"We need a pentest for compliance" is one of the most common reasons UK organisations commission security testing. Each UK law, regulator and standard expects something slightly different in scope, frequency and evidence, though. This guide summarises what the main UK frameworks expect, so you can scope one test that satisfies as many of them as possible.
UK GDPR and the Data Protection Act 2018
Article 32 of UK GDPR requires "appropriate technical and organisational measures" and, specifically, "a process for regularly testing, assessing and evaluating the effectiveness" of those measures. No UK law names penetration testing as mandatory. However, regular testing of systems that hold personal data is the most direct way to show you meet Article 32, and the ICO's security guidance points to testing as part of that process.
If a personal data breach is likely to result in a risk to people's rights and freedoms, you must usually report it to the ICO within 72 hours of becoming aware of it. Incident response planning and monitoring are therefore part of being ready for UK GDPR, as well as testing.
Cyber Essentials and Cyber Essentials Plus
Cyber Essentials is the UK government-backed scheme covering five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Central government has required it for contracts involving personal data and certain ICT services since 2014, and many private-sector buyers now ask for it too. Cyber Essentials Plus adds a hands-on audit by a Certification Body.
Neither level is a penetration test, and neither requires one. Many UK organisations hold Cyber Essentials as a baseline and add penetration testing for their applications and networks. See Cyber Essentials vs penetration testing.
ISO/IEC 27001:2022
ISO 27001 requires organisations to manage technical vulnerabilities (Annex A control 8.8) and to carry out security testing during development and acceptance (control 8.29). Penetration testing is the usual evidence for these controls on internet-facing systems. How often you test is your risk-based decision, but UK certification bodies generally expect at least an annual test and testing after significant change.
PCI DSS v4.0
PCI DSS is the most explicit standard about penetration testing. Requirement 11.4 requires a defined methodology and internal and external penetration testing at least every 12 months and after any significant change. Exploitable vulnerabilities must be fixed and retested. Where segmentation is used to reduce scope, it must also be tested at least annually for merchants and every six months for service providers. UK merchants and payment firms should agree scope with their acquirer or QSA.
NIS Regulations 2018 and the Cyber Security and Resilience Bill
The Network and Information Systems Regulations 2018 apply to operators of essential services in sectors such as energy, transport, health, water and digital infrastructure, and to relevant digital service providers. Competent authorities commonly assess these organisations against the NCSC's Cyber Assessment Framework (CAF). The CAF expects you to understand and test your security, which is where penetration testing provides evidence.
The Cyber Security and Resilience Bill is going through Parliament. It is expected to bring more organisations into scope, including managed service providers and some data centres, and to tighten incident reporting. Much of the detail will be set in secondary legislation. If you are an MSP or a supplier to essential services, now is a good time to build testing and monitoring evidence.
Financial services: FCA, PRA and CBEST
- Operational resilience: FCA (SYSC 15A) and PRA rules require firms to identify important business services, set impact tolerances and run scenario testing. Penetration testing and red teaming feed directly into those scenarios.
- CBEST: the Bank of England's intelligence-led red teaming framework for systemically important firms has its own requirements for threat intelligence and testing providers.
- EU operations: UK firms with EU-regulated entities may also fall under DORA, including threat-led penetration testing (TLPT) for some.
Healthcare: NHS Data Security and Protection Toolkit
Organisations with access to NHS patient data and systems, including many suppliers, must complete the Data Security and Protection Toolkit (DSPT) each year. The toolkit has been moving towards the CAF for larger organisations, and it expects evidence of vulnerability management and, for many organisations, independent testing of internet-facing systems.
Telecoms and public sector
Public telecoms providers have specific duties under the Telecommunications (Security) Act 2021 and its code of practice. Testing of UK government and many public-sector systems may need an NCSC CHECK provider. See our CREST and CHECK guide.
Quick reference
| Framework | Pentest explicitly required? | Typical frequency | Typical evidence |
|---|---|---|---|
| UK GDPR Art. 32 | No (regular testing required) | Risk-based; annually is common | Test reports, remediation records |
| Cyber Essentials / Plus | No | Annual certification | Self-assessment; Plus audit |
| ISO/IEC 27001:2022 | No (controls 8.8, 8.29) | Annual + after major change | Pentest and vulnerability records |
| PCI DSS v4.0 | Yes (Req. 11.4) | 12 months + after significant change | Internal, external, segmentation reports |
| NIS / NCSC CAF | No (testing expected) | Set by competent authority | CAF self-assessment with evidence |
| FCA / PRA resilience | No (scenario testing required) | Ongoing | Scenario tests, red team results |
| NHS DSPT | Depends on organisation type | Annual submission | Test reports, vulnerability management |
Scoping one test for several frameworks
- List every framework and contract that applies and note what each one requires.
- Start from the strictest requirement, which is often PCI DSS, and check that the scope covers the others.
- Ask for a report that maps findings to each framework, along with an attestation letter for customers.
- Book the retest before your audit date so the evidence shows issues as fixed.
Frequently asked questions
Is penetration testing a legal requirement in the UK?
No UK law requires a penetration test by name. UK GDPR does require a process for regularly testing the effectiveness of your security measures, and standards such as PCI DSS require penetration testing explicitly. In practice, regular testing is expected.
Does Cyber Essentials Plus count as a penetration test?
No. Cyber Essentials Plus is a technical audit of five baseline controls. It is valuable, but it does not look for application flaws, business-logic issues or attack chains the way a penetration test does.
Need a test that satisfies several frameworks at once? Request a scoped proposal or see our compliance services.