Overview
US organizations rarely answer to one rule. A payments startup may face PCI DSS, the FTC Safeguards Rule and a SOC 2 audit in the same year. We scope one test to cover as many of those as it fairly can and state in the report which requirement each part supports. We don't claim QSA, ASV or C3PAO status; if you need one, tell us at scoping.
Many security standards require penetration testing, but a generic test does not automatically satisfy them. Each framework expects particular scope, timing and evidence, and an auditor needs to see that those expectations were met, not just that some testing happened. Compliance pentesting starts from the control you must satisfy and works backward, so the engagement is designed from the outset to produce the evidence your assessor is looking for.
For payment environments, PCI DSS v4.0.1 Requirement 11.4 calls for penetration testing at least annually and after any significant change, covering the cardholder data environment and the segmentation that isolates it; we scope the test and the segmentation checks accordingly. For an information security management system, ISO/IEC 27001:2022 Annex A 8.8 on technical vulnerabilities and A.8.29 on security testing in development point to regular testing, and we align the engagement to those controls. For SOC 2, a penetration test is commonly expected as evidence supporting the security criteria, so we document it to suit an attestation.
Above all we keep the work honest about what it proves. We map findings to the relevant controls, provide an evidence pack covering scope, dates, method and results, and issue an attestation letter once fixes are retested. Where US rules add their own expectations, for example NYDFS Part 500, the FTC's Safeguards Rule or a CMMC assessment, we scope against that wording and say in the report which requirement each part of the test was designed to support.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- Requirement reviewWe confirm which framework, control and timing your test must satisfy.
- ScopingThe engagement is designed to meet that control, including any segmentation checks.
- TestingWe test the in-scope environment to the depth the standard expects.
- Evidence assemblyFindings are mapped to controls and packaged for audit.
- Retest & attestFixed findings are retested and an attestation letter is issued.
What you receive
- Report scoped and mapped to your framework
- Audit-ready evidence pack with scope, dates and method
- Segmentation test results where PCI DSS applies
- Findings mapped to the relevant controls
- Attestation letter once fixes are retested
Standards & frameworks
- PCI DSS v4.0.1 Req. 11.4
- ISO/IEC 27001:2022 A.8.8
- ISO/IEC 27001:2022 A.8.29
- SOC 2
- NIST SP 800-115
- PTES
- CVSS v4.0
- FTC Safeguards Rule
- NYDFS Part 500
- CMMC Level 2
Frequently asked questions
Which frameworks can this support?
Commonly PCI DSS, ISO/IEC 27001 and SOC 2, and it can be scoped for NYDFS Part 500 or the FTC's Safeguards Rule when either applies to you. We scope the single engagement so its evidence serves whichever standards and jurisdiction you report against.
How often does PCI DSS need a pentest?
Requirement 11.4 calls for penetration testing at least once a year and after any significant change to the environment, covering both the cardholder data environment and the controls that segment it. We scope the test and segmentation checks to match that expectation.
Will our auditor accept your report?
Reports state scope, dates, method and risk-rated findings with evidence, and we map results to the relevant controls. Once fixes are retested we issue an attestation letter. We cannot act as your certifying body, but assessors routinely accept testing documented this way.
Which US rules call for annual penetration testing?
Among others: PCI DSS v4.0.1 Requirement 11.4; the FTC Safeguards Rule for covered non-bank financial institutions that don't run continuous monitoring; and NYDFS Part 500.5 for covered entities. HHS has proposed annual testing under HIPAA, but that rule is not final. Confirm which apply to you with counsel.
Can you act as our CMMC assessor or PCI QSA?
No. We don't claim QSA, ASV, C3PAO or RPO status. We run the penetration test and document it for whoever assesses you. If a requirement calls for an accredited body, raise it at scoping and we'll tell you plainly whether we can meet it.