⬢ Compliance Hub · 8 Frameworks · Updated May 2026

Compliance Penetration Testing Eight Frameworks, One Engagement

Penva Security delivers penetration testing aligned to the eight compliance frameworks that matter most to Australian businesses. ISO 27001, SOC 2, PCI DSS v4.0.1, APRA CPS 234, Essential Eight, IRAP/ISM, HIPAA, and GDPR / Privacy Act.

One penetration test, mapped across the compliance frameworks buyers care about

The hub is designed to help Australian teams understand which frameworks apply, where requirements overlap, and how one engagement can support multiple audits.

At-a-glance

Audit-readiness snapshot

A compact summary of the audit driver, typical scope, reporting outputs, and retest evidence.

ISO 27001: Annex A.8.8 / A.8.29
SOC 2: CC7.1
PCI DSS v4.0.1: Requirement 11.4
APRA CPS 234: Paragraphs 27-28
Essential Eight: ML0-ML3 maturity
IRAP / ISM: AU Gov supply-chain
HIPAA: §164.308 evaluation
GDPR / Privacy Act: Article 32 / APP 11

Quick Answer

What "compliance penetration testing" actually means

Compliance penetration testing is regular penetration testing with reporting structured for a specific audit framework. The methodology (OWASP WSTG v4.2, PTES, NIST SP 800-115) is identical regardless of framework. What changes is the report – citing the right paragraphs, mapping findings to control objectives, formatting attestation letters for the specific auditor.

Quick answer

What "compliance penetration testing" actually means

A single Penva Security