How Often Should You Pen Test? What Standards Say

Pen test at least once a year and again after any significant change to the system. That is the PCI DSS baseline, and it is a sensible floor for most teams that handle sensitive data. Some regimes set other intervals, such as every three years for threat-led tests under the EU's DORA. Between tests, scan continuously.

Key takeaways

• PCI SSC guidance says penetration tests are required at least annually and after any significant change.
• PCI SSC does not define "significant change". The entity decides, using its own risk assessment.
• DORA requires threat-led penetration testing at least every 3 years for in-scope financial entities, and appropriate testing at least yearly on systems supporting critical functions.
• NIST SP 800-53 control CA-8 leaves the frequency to the organization.
• A yearly test leaves long gaps. The UK NCSC says a year or more between tests is not uncommon, which is why routine scanning must continue.

How often does PCI DSS require a penetration test?

At least once a year and after any significant change. The PCI SSC penetration testing guidance (version 1.1, September 2017) says penetration testing must be performed at least annually and after any significant change, for example an infrastructure or application upgrade or modification, or new system component installations. It adds that some entities may need to test more often.

The guidance cites the requirement numbering from the earlier PCI DSS version, so confirm the current requirement numbers in the standard itself. The cadence has stayed the same in the guides we read.

What counts as a significant change?

You decide, and you document the reasoning. The PCI SSC guidance says what is significant depends on your risk assessment and your environment, and that PCI DSS does not prescribe it. Its test is practical: if the change could affect network security or allow access to cardholder data, you may treat it as significant. Its purpose is to confirm that controls assumed to be in place still work after the change.

A workable internal rule might include a new internet-facing system, a new authentication method, a change to network segmentation, a move between cloud providers or a major release. Write the list down so an assessor sees a rule, not a judgment made after the fact.

What does DORA require?

DORA applies to EU financial entities and has two relevant rules. Article 24(6) says entities other than microenterprises must ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions. Article 26 says entities identified under that article, other than microenterprises, must carry out advanced testing by means of threat-led penetration testing at least every 3 years.

The competent authority may adjust the frequency based on the entity's risk profile. If you are in scope, read the articles and your regulator's guidance.

What does NIST say?

NIST leaves it to you. Control CA-8 in NIST SP 800-53 Revision 5 says to conduct penetration testing at an organization-defined frequency on organization-defined systems. Its first enhancement, which applies in the high baseline, calls for an independent penetration testing agent or team.

NIST SP 800-115 adds a general principle from the FISMA statute: periodic testing of security controls should be done at a frequency depending on risk, but no less than annually.

What about SOC 2, ISO 27001 and HIPAA?

We did not find a primary source that sets a pen test interval for these. We did not fetch the AICPA text for SOC 2, so we make no claim about it here. Vendor commentary says auditors commonly expect a test once per audit period, but that is opinion, not standard text.

Ask your auditor or customer for the written requirement, and keep their answer with your evidence.

What testing cadence works between pen tests?

Run scans on every change and on a schedule, and keep pen tests for assurance. The UK NCSC describes a pen test as assurance over your own vulnerability management, and says planned tests do not replace routine testing of the system. PCI guidance puts vulnerability scans at least quarterly and after significant changes.

For dependencies, a scan on every pull request catches what a yearly test cannot. Try the free in-browser scan at gold.safeguard.sh/scan, which needs no login and keeps your file on your machine.

How to choose your cadence

• Start with the written requirement: PCI DSS, DORA, customer contract or your own policy.
• If none applies, test at least once a year and after any major release or infrastructure change.
• Define "significant change" in a short written rule.
• Add a test when you handle new data types, add a public API or change authentication.
• Scan continuously and fix findings before the next pen test so paid time goes further.
• Keep retest evidence with each report. See pen test retest evidence.

Frequently asked questions

Sources

• PCI Security Standards Council, Penetration Testing Guidance v1.1, September 2017
• EU Regulation 2022/2554 (DORA), Articles 24 and 26
• NIST SP 800-53 Rev 5, CA-8 Penetration Testing, text as reproduced by CSF Tools
• NIST SP 800-115
• NCSC, Penetration testing

Last reviewed: 19 October 2026.