Regulated environments

Yes6

• Does GDPR require penetration testing?

  Yes in practice: the GDPR does not name penetration testing, but Article 32(1)(d) requires regular testing of security measures, so a web application that holds customer personal data needs access tests in CI and a penetration test on a fixed schedule, such as once a year, with the results written down.

  Code under test: Yes

• Does HIPAA require penetration testing?

  Yes, run one: the HIPAA Security Rule in force in September 2026 does not name penetration testing, but it requires a periodic technical evaluation of your safeguards, so penetration-test every system that holds patient data (ePHI) once a year and after each major change.

  Code under test: Yes

• Does ISO 27001 require penetration testing?

  Yes in practice: ISO/IEC 27001 does not name penetration testing, but its Annex A control 8.8 requires you to find and evaluate technical vulnerabilities, so penetration-test each application in the ISMS scope that holds customer data once a year and after major changes, and test access checks in CI on every change.

  Code under test: Yes

• Does SOC 2 require penetration testing?

  Run a penetration test of your application before your first SOC 2 audit and every year after, although the SOC 2 criteria name it only as one example of an evaluation under CC4.1, and test tenant access checks in CI on every change.

  Code under test: Yes

• Is 100% coverage required for safety-critical software?

  Yes, at the top safety levels: DO-178C Level A and ECSS category A software needs 100% statement, decision and MC/DC coverage from tests written against requirements.

  Code under test: Yes

• Should I anonymize data before testing?Yes

  Yes, anonymize every production record before it reaches a test environment, and test the masking in CI: one test that fails when a database column has no masking rule, and one that finds no original value in the masked output.