Three sets of US rules say the words "penetration testing" in their own binding text: PCI DSS, the FTC's GLBA Safeguards Rule, and New York's Part 500. Everything else either requires you to test and leaves the method to you, or does not require testing at all.
That distinction is the whole point of this post. "Required by regulation" and "expected by your auditor" are different claims, and mixing them up is how companies either overbuy or walk into an assessment unprepared.
Find yourself in the table, then read the section that matches. This is general information, not legal advice.
The short version
| Rule or framework | Who it applies to | Says "penetration test"? |
|---|---|---|
| PCI DSS v4.x | Anyone storing, processing or transmitting card data | Yes. Requirement 11.4, internal and external |
| HIPAA Security Rule | Covered entities and their business associates | No. Risk analysis and periodic evaluation instead |
| SOC 2 | Not a regulation. Any vendor whose buyers ask for it | Named as one option, not mandated |
| FedRAMP | Cloud providers selling to federal agencies | Yes, in the assessment requirements |
| NIST SP 800-171 and CMMC | Defense contractors and subcontractors handling CUI | 800-171: no. CMMC Level 3: yes, via SP 800-172 |
| GLBA Safeguards Rule | FTC-defined financial institutions, which is a wide net | Yes, unless you run continuous monitoring instead |
| NYDFS Part 500 | Entities licensed under New York financial services law | Yes, and it is the most specific of the lot |
| FFIEC guidance and the interagency GLBA standards | Banks and credit unions | Guidance: yes. The rules themselves: no |
| State privacy laws | Businesses holding consumer personal data | Statutes: no. California's audit regulations: yes |
| SEC cyber disclosure rules | Public companies | No. These are disclosure rules |
If you take card payments: PCI DSS
PCI DSS applies if you store, process or transmit cardholder data. It is a contractual standard enforced by the card brands and your acquiring bank rather than a statute, but the obligation is real and the wording is not vague.
Requirement 11.4 of PCI DSS v4.x calls for external and internal penetration testing at least once every 12 months and after any significant infrastructure or application change, following a defined methodology, with exploitable findings corrected and the test repeated to verify the fix. Entities that use network segmentation to shrink scope have to test the segmentation too. Service providers test segmentation more often than merchants do.
The nuance that saves small merchants money: the self-assessment questionnaires are not all the same length. A merchant on the shortest SAQ, where card data never touches their systems because checkout is fully redirected to a validated third party, is not answering Requirement 11.4 at all. A merchant on SAQ D is. Ask your acquirer which SAQ applies before you buy any testing, because that answer changes what you owe.
If you handle health data: HIPAA
The HIPAA Security Rule binds covered entities (health plans, providers, clearinghouses) and their business associates, which is how a five-person SaaS company processing patient records ends up in scope.
Be precise about what the rule says, because a lot of vendors are not. The Security Rule does not use the phrase "penetration test" anywhere. It requires a risk analysis, described at 45 CFR 164.308 as an accurate and thorough assessment of risks and vulnerabilities to electronic protected health information, and a periodic technical and nontechnical evaluation of whether your safeguards still meet the rule. Testing is implied. The method is yours to choose.
That may change. HHS published a proposed overhaul of the Security Rule in January 2025 that would name specific technical controls, including penetration testing and vulnerability scanning on fixed schedules. Check the HHS Security Rule page for its current status rather than trusting any summary, this one included. Until a final rule lands, the obligation is still risk analysis and evaluation.
If your buyers ask for SOC 2
SOC 2 is not a regulation. It is an audit against the AICPA's Trust Services Criteria, and nobody can fine you for not having one. The criteria name penetration testing as one way to show your monitoring works, which is not the same as requiring it, and in practice almost every auditor expects one anyway.
We wrote that up separately in does SOC 2 require a pen test, including what auditors check and when to schedule the test.
If you sell to federal agencies: FedRAMP
FedRAMP applies to cloud service providers that want federal agencies as customers. Penetration testing is explicit here, it is annual, and it has to be performed by an accredited third-party assessment organisation against defined attack vectors. You cannot do it yourself and you cannot do it cheaply.
FedRAMP has been reworking its authorisation process, so read the current requirements on fedramp.gov rather than an older guidance PDF someone sent you. StateRAMP, which does the same job for state and local government buyers, mirrors the federal model closely.
If you are in the defense supply chain: NIST SP 800-171 and CMMC
If your contract or subcontract involves controlled unclassified information, you are in NIST SP 800-171 territory, and increasingly in CMMC territory as the Defense Department phases the requirement into contracts.
SP 800-171 does not name penetration testing. Its security assessment control requires you to periodically assess your controls to determine whether they are effective, which is a method-open requirement in the same family as HIPAA's. CMMC Level 2 is built on those 800-171 requirements, so Level 2 does not name pen testing either.
CMMC Level 3 is different. It draws on NIST SP 800-172, which does call for penetration testing using automated tooling and expert-led ad hoc testing. Check the current rule and your contract clauses on the DoD CIO CMMC site, since the phase-in schedule determines what your next award asks for.
If the FTC thinks you are a financial institution: GLBA
This one catches more companies than any other rule on the list, because the FTC defines "financial institution" by activity rather than by signage. Mortgage brokers, auto dealers that arrange financing, tax preparers, payday lenders, collection agencies and finders are all in scope. So are a lot of fintech companies that have never thought of themselves as banks.
