Which US Regulations Actually Require a Penetration Test?

For most private companies, three sets of rules say the words "penetration testing" in their own binding text: PCI DSS, the FTC's GLBA Safeguards Rule, and New York's Part 500. If you sell to government, add FedRAMP and CMMC Level 3. Almost everything else requires you to test and leaves the method to you, or doesn't require testing at all.

That's the distinction this post is about. "Required by regulation" and "expected by your auditor" are different claims, and mixing them up is how companies either overbuy or walk into an assessment unprepared.

Find yourself in the table, then read the section that matches. This is general information, not legal advice.

The short version

If you take card payments: PCI DSS

PCI DSS applies if you store, process or transmit cardholder data. It is a contractual standard enforced by the card brands and your acquiring bank rather than a statute, but the obligation is real and the wording is not vague.

Requirement 11.4 of PCI DSS v4.x calls for external and internal penetration testing at least once every 12 months and after any significant infrastructure or application change, following a defined methodology, with exploitable findings corrected and the test repeated to verify the fix. Entities that use network segmentation to shrink scope have to test the segmentation too. Service providers test segmentation more often than merchants do.

The nuance that saves small merchants money: the self-assessment questionnaires are not all the same length. A merchant on the shortest SAQ, where card data never touches their systems because checkout is fully redirected to a validated third party, is not answering Requirement 11.4 at all. A merchant on SAQ D is. Ask your acquirer which SAQ applies before you buy any testing, because that answer changes what you owe.

If you handle health data: HIPAA

The HIPAA Security Rule binds covered entities (health plans, providers, clearinghouses) and their business associates, which is how a five-person SaaS company processing patient records ends up in scope.

Be precise about what the rule says, because a lot of vendors are not. The Security Rule does not use the phrase "penetration test" anywhere. It requires a risk analysis, described at 45 CFR 164.308 as an accurate and thorough assessment of risks and vulnerabilities to electronic protected health information, and a periodic technical and nontechnical evaluation of whether your safeguards still meet the rule. Testing is implied. The method is yours to choose.

That may change. HHS published a proposed overhaul of the Security Rule in January 2025 that would name specific technical controls, including penetration testing and vulnerability scanning on fixed schedules. Check the HHS Security Rule page for its current status rather than trusting any summary, this one included. Until a final rule lands, the obligation is still risk analysis and evaluation.

If your buyers ask for SOC 2

SOC 2 is not a regulation. It is an audit against the AICPA's Trust Services Criteria, and nobody can fine you for not having one. The criteria name penetration testing as one way to show your monitoring works, which isn't the same as requiring it. In practice most auditors expect one anyway.

We wrote that up separately in does SOC 2 require a pen test, including what auditors check and when to schedule the test.

If you sell to federal agencies: FedRAMP

FedRAMP applies to cloud service providers that want federal agencies as customers. Penetration testing is explicit here, it is annual, and it has to be performed by an accredited third-party assessment organisation against defined attack vectors. You cannot do it yourself and you cannot do it cheaply.

FedRAMP has been reworking its authorisation process, so read the current requirements on fedramp.gov rather than an older guidance PDF someone sent you. GovRAMP (called StateRAMP until 2025), which does the same job for state and local government buyers, mirrors the federal model closely.

If you are in the defense supply chain: NIST SP 800-171 and CMMC

If your contract or subcontract involves controlled unclassified information, you are in NIST SP 800-171 territory, and increasingly in CMMC territory as the Defense Department phases the requirement into contracts.

SP 800-171 does not name penetration testing. Its security assessment control requires you to periodically assess your controls to determine whether they are effective, which is a method-open requirement in the same family as HIPAA's. CMMC Level 2 is built on those 800-171 requirements, so Level 2 does not name pen testing either.

CMMC Level 3 is different. It draws on NIST SP 800-172, which does call for penetration testing using automated tooling and expert-led ad hoc testing. Check the current rule and your contract clauses on the DoD CIO CMMC site, since the phase-in schedule determines what your next award asks for.

If the FTC thinks you are a financial institution: GLBA

This one catches more companies than any other rule on the list, because the FTC defines "financial institution" by activity rather than by signage. Mortgage brokers, auto dealers that arrange financing, tax preparers, payday lenders, collection agencies and finders are all in scope. So are a lot of fintech companies that have never thought of themselves as banks.

The Safeguards Rule at 16 CFR Part 314 names penetration testing directly, and it does it as an either/or. You either run continuous monitoring of your information systems, or you do annual penetration testing plus vulnerability assessments at least every six months. Most small companies do not have continuous monitoring in the sense the FTC means, which leaves the annual test.

The FTC's own plain-English guide is short and worth reading in full. Small companies get a break: if you hold information on fewer than 5,000 consumers, 16 CFR 314.6 exempts you from a few provisions, and the pen test requirement is one of them. Check your count before assuming the full programme applies.

