Knowledge center
Penetration Testing and IT Audit Knowledge Center.
Explore what each type of authorized security assessment includes, which areas are examined, the guidance used, and what appears in the final report.
Penetration testing
What a Network Penetration Test Includes
Scope, test coverage, industry guidance, evidence, and reporting for internal and external network assessments.
Read articlePenetration testing
What a Web Application Penetration Test Includes
A practical guide to web application scope, authenticated testing, review of business logic, and the final report.
Read articlePenetration testing
What a Mobile Application Penetration Test Includes
Coverage for iOS and Android applications, device storage, platform controls, communications, APIs, and reporting.
Read articlePenetration testing
What an API Penetration Test Includes
How REST, GraphQL, and service interfaces are scoped, tested, evidenced, and reported.
Read articlePenetration testing
What a Cloud Penetration Test Includes
Cloud identity, workload, storage, network, logging, privilege paths, and reporting coverage explained.
Read articlePenetration testing
What a Wireless Penetration Test Includes
Wireless encryption, authentication, isolation, rogue access scenarios, and assessment reporting explained.
Read articlePenetration testing
What an Active Directory Penetration Test Includes
Identity architecture, privileges, trusts, credentials, attack paths, hardening, and reporting in one guide.
Read articlePenetration testing
What an IoT Penetration Test Includes
Device, firmware, interfaces, communications, connected services, and product security reporting explained.
Read articleIT audits
What an IT Security Audit Includes
How audit criteria, evidence, control gaps, risks, recommendations, and management reporting are structured.
Read articleLegal and regulatory drivers
How testing supports regulatory and contractual obligations.
Across Europe and the United States, legislation and industry frameworks increasingly oblige organisations to test the effectiveness of their security controls. Authorized penetration testing and IT audits provide the documented evidence regulators, auditors, and business partners expect.
Europe
European law treats security testing as part of an organisation's duty to protect personal data and essential services.
GDPR, Article 32
Requires technical and organisational measures appropriate to the risk, including a process for regularly testing, assessing, and evaluating the effectiveness of security controls.
NIS2 Directive
Obliges essential and important entities to manage cyber risks and verify measures; penetration testing is a recognised way to demonstrate that controls actually work.
DORA
For financial entities in the EU, mandates digital operational resilience testing, including penetration testing based on threat intelligence for designated institutions.
National frameworks
Sector and national rules (for example in healthcare, energy, and government) frequently reference independent security testing as evidence of due care.
United States
US obligations arise from federal regulation, industry standards, and state privacy law. Many explicitly name penetration testing.
PCI DSS
Requirement 11 mandates regular penetration testing of the cardholder data environment by any organisation that stores, processes, or transmits payment card data.
HIPAA Security Rule
Requires covered entities to evaluate technical safeguards; penetration testing can support evaluation but is not explicitly mandated by HIPAA.
GLBA / SOX
Financial and publicly traded organisations must demonstrate tested controls over financial systems and customer information.
State privacy laws
Laws such as the CCPA/CPRA expect reasonable security procedures; documented testing is central to showing that standard is met.
International frameworks
Framework selection depends on systems, contractual commitments, and risk.
ISO/IEC 27001
An information security management standard. Technical testing can support risk treatment and control evaluation.
SOC 2
An attestation framework for service organisation controls, not a universal penetration testing mandate.
NIST CSF
A cybersecurity risk management framework that can inform assessment objectives and improvement planning.
This overview is general information, not legal advice. The exact obligations that apply depend on your sector, the data you process, and the jurisdictions in which you operate. DIGITPOL confirms the applicable requirements during engagement scoping.