Under the FTC Safeguards Rule, a covered company either runs continuous monitoring or does both of these: penetration testing at least annually and vulnerability assessments, including system wide scans, every six months. Pick one path on purpose, write down which, and keep dated results for each cycle.
The two paths
The FTC guidance describes the testing requirement this way: use continuous monitoring, or otherwise conduct penetration testing annually and vulnerability assessments every six months. The rule text should be read by your counsel, but the shape is simple.
Path one is continuous monitoring. You need to be able to explain what is monitored, how often, and who reviews the output. A scanner that runs once a quarter and nobody reads does not tell that story.
Path two is the calendar. One pen test a year. Two vulnerability assessments a year, six months apart, covering systems broadly rather than a hand picked sample.
Pen test versus vulnerability scan
They answer different questions. A scan lists known weaknesses across many assets and is mostly automated. A pen test is a person trying to chain weaknesses into real access. Treat them as separate line items, with separate reports.
What a clean evidence trail looks like
For each cycle, keep:
- the scope, including which systems hold customer information
- the date and the tester or tool
- the findings with severity
- a ticket per finding with owner and outcome
- a retest or closure note
A finding with no ticket is a finding you cannot defend later.
Common gaps
Scope drift is the big one. A new service ships in March and is missing from the September scan. Tie your asset inventory to the scan scope so new services appear automatically.
The second gap is dependency risk. A network scan will not tell you that a library in your payment service has a known flaw. Software composition scanning in CI fills that hole, and reachability analysis helps decide which findings matter first.
The third gap is findings that age out. Set a target for closure by severity, and report on it at the annual board or senior officer review the rule requires.
Where Safeguard fits
Safeguard's dependency and SBOM scanning, reachability analysis and compliance evidence automation can supply part of the continuous side. It does not replace a human pen test. A free scan is at gold.safeguard.sh/scan.
A first quarter plan
In week one, choose the path and write it in one paragraph that the Qualified Individual signs off. In week two, list every system that holds customer information and confirm each is in scan scope. By the end of month one, book the pen test with a date and a budget, and put both six month scan dates in a shared calendar. In month two, agree closure targets by severity and start tracking them. In month three, produce a one page summary of results so far. That page becomes the seed of the annual written report to the board or senior officer.
Quick check
Is a pen test needed every year if we monitor continuously?
According to the FTC summary, the annual pen test and six month assessments apply when you do not have continuous monitoring. Confirm your reading with counsel.
Sources
Last reviewed: 19 October 2026.
