Skip to content
AI Pentest
← All guides

Which regulations require penetration testing? A UK guide

PCI DSS, SOC 2, ISO 27001, DORA, UK GDPR, NHS DSPT and Cyber Essentials — which explicitly require penetration testing and which simply expect it.

7 November 2026 · 6 min read

Explicitly required

  • PCI DSS v4.0 — Requirement 11.4: at least annually and after significant changes, for in-scope environments
  • DORA (EU) — annual resilience testing, plus threat-led penetration testing every three years for designated financial entities

Expected in practice

  • SOC 2 — not named as mandatory, but most auditors expect a recent pentest as evidence for vulnerability monitoring
  • ISO 27001:2022 — risk-based; pentests commonly evidence controls A.8.8 and A.8.29
  • NHS DSPT and DTAC — suppliers are commonly asked for penetration test evidence
  • UK GDPR Article 32 — requires regular testing of security measures; the ICO points to penetration testing

Not a pentest, but related

Cyber Essentials Plus includes a technical audit with vulnerability scanning, but doesn’t test your web application’s logic. Many organisations need both.

Contracts often matter more

Enterprise customers, insurers and public-sector buyers frequently require annual penetration testing in contracts and questionnaires, regardless of regulation.

Learn more

See our pages for each standard under Penetration testing → By regulation and standard, or start with a complimentary AI pentest.