Compliance frameworks
What each framework actually asks for.
Most confusion about compliance and security testing comes from treating every framework the same way. They are not the same: some name penetration testing outright, and some only state an objective and leave the evidence to your auditor.
One page per framework, each with the requirement as the standard words it, a link to the primary source, and what that means when you scope an engagement.
SOC 2 does not require a penetration test. Your auditor probably still wants one.
SOC 2 never names penetration testing as a required procedure. Here is what the Trust Services Criteria actually ask for, and why auditors still ask for a test.
PCI DSS names penetration testing outright. Requirement 11.4.
PCI DSS Requirement 11.4 is explicit about penetration testing: internal and external, at least every 12 months, and after any significant change.
PHIPA asks for reasonable steps. Testing is how you show them.
PHIPA s. 12(1) requires Ontario health information custodians to take reasonable steps to protect personal health information. What that means for testing.
PIPEDA names no technology. It names a standard.
PIPEDA Principle 7 requires safeguards appropriate to the sensitivity of the information, and names no specific technology. What that means in practice.
The OWASP Top 10:2025, and what testing each one requires.
The OWASP Top 10:2025 categories, what each one looks like in a real application, and what it takes to test for it rather than scan for it.
ISO 27001 asks you to manage vulnerabilities, not to run a specific test.
ISO/IEC 27001 does not mandate a penetration test. It requires technical vulnerabilities to be managed, and testing is the usual evidence.
An LLM application moves the trust boundary into the context window.
How to test an application built on a large language model: prompt injection, tool and agent permissions, output handling and the trust boundary.
Next step
Start with a scoping call.
Tell us what you need tested. Before any testing begins, the scope is written down and the agreement and rules of engagement are signed.