Which frameworks require a third-party penetration test?

Three do: FedRAMP, the CSA Cloud Controls Matrix, and DORA. PCI DSS and NYDFS require a penetration test but explicitly accept an internal tester. SOC 2 and ISO 27001 require no penetration test at all. Almost every vendor page you will read on this gets it wrong in the same direction.

On this page: the matrix · the three that mean it · required but not external · not required at all · independence · what is changing · what to do

The matrix

Read “requires a pentest” and “must the tester be external” as two separate questions. Almost all of the confusion in this market comes from collapsing them into one.

The three that actually require an outside tester

FedRAMP is the strictest, and says so plainly

The FedRAMP Penetration Test Guidance sets the schedule in Section 7.0:

For each initial security authorization, a penetration test must be completed by a 3PAO as a part of the assessment process described in the SAP. This initial penetration test must be performed no more than 6 months prior to the submission of the SAR. Once within the continuous monitoring phase of the FedRAMP process, additional penetration testing activities must be performed at least every 12 months.

Section 8.0 adds that all penetration test activities must be performed by a 3PAO with demonstrated proficiency and a defined methodology, and that the team lead must hold an industry-recognized penetration testing credential. There is one nuance worth knowing before you buy: a FedRAMP-recognized 3PAO is required for systems with a JAB provisional authorization, while for an Agency authorization the guidance says this “may refer to any assessment organization designated by the agency AO.”

CSA STAR inherits it from one CCM control

The Cloud Controls Matrix is the control set behind the CSA STAR registry, and control TVM-06 in CCM v4.0 is unambiguous about who tests:

Define, implement and evaluate processes, procedures and technical measures for the periodic performance of penetration testing by independent third parties.

Note what is missing: an interval. “Periodic” is doing a lot of work, and in practice the assessor decides whether your cadence is defensible against your own risk profile.

DORA requires it, then makes internal testing hard on purpose

Regulation (EU) 2022/2554 requires in-scope financial entities to “carry out at least every 3 years advanced testing by means of TLPT” on live production systems. Article 27 is where externality bites. Internal testers are permitted only where the competent authority has approved their use, has verified that conflicts of interest are avoided, and where “the threat intelligence provider is external to the financial entity.” That is a third-party requirement written as a conditional.

Required but not external

PCI DSS names the tester’s qualities, not their employer

Requirement 11.4 asks for a tester qualified by experience or training with organizational independence from the systems being tested. The parenthetical

(not required to be a QSA or ASV)

appears repeatedly through Requirement 11.4 and the SAQs. A qualified internal resource is explicitly acceptable. The full requirement breakdown is here, including the retest clause in 11.4.4 that most firms bill separately at 10% to 25% of the original fee.

NYDFS spells out both options in one sentence

The 2023 amendment to 23 NYCRR Part 500 retitled Section 500.5 as vulnerability management and requires covered entities to conduct

penetration testing of their information systems from both inside and outside the information systems’ boundaries by a qualified internal or external party at least annually

Two directions of testing, one annual interval, either kind of tester. Anyone telling a New York covered entity that Part 500 forces them to hire an outside firm has not read the clause.

NIST makes independence an optional enhancement

This one surprises people, because FISMA and FedRAMP both build on it. The base control CA-8 in NIST SP 800-53 Rev 5 says only to conduct penetration testing at an organization-defined frequency, and its discussion states that testing “can be conducted internally or externally” and that “risk assessments guide the decisions on the level of independence required.” Externality arrives only when the CA-8(1) enhancement is selected on top:

Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.

The ones that do not require a test at all

SOC 2 and ISO 27001 are the two most requested frameworks in startup procurement and neither one requires a penetration test. We have written the long version for both: SOC 2 never names it, and ISO 27001 never names it either, though A.8.8 and A.8.29 make a test the cheapest defensible evidence.

GDPR belongs in this group too. Article 32(1)(d) requires “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures” and stops there. No method, no tester, no interval.

The current HIPAA Security Rule is the same shape. The Evaluation standard at 45 CFR 164.308(a)(8) asks a covered entity to “perform a periodic technical and nontechnical evaluation” and never mentions penetration testing.

Independence is the real constraint

Once you stop asking “is an outside test required” and start asking “is this tester independent of what they built”, most of the matrix collapses into one practical rule. NIST defines the bar as freedom “from perceived or actual conflicts of interest with respect to the development, operation, or management of the systems that are the targets of the penetration testing.”

Perceived is the operative word. Your platform lead may be the most rigorous tester in the building, and an assessor can still discount the evidence because a reasonable reader could suspect otherwise. At ten engineers, there is generally no internal resource who satisfies that test, which is why the internal option that PCI and NYDFS allow on paper is unavailable to most startups in practice.

What each rung costs

The bands below are market prices for a single web application, taken from our penetration testing cost breakdown. The point of the table is that rung 2 is the expensive one, even though it looks free.

What is changing

Two moves are worth watching, because both push in the same direction.

HHS proposed a rewritten HIPAA Security Rule in January 2025 that would require vulnerability scanning every six months and penetration testing at least once every 12 months, turning the framework in the “not required” column into one in the “required” column. It does not, as proposed, require an outside tester.

DORA’s TLPT regime has been live since January 2025, and it is the first major regime to write externality as a default with internal testing as a supervised exception rather than the reverse.

What to do with this

Pick the strictest framework you are genuinely in scope for and test once to that bar. Coverage and independence both flow downhill: a test that satisfies FedRAMP’s mandatory attack vectors satisfies PCI Requirement 11.4 and any SOC 2 control you wrote about testing. Running one engagement per framework is how companies end up paying three times for evidence a single well-scoped test would have produced, and the cost breakdown for a single engagement shows what each duplicate is worth.

Then check what your buyer wants, because it is usually stricter than your framework. A report from your own team clears an auditor and stalls in a security questionnaire, and the real cost of a compliance program is mostly determined by which of those two audiences you were optimising for.