Which rules require a pentest, and how often.

PCI DSS 4.0: required, annually and after change

Requirement 11.4 of PCI DSS 4.0 is the most specific of the three. In plain terms, it asks for:

• A documented methodology based on industry-accepted approaches (NIST SP 800-115 is the usual reference), covering the whole cardholder data environment perimeter and critical systems, from inside and outside the network.
• External and internal penetration testing at least once every 12 months and after any significant infrastructure or application change.
• Exploitable vulnerabilities and security weaknesses corrected, then retested to confirm the fix.
• If you use segmentation to shrink scope, testing that the segmentation works: annually for merchants, every six months for service providers.
• A tester who is qualified and organizationally independent. It doesn’t have to be an outside firm, but most organizations use one.

What to ask a firm: will the report map to 11.4, does the price include the retest, and will they test segmentation if you rely on it.

SOC 2: not mandated, usually expected

The AICPA Trust Services Criteria don’t require a penetration test. Under CC4.1 (monitoring activities), they list penetration testing among the kinds of separate evaluations management can use, next to independent certifications and internal audit. In practice most auditors ask to see a recent pentest for a Type II report, especially for a SaaS product, and many enterprise customers ask for the report directly in security questionnaires.

What to ask a firm: a report you can hand to customers (an executive letter or attestation summary as well as the full findings), and a retest letter once fixes are in.

HIPAA: evaluation required today, a pentest proposed

The Security Rule in force requires a risk analysis (45 CFR 164.308(a)(1)) and periodic technical and nontechnical evaluation (164.308(a)(8)). It doesn’t name penetration testing. Many covered entities use a pentest to meet the evaluation requirement and to support the risk analysis.

On January 6, 2025, HHS published a proposed rule that would add a vulnerability-management requirement including penetration testing at least once every 12 months. As of November 8, 2026 the Federal Register shows it as a proposed rule only; check its status before relying on it either way.