Short answer: at least once a year, and again after any significant change to your network or applications. Some regulations set that floor in writing. Others leave it to your risk assessment, and auditors still expect to see a yearly test.
What each framework requires
| Framework | Penetration testing requirement |
|---|---|
| PCI DSS v4.0.1 | Internal and external tests at least every 12 months and after any significant change (Requirements 11.4.2 and 11.4.3). Segmentation testing every 12 months, or every 6 months for service providers. |
| FTC Safeguards Rule (GLBA) | An annual penetration test plus vulnerability assessments at least every six months, unless you run continuous monitoring. Firms with information on fewer than 5,000 consumers are exempt (16 CFR 314.4). |
| NYDFS Part 500 | A test at least annually, from both inside and outside the network boundary, by a qualified internal or external party (23 NYCRR 500.5). |
| HIPAA | Not explicitly required today. Risk analysis and periodic evaluation are. A rule proposed in January 2025 would require annual penetration testing, but it was not final as of mid 2026. |
| SOC 2 | Not mandated by name, but penetration testing is a listed example of a separate evaluation under the monitoring criteria, and most auditors expect one each year. |
| CMMC Level 2 (NIST SP 800-171) | No explicit penetration test. Periodic control assessments and vulnerability scanning are required, and a pentest is a common way to show those controls work. |
| FFIEC (banks and credit unions) | Examiners expect independent testing scaled to risk. An annual external and internal test is the norm. |
When to test more often
- After a major change: a new application release, a cloud migration, a network redesign or an acquisition.
- After a security incident, to confirm the attacker’s path is closed.
- Before an audit or a large customer’s security review.
- When you release software often. A yearly test only covers the code that existed that week.
A practical schedule
- Once a year: a manual external and internal penetration test by a qualified tester.
- Between annual tests: automated external testing after each major release or each quarter. Our AI pentest platform runs a full external test in hours, and your first scan is free with code FIRSTSCAN.
- After fixes: a retest to confirm each finding is closed.
Not sure whether you need an internal test, an external test or both? Read internal vs. external penetration testing, or see what a penetration test costs.
How Coastline Can Help
Coastline runs annual external and internal penetration tests scoped to the framework you report against.
Request a free scoping call and we will recommend the right scope for your environment.