Penetration Testing

What a penetration test is, and how it differs from a scan

The sections below describe what NIST’s guide and other public sources say in general. They do not list the steps of the partner firm’s own tests.

NIST SP 800-115, published in 2008, defines a penetration test as security testing in which assessors mimic real-world attacks. They look for ways around the security features of an application, system or network. Most tests look for combinations of weaknesses that together give more access than any single one would.

A vulnerability scan is a different job. The Payment Card Industry Security Standards Council (PCI SSC) wrote guidance in 2017 for payment card environments. The guidance says a scan identifies, ranks and reports vulnerabilities, or weaknesses, usually with automated tools plus manual verification. A penetration test looks for ways to exploit them. It is a manual process that may use scanners and other tools.

NIST guidance is not itself a legal requirement for a private firm. NIST also notes that tests often use non-technical methods, such as social engineering.

Which rules or standards ask for penetration testing?

Two examples follow. Each reaches only the group it names.

• The Payment Card Industry Data Security Standard (PCI DSS) is an industry standard. In version 4.0, requirement 11.4 calls for penetration testing at least once every 12 months, and after any significant infrastructure or application upgrade or change. It covers entities that store, process or transmit cardholder data or sensitive authentication data, or that could affect the security of the environment holding it.
• The Federal Trade Commission (FTC) Safeguards Rule is a federal regulation for financial institutions under FTC authority, such as mortgage lenders and tax preparation firms. Without effective continuous monitoring or other ongoing detection of changes that may create vulnerabilities, it calls for a penetration test every year. That yearly test does not apply to institutions that keep customer information on fewer than 5,000 consumers.

This page cannot say whether either one reaches your business. Ask your counsel, auditor or insurer whether either applies to you and whether a test meets it.

Does HIPAA require a penetration test?

Not today. The Security Rule of the Health Insurance Portability and Accountability Act (HIPAA) does not name penetration testing. It requires an accurate and thorough analysis of risks and vulnerabilities to electronic protected health information. It also requires a periodic evaluation of whether security policies and procedures meet the rule. The rule applies to covered entities and business associates, so ask your counsel whether you are one.

In January 2025, the US Department of Health and Human Services (HHS) published a proposal to add penetration testing to the Security Rule. As proposed, a qualified person would test relevant electronic information systems at least once every 12 months, or more often if the risk analysis calls for it. It is not final, so it creates no duty today. If finalized as proposed, it would apply to the same entities. To check its status, search reginfo.gov for regulation identifier number 0945-AA22.

TTS Cyber is not a law firm, and this is general information, not legal advice.

What approval should come before a test starts?

NIST SP 800-115 puts approval first. In its planning phase, the rules of the test are identified, management approval is finalized and documented, and goals are set. NIST also offers a Rules of Engagement template, a document that sets the terms of a test. It covers scope, test schedule and hours, communication, and incident handling with criteria for halting testing.

Approval matters because federal law (18 U.S.C. 1030) makes it an offense to intentionally access a computer without authorization, or beyond authorized access, and obtain information from a protected computer. NIST says the Rules of Engagement provide the authorization for activities that are usually prohibited.

NIST recommends that legal advisors always be involved in intrusive tests such as penetration testing. It says legal departments may help with indemnity or limitation-of-liability clauses and may require testers to sign non-disclosure agreements. Ask whoever will run your test to show you the written rules and approval steps before any work starts.