The Safeguards Rule at 16 CFR Part 314 names penetration testing directly, and it does it as an either/or. You either run continuous monitoring of your information systems, or you do annual penetration testing plus vulnerability assessments at least every six months. Most small companies do not have continuous monitoring in the sense the FTC means, which leaves the annual test.
The FTC's own plain-English guide is short and worth reading in full. If you are small enough, parts of the rule are relaxed, so check the customer-count threshold before assuming the full programme applies.
If you are licensed in New York: Part 500
New York's Department of Financial Services regulates banks, insurers, mortgage servicers, money transmitters and virtual currency businesses licensed in the state. Part 500 is the most prescriptive cybersecurity rule any small US company is likely to meet.
On testing it is unambiguous. Covered entities must conduct penetration testing of their information systems "from both inside and outside the information systems' boundaries by a qualified internal or external party" at least annually. No alternative, no method-open language, and automated scanning does not substitute for it.
Part 500 has limited exemptions for very small entities based on headcount, New York revenue and total assets, and the penetration testing requirement is one of the provisions those exemptions can reach. Read the exemption section against your own numbers before you assume either way.
If you are a bank or a credit union
Depository institutions sit under GLBA section 501(b) rather than the FTC rule, implemented through the interagency Information Security Standards in the banking agencies' regulations and, for credit unions, the NCUA's equivalent. Those standards require regular testing of key controls, systems and procedures. They do not name penetration testing.
Examiner expectations are a different matter. The FFIEC IT Examination Handbook discusses penetration testing by name as part of an assurance programme, and examiners ask about it. So the rule leaves the method open and the guidance closes it. If you are a bank, your compliance team already knows this and you are not buying a $495 test to satisfy an examiner.
If you just hold consumer data: state privacy law
California's CCPA, as amended by the CPRA, plus the comprehensive privacy laws in Colorado, Connecticut, Texas, Virginia and a growing list of others, all impose some version of a duty to use reasonable security measures appropriate to the data. None of those statutes names penetration testing. California's private right of action for data breaches turns on whether your security was reasonable, which is where evidence of testing earns its keep.
The California Privacy Protection Agency went further in regulations adopted in 2025, which require annual cybersecurity audits for businesses above defined thresholds and enumerate the components the audit has to assess. Penetration testing appears in that enumeration. The audits phase in by business size over several years, so check the CPPA regulations page for your date.
Two older state rules are worth knowing because they are often quoted at you in questionnaires. New York's SHIELD Act requires reasonable safeguards including regular testing and monitoring of key controls, and Massachusetts 201 CMR 17.00 requires a written information security programme with regular monitoring. Neither names a pen test. Most state insurance data security laws, built on the NAIC model, follow the same pattern of requiring testing without prescribing it.
If you are public: the SEC rules are about disclosure
The SEC's cybersecurity rules, adopted in July 2023, require registrants to report material cybersecurity incidents on Form 8-K and to describe their risk management, strategy and governance in annual filings, including whether they engage outside assessors or consultants.
Say this plainly: the SEC rules govern what you tell investors, not what you test. They do not require a penetration test. What they do is make the absence of one something you may have to describe, which is a softer incentive pointing the same direction.
Named versus left open
Collecting the answer in one place, because it is the only part of this post worth memorising.
Name penetration testing outright: PCI DSS Requirement 11.4, the FTC's GLBA Safeguards Rule (as one branch of an either/or), NYDFS Part 500, FedRAMP and StateRAMP through their assessment requirements, CMMC Level 3 via NIST SP 800-172, and HITRUST CSF certification.
Require testing or evaluation, method left to you: the HIPAA Security Rule, NIST SP 800-171 and therefore CMMC Level 2, the interagency banking security standards, the SHIELD Act, Massachusetts 201 CMR 17.00, and the reasonable-security duties in state privacy laws. SOC 2 belongs here too, with pen testing named as an option rather than a mandate.
Require neither: the SEC disclosure rules. They ask what you do, not that you do it.
Where our $495 test fits, and where it does not
An external web application test is genuinely the right purchase in three situations. A small SaaS company answering a customer questionnaire that asks for an independent test in the last 12 months. A company building a reasonable-security record under CCPA or the GLBA Safeguards Rule, where the evidence that matters is a dated third-party report plus a remediation log. And the external component of a bigger programme you are running elsewhere.
It is not a FedRAMP assessment, a CMMC assessment, a PCI engagement covering internal testing and segmentation, or a HIPAA security evaluation. Those need internal network work, scoped assessors, or both, and no $495 test substitutes for a QSA, a 3PAO or a C3PAO. If you are in one of those regimes, buy the engagement your assessor will accept and treat this as the wrong tool.
The honest version for most readers: no US regulator is demanding a pen test of you, and a customer probably is. That is covered in your first security questionnaire.
Start by looking
Before you decide which regime you are buying for, find out what is actually exposed. The free scan checks what is visible on your domain right now and takes a couple of minutes.
If you already know you need the report, the $495 external test comes back within 24 hours with findings written for a customer to read, and an attestation letter you can attach to a questionnaire. If you are not sure whether that is the right thing to buy, say what regime you are in and we will tell you if it is not.