VAPT Compliance Requirements: Frameworks, Frequency and Audit Evidence

ISO 27001, SOC 2 and GDPR set no fixed testing clock. Auditors and enterprise buyers still ask for test evidence under all 3.

HIPAA's 12-month penetration testing rule is still a proposal, not law. This matrix was last verified in October 2026, and regulations change, so confirm the current instrument before planning a cycle.

What Does VAPT Compliance Actually Prove?

VAPT compliance proves that a defined scope was tested to a framework's standard and that findings reached closure. A VAPT report alone does not prove full compliance. Governance, policies and monitoring sit outside it.

A vulnerability assessment finds potential weaknesses across a defined scope. Penetration testing then validates selected weaknesses through controlled exploitation. Together, they produce technical evidence for a wider compliance process.

The testing stages we run for web, mobile and API targets explain how that evidence gets produced.

Practitioner note: The fastest way I have seen a compliance submission fail is a scope mismatch. The tested system and the documented system must be the same system.

On the Infinium LLP engagement, the certificate depended on the exact production scope. We tested the web application and its REST APIs over 3 weeks.

The Infinium LLP engagement produced 18 findings, including 2 high-risk issues. Those were a path traversal in a file-handling API and an outdated JavaScript library. The certificate was issued only after retesting confirmed the fixes.

Scope comes first. The frameworks below decide how often that scope gets tested.

What Does PCI DSS Require for VAPT?

PCI DSS requires vulnerability scans every 3 months and penetration testing every 12 months for in-scope environments. Significant changes trigger extra testing. External scans use an Approved Scanning Vendor (ASV).

Requirement 11.4.2 covers internal penetration testing, and Requirement 11.4.3 covers external testing. Both repeat after significant infrastructure or application changes.

PCI DSS does not require the penetration tester to hold Qualified Security Assessor (QSA) or ASV status. The tester needs suitable qualification and organisational independence. External scans follow a different rule set by the PCI Security Standards Council: applicable scans come from a listed ASV.

In procurement reviews, I see these 2 roles confused often. An ASV scan report and a penetration test report answer different PCI requirements.

Do ISO 27001, SOC 2, HIPAA and GDPR Require Penetration Testing?

ISO 27001, SOC 2, HIPAA and GDPR do not currently mandate a fixed penetration testing schedule. Each one requires evidence that security controls work. Penetration testing is a common way to produce that evidence.

Does ISO 27001 Require VAPT?

No, ISO 27001 does not require VAPT at a fixed frequency. ISO/IEC 27001:2022 Annex A control 8.8 covers the management of technical vulnerabilities.

Certification auditors look for a risk-based testing approach that the organisation follows in practice. A documented VAPT cycle is the clearest way to show that.

Does SOC 2 Require Penetration Testing?

No, SOC 2 does not explicitly require penetration testing. The AICPA Trust Services Criteria name penetration testing only as an example evaluation under criterion CC4.1.

Enterprise customers reviewing a SOC 2 report often ask for a recent penetration test anyway. For most SaaS vendors, that request decides the testing cycle.

Does HIPAA Require Penetration Testing?

No, the current HIPAA Security Rule does not name penetration testing. The rule requires risk analysis and periodic evaluation of security safeguards.

The US Department of Health and Human Services (HHS) published a proposed update on 6 January 2025. The proposal requires penetration testing every 12 months and vulnerability scans every 6 months. As of October 2026, the rule is not final.

Does GDPR Require Security Testing?

Yes, GDPR requires regular testing of security measures, without a VAPT schedule. Article 32(1)(d) calls for a process to regularly test, assess and evaluate those measures.

VAPT reports are one practical way to show that process exists and runs.

Practitioner note: For SaaS clients selling into the US and Europe, the real deadline is usually the customer's security questionnaire. The framework sets the floor, and the buyer sets the date.

Indian regulators work differently. Their rules name exact frequencies and, for SEBI and IRDAI, the auditor type.

What Do Indian Regulators Require for VAPT?

Indian financial regulators set fixed VAPT frequencies and evidence formats for the entities they supervise. RBI, SEBI and IRDAI each publish separate rules. SEBI and IRDAI require CERT-In empanelled auditors for covered testing.

What Does RBI Require?

RBI requires commercial banks to run vulnerability assessment every 6 months and penetration testing every 12 months on critical systems. The rule sits in the Commercial Banks Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026.

RBI issued these directions on 31 July 2026, effective immediately. They cover critical and internet-facing systems. Non-critical systems follow a documented risk-based approach.

Testing applies before implementation, after implementation and after changes. Trained, independent security experts or auditors perform it.

RBI issued 6 entity-specific directions the same day:

• Commercial banks.

• Small finance banks.

• Payments banks.

• Urban co-operative banks.

• Non-banking financial companies (NBFCs).

• Credit information companies.

Use the instrument that matches your licence, available through the RBI Master Directions library.

Practitioner note: One annual calendar entry cannot represent 2 different testing clocks. I recommend separate VA and PT dates for every RBI-regulated system.

What Does SEBI CSCRF Require?

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) links VAPT frequency to entity category. The National Critical Information Infrastructure Protection Centre (NCIIPC) identifies protected systems and critical information infrastructure (CII). The 3 frequency tiers are:

• Protected systems and CII run VAPT at least twice per financial year.

• Qualified Stock Brokers (QSBs) run VAPT at least twice per financial year.

• Other regulated entities run VAPT at least once per financial year.

SEBI separates 3 deadlines after each cycle:

• Report submission within 1 month of VAPT completion, after IT Committee approval.

• Closure of findings within 3 months of report submission.

• Revalidation within 5 months of VAPT completion.

SEBI's Annexure-A format records auditor identity, scope, tools, exclusions, findings and risk ratings. It adds the entity's signed declaration and the IT Committee minutes approving the report.

Covered audits use CERT-In empanelled auditing organisations. A generic penetration testing firm does not qualify automatically.

What Does IRDAI Require?

IRDAI requires external grey-box or white-box penetration testing every 6 months on internet-facing assets. The rule comes from the Information and Cyber Security Guidelines, 2026, issued on 6 April 2026 (circular IRDAI/GA&HR/CIR/MISC/51/4/2026).

The 2026 guidelines replace the 2023 framework. They apply to insurers, foreign reinsurance branches and intermediaries such as brokers and third-party administrators.

The 2026 version moves from black-box testing to grey-box or white-box testing. Testers now receive architecture details, credentials or source code. A CERT-In empanelled auditor performs the testing.

Practitioner note: Grey-box testing changes the preparation work. Insurers need a complete inventory of internet-facing components, including third-party hosted ones, before testing starts.

Is CERT-In Empanelment Required for Every VAPT?

No, CERT-In empanelment is required only where a framework says so. The Indian Computer Emergency Response Team (CERT-In) maintains a list of empanelled security auditing organisations.

SEBI CSCRF and IRDAI's 2026 guidelines require CERT-In empanelled auditors for covered testing. PCI DSS, SOC 2 and ISO 27001 use their own qualification models.

Ask for the current empanelment letter before signing. Empanelment lists change.

How Often Is VAPT Testing Required?

VAPT testing frequency depends on the framework, the entity type, the system and the testing activity. Vulnerability assessment and penetration testing often run on different clocks. Change events add tests outside the calendar.

I answer frequency questions with 4 questions of my own:

1. Which framework or contract applies?

2. Which entity category does the organisation fall under?

3. Which systems are critical, internet-facing or in scope?

4. Which activity applies: VA, PT or both?

ISO 27001 and SOC 2 set no clock at all. For those, I recommend annual penetration testing plus testing after major releases. That baseline matches what enterprise security questionnaires typically ask for.

Change-triggered testing sits outside every calendar. PCI DSS repeats testing after significant changes, and RBI applies VA/PT after system changes.

What Evidence Does a VAPT Compliance Audit Require?

A VAPT compliance audit requires evidence that proves scope, execution, remediation and closure. A certificate alone carries limited detail. Auditors need records that connect the requirement to the tested system.

The evidence pack I build for compliance engagements contains 10 records:

RBI now treats closure as a governance item. Paragraph 161 of the 2026 directions requires quarterly VAPT closure status reports. Those reports go to the IT Strategy Committee and Information Security Committee.

Practitioner note: A certificate becomes stronger when every statement maps back to a dated report and a retest record.

Our guide on what a VAPT certificate records and what it cannot prove covers the certificate side in detail.

What Is the Difference Between VAPT, a Security Audit and a Compliance Audit?

VAPT tests technical weaknesses, a security audit reviews defined controls, and a compliance audit tests obligations. The 3 activities can share evidence. They do not answer the same question.

The phrase "VAPT security audit" often blends separate activities. The contract needs to state which activity the provider performs.

A strong VAPT report does not replace a compliance assessment. A policy review does not replace technical penetration testing either.

How Do You Build a VAPT Compliance Calendar?

Build a VAPT compliance calendar by separating recurring obligations from event-driven testing. Assign one owner to every testing clock. Track remediation and retesting as separate deadlines.

I set up client calendars in 5 steps:

1. List every applicable requirement in a register.

2. Add each system and its classification beside the requirement.

3. Record the last completed test date and the latest allowed next date.

4. Add remediation, closure and revalidation deadlines as separate entries.

5. Connect change management, so major releases trigger a compliance review.

This model stops an annual penetration test from hiding a 6-month vulnerability assessment obligation.

How Do You Choose a VAPT Auditor for Compliance?

Choose a VAPT auditor for compliance against the exact framework requirement, not the VAPT label. Frameworks recognise different tester qualifications. The contract needs to match the required evidence.

I use 6 checks before any statement of work is signed:

1. The framework scope matches the organisation's regulated entity type.

2. The testing team meets the required qualification or empanelment rule.

3. The statement of work separates VA, PT, remediation and retesting.

4. The report format captures framework-specific evidence and declarations.

5. The retest terms match required closure and revalidation timelines.

6. Every certificate statement traces back to audit evidence.

RBI raises the stakes on auditor choice. Paragraph 158 of the 2026 directions covers missed vulnerabilities. A compromise through a flaw the auditor missed counts as an auditor deficiency at contract renewal.

Evidence requirements shape scope, and scope shapes price. Our breakdown of VAPT testing costs shows how.

FAQs