Pentest Evidence for SOC 2, ISO 27001, PCI DSS, DORA

Global frameworks

Global · CC4.1 and CC7.1

What it asks for: Penetration testing is not explicitly required. It appears as a point of focus under CC4.1, and vulnerability scanning under CC7.1. Many auditors expect pentest or scan evidence.
Syber evidence: Findings, fixes and retests you can offer as evidence for CC4.1, and as supporting evidence for CC7.1, at your auditor's discretion.
Who signs: Your SOC 2 auditor; Syber produces the evidence.
Source: risk3sixty.com

Global · Annex A.8.8 and A.8.29

What it asks for: Penetration testing is not named as mandatory. Annex A.8.8 covers management of technical vulnerabilities and A.8.29 covers security testing in development and acceptance. Auditors commonly accept pentest reports as evidence for these controls.
Syber evidence: Findings, fixes and retests you can offer as evidence for A.8.8, and for A.8.29 where testing covers pre-release builds.
Who signs: Your certification body; Syber produces the evidence.
Source: isms.online

Global · Payment card data

What it asks for: Internal and external penetration tests at least every twelve months and after significant changes, with exploitable findings fixed and retested (11.4.4).
Syber evidence: Proof, fix and retest evidence mapped to 11.4.4.
Who signs: Your QSA or internal assessor; Syber produces the evidence.
Source: pcisecuritystandards.org

United States · 45 CFR 164.308

What it asks for: The current rule requires a thorough risk analysis and periodic technical evaluation, but names no penetration test or fixed frequency. A proposed 2025 update would require vulnerability scanning at least every six months and penetration testing at least every twelve months, but it is not final.
Syber evidence: Testing and evidence that support the risk-analysis and evaluation requirements.
Who signs: The rule names no external sign-off; Syber produces testing evidence for your risk analysis and evaluation.
Source: law.cornell.edu

EU · Financial entities · Articles 24 to 26

What it asks for: EU financial entities must run a risk-based digital operational resilience testing program, which can include vulnerability assessments and penetration testing (Articles 24 and 25). Entities their authority designates must also run threat-led penetration testing at least every three years (Article 26).
Syber evidence: Continuous testing, proofs-of-concept, fixes and dated retests that document your testing program between threat-led exercises.
Who signs: Threat-led tests follow TIBER-EU style rules with qualified testers. Syber delivers alongside licensed partners where required.
Source: eur-lex.europa.eu

EU · Essential and important entities · Article 21

What it asks for: Article 21(2)(f) requires policies and procedures to assess whether cybersecurity risk-management measures are effective. The directive does not name penetration testing; for some digital entities, Implementing Regulation (EU) 2024/2690 requires security testing and leaves the method to the entity.
Syber evidence: Repeated, documented testing of whether your controls hold against real attack paths.
Who signs: No external sign-off is named. Syber produces the evidence.
Source: eur-lex.europa.eu

India · Banks, NBFCs and AIFIs

What it asks for: Issued July 31, 2026 for banks, NBFCs and AIFIs; the full VA/PT chapter applies to Top-, Upper- and Middle-Layer NBFCs. Vulnerability assessments of critical and customer-facing systems at least every six months, penetration tests at least every twelve months, and testing of critical internet-facing apps before go-live, after go-live and after changes, with closure status reported to IT and security committees at least quarterly. Testing must be done by trained, independent security experts or auditors.
Syber evidence: A proof-of-concept per finding and timestamped retests after changes, supporting your after-change testing record.
Who signs: Trained, independent security experts or auditors. Where you need that independence, Syber delivers alongside licensed partners.
Source: rbi.org.in

India · Non-bank payment system operators

What it asks for: Security testing of all applications, including source code review and authenticated VA/PT, at least annually by qualified professionals, reported to the IT oversight sub-committee. Applies to large PSOs from April 1, 2025, medium from April 1, 2026 and small from April 1, 2028.
Syber evidence: Proven findings and dated retests for your IT oversight sub-committee.
Who signs: Qualified professionals. Where you need an outside signatory, Syber delivers alongside licensed partners.
Source: rbi.org.in

India · SEBI-regulated entities

What it asks for: VAPT at least once a year, or twice a year for entities NCIIPC has identified as critical information infrastructure or protected systems and for Qualified Stock Brokers, plus after every major release and before new systems go live. A CERT-In empaneled auditing organization performs the audit, including VAPT, and findings must close within three months of the report.
Syber evidence: Proven findings, fixes and dated retests between audits, to track closure against the three-month deadline.
Who signs: A CERT-In empaneled auditing organization. Syber tests between audits and, for the audit itself, delivers alongside licensed partners.
Source: sebi.gov.in

India · IRDAI-regulated entities · From FY 2026-27

What it asks for: From FY 2026-27, gray-box or white-box penetration testing of all internet-facing assets at least every six months by a CERT-In empaneled auditor, plus an annual audit by an empaneled auditor.
Syber evidence: Continuous testing and dated retests between the half-yearly tests, so changes between cycles have their own record.
Who signs: A CERT-In empaneled auditor does the half-yearly test and the annual audit. For that work, Syber delivers alongside licensed partners.
Source: irdai.gov.in

India · CERT-In

What it asks for: The 2022 directions set no testing frequency, but require specified incidents to be reported within six hours and ICT logs kept in India for 180 days. The 2025 guidelines expect a comprehensive ICT audit at least once a year that scores findings with CVSS and EPSS and does not rely only on automated tools. High-risk tests such as PT, DoS and social engineering need prior written consent.
Syber evidence: Dated findings, proofs-of-concept, fixes and retests your auditor can review. Incident reporting and log retention stay with your team.
Who signs: Where a CERT-In empaneled auditor is required, Syber delivers alongside licensed partners.
Source: cert-in.org.in (PDF) · it.delhi.gov.in (PDF)

India · Most obligations from May 2027

What it asks for: Section 8(5) requires reasonable security safeguards to prevent a personal data breach, with penalties of up to ₹250 crore from May 2027. The Act does not name penetration testing.
Syber evidence: A documented, repeated testing record: one way to show your safeguards are reasonable.
Who signs: The safeguards duty names no auditor. Significant Data Fiduciaries also owe periodic DPIAs and independent audits. Syber produces the testing record.
Source: pib.gov.in (PDF)