If you are licensed in New York: Part 500

New York's Department of Financial Services regulates banks, insurers, mortgage servicers, money transmitters and virtual currency businesses licensed in the state. Part 500 is the most prescriptive cybersecurity rule any small US company is likely to meet.

On testing it is unambiguous. Covered entities must conduct penetration testing of their information systems "from both inside and outside the information systems' boundaries by a qualified internal or external party" at least annually. No alternative, no method-open language, and automated scanning does not substitute for it.

Part 500 has limited exemptions for very small entities based on headcount, New York revenue and total assets, and the penetration testing requirement is one of the provisions those exemptions can reach. Read the exemption section against your own numbers before you assume either way.

If you are a bank or a credit union

Depository institutions sit under GLBA section 501(b) rather than the FTC rule, implemented through the interagency Information Security Standards in the banking agencies' regulations and, for credit unions, the NCUA's equivalent. Those standards require regular testing of key controls, systems and procedures. They do not name penetration testing.

Examiner expectations are a different matter. The FFIEC IT Examination Handbook discusses penetration testing by name as part of an assurance programme, and examiners ask about it. So the rule leaves the method open and the guidance closes it. If you are a bank, your compliance team already knows this and you are not buying a $495 test to satisfy an examiner.

If you just hold consumer data: state privacy law

California's CCPA, as amended by the CPRA, plus the general consumer privacy laws in Colorado, Connecticut, Texas, Virginia and a growing list of others, all impose some version of a duty to use reasonable security measures appropriate to the data. None of those statutes names penetration testing. California's private right of action for data breaches turns on whether your security was reasonable, which is where evidence of testing earns its keep.

The California Privacy Protection Agency went further in regulations adopted in 2025, which require annual cybersecurity audits for businesses above defined thresholds and enumerate the components the audit has to assess. Penetration testing appears in that enumeration. The audits phase in by business size over several years, so check the CPPA regulations page for your date.

Two older state rules are worth knowing because they are often quoted at you in questionnaires. New York's SHIELD Act requires reasonable safeguards including regular testing and monitoring of key controls, and Massachusetts 201 CMR 17.00 requires a written information security programme with regular monitoring. Neither names a pen test. Most state insurance data security laws, built on the NAIC model, follow the same pattern of requiring testing without prescribing it.

If you are public: the SEC rules are about disclosure

The SEC's cybersecurity rules, adopted in July 2023, require registrants to report material cybersecurity incidents on Form 8-K and to describe their risk management, strategy and governance in annual filings, including whether they engage outside assessors or consultants.

Plainly: the SEC rules govern what you tell investors, not what you test. They do not require a penetration test. What they do is make the absence of one something you may have to describe, which is a softer incentive pointing the same direction.

Named versus left open

Here's the answer in one place, since it's the only part of this post worth memorising.

Name penetration testing outright: PCI DSS Requirement 11.4, the FTC's GLBA Safeguards Rule (as one branch of an either/or), NYDFS Part 500, FedRAMP and GovRAMP through their assessment requirements, CMMC Level 3 via NIST SP 800-172, California's cybersecurity audit regulations for the businesses they cover, and (not a law, but often asked for) HITRUST CSF certification.

Require testing or evaluation, method left to you: the HIPAA Security Rule, NIST SP 800-171 and therefore CMMC Level 2, the interagency banking security standards, the SHIELD Act, Massachusetts 201 CMR 17.00, and the reasonable-security duties in state privacy laws. SOC 2 belongs here too, with pen testing named as an option rather than a mandate.

Require neither: the SEC disclosure rules. They ask what you do, not that you do it.

Where our $495 test fits, and where it does not

An external web application test is the right purchase when you're a small SaaS company answering a customer questionnaire that asks for an independent test in the last 12 months. It also fits when you're building a reasonable-security record under CCPA or the GLBA Safeguards Rule, where what matters is a dated third-party report plus a remediation log, or when you need the external piece of a bigger programme run elsewhere.

It is not a FedRAMP assessment, a CMMC assessment, a PCI engagement covering internal testing and segmentation, or a HIPAA security evaluation. Those need internal network work, scoped assessors, or both, and no $495 test substitutes for a QSA, a 3PAO or a C3PAO. If you are in one of those regimes, buy the engagement your assessor will accept and treat this as the wrong tool.

For most readers the truth is simpler: no US regulator is demanding a pen test of you, and a customer probably is. That is covered in your first security questionnaire.

Start by looking

Before you decide which regime you are buying for, find out what is actually exposed. The free scan checks what is visible on your domain right now and takes a couple of minutes.

If you already know you need the report, the $495 external test comes back within 24 hours with findings written for a customer to read, and an attestation letter you can attach to a questionnaire. If you are not sure whether that is the right thing to buy, say what regime you are in and we will tell you if it is not.