"We need a pentest for compliance" is one of the most common reasons US organizations commission security testing. But the US has no single cybersecurity law. Instead, federal agencies, state regulators, card brands and auditors each set their own expectations for scope, frequency and evidence. This guide summarizes what the main US rules and frameworks say about testing, so you can scope one test that satisfies as many of them as possible.
FTC Safeguards Rule (GLBA)
The FTC Safeguards Rule (16 CFR 314) applies to non-bank financial institutions such as mortgage brokers, auto dealers that offer financing, tax preparers, payday lenders and fintech lenders. Section 314.4(d)(2) requires either effective continuous monitoring or periodic testing: an annual penetration test, with scope based on your risk assessment, plus vulnerability assessments at least every six months and after material changes. The FTC has described this as one, not both.
Institutions that maintain customer information on fewer than 5,000 consumers are exempt from those testing requirements under 314.6, although other duties remain. Since May 13, 2024, covered institutions must also notify the FTC as soon as possible, and no later than 30 days after discovery, of unauthorized acquisition of unencrypted information involving at least 500 consumers. Our FTC Safeguards Rule guide covers this in detail.
NYDFS 23 NYCRR Part 500
Banks, insurers and other financial services companies regulated by the New York State Department of Financial Services must meet Part 500, which was amended in November 2023. Section 500.5 requires penetration testing at least annually by a qualified internal or external independent party, alongside vulnerability management that includes automated scans. Cybersecurity events generally must be reported to DFS within 72 hours under section 500.17, so monitoring and incident readiness matter as much as testing.
PCI DSS v4.0 and v4.0.1
PCI DSS is the most explicit standard about penetration testing. Requirement 11.4 calls for a defined methodology and internal and external penetration testing at least every 12 months and after any significant change, with exploitable findings fixed and retested. Where segmentation is used to reduce scope, it must be tested at least annually for merchants and every six months for service providers. Requirement 11.3 adds quarterly internal and external vulnerability scans, and external scans must be run by a PCI SSC Approved Scanning Vendor (ASV). We are not an ASV or a QSA, so agree scope with your acquirer or QSA.
HIPAA Security Rule
Today, the HIPAA Security Rule requires covered entities and business associates to perform a risk analysis and a periodic technical evaluation of their safeguards (45 CFR 164.308). It does not name penetration testing, but a pentest is a common way to support both. In January 2025, HHS published a proposed update that would require penetration testing at least annually and regular vulnerability scanning. That rule is proposed, not final, and the federal Unified Agenda projects a final rule in 2027. Many healthcare organizations are building the habit now.
SOC 2
SOC 2 reports are issued by independent CPA firms against the AICPA Trust Services Criteria. The criteria don't name penetration testing, but auditors and enterprise customers commonly expect an annual third-party test as evidence for monitoring and risk criteria such as CC4.1 and CC7.1. See our SOC 2 penetration testing guide.
CMMC 2.0 and NIST SP 800-171
Defense contractors handling Federal Contract Information or Controlled Unclassified Information fall under CMMC. Level 2 follows the 110 requirements of NIST SP 800-171 Rev 2, which include vulnerability scanning and periodic security assessments but don't name penetration testing. Level 3 adds enhanced requirements from NIST SP 800-172, including penetration testing at least annually. From November 10, 2026, Level 2 certification by a C3PAO becomes a condition of award for applicable contracts. Read our CMMC guide.
FedRAMP
Cloud service providers with a FedRAMP authorization must have annual penetration testing performed by a FedRAMP-recognized Third Party Assessment Organization (3PAO). We are not a 3PAO. Internal pre-assessment testing can still help you find issues before the 3PAO does.
SEC cybersecurity disclosure
Under rules adopted in 2023, public companies must disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining that an incident is material, and describe their cybersecurity risk management, strategy and governance in the annual 10-K. The rules don't require penetration testing, but a regular testing program is one of the clearest ways to show that the risk management described in the 10-K is real.
State privacy and breach notification laws
California's CCPA, as amended by the CPRA, and a growing number of other state comprehensive privacy laws require reasonable security for personal information. All 50 states have breach notification laws. None of these names penetration testing, but testing and remediation records help show that your security was reasonable if an incident happens.
Quick reference
| Rule or framework | Pentest explicitly required? | Frequency | Typical evidence |
|---|---|---|---|
| FTC Safeguards Rule | Yes, unless effective continuous monitoring | Annual pentest; vulnerability assessments every 6 months | Test reports, risk assessment, remediation |
| NYDFS Part 500 | Yes (500.5) | At least annually | Independent test report, scan records |
| PCI DSS v4.0 | Yes (Req. 11.4) | 12 months + after significant change | Internal, external, segmentation reports |
| HIPAA Security Rule | No (annual testing proposed, not final) | Risk-based; periodic evaluation | Risk analysis, evaluation, test reports |
| SOC 2 | No (commonly expected) | Annual is typical | Third-party report, remediation records |
| CMMC Level 2 / Level 3 | Level 2 no; Level 3 yes (3.12.1e) | Level 3: at least annually | Scans, assessments, test reports |
| FedRAMP | Yes, by a 3PAO | Annual | 3PAO penetration test report |
Scoping one test for several rules
- List every rule, framework and customer contract that applies, and note what each one requires.
- Start from the strictest requirement, often PCI DSS or NYDFS, and check that the scope covers the others.
- Ask for a report that maps findings to each framework, plus an attestation letter for customers.
- Book the retest before your audit or certification date so the evidence shows issues as fixed.
Frequently asked questions
Is penetration testing legally required in the US?
No single federal law requires every business to run a penetration test. Several rules do require it for the organizations they cover: the FTC Safeguards Rule (annually, unless you run effective continuous monitoring), NYDFS Part 500 (at least annually) and PCI DSS (at least every 12 months). Others, such as SOC 2, make it a common expectation.
Does HIPAA require penetration testing?
Not today. The HIPAA Security Rule requires a risk analysis and periodic technical evaluation. HHS published a proposed update in January 2025 that would require penetration testing at least annually, but it is a proposal, not a final rule.
Need a test that satisfies several US requirements at once? Request a scoped proposal or see our compliance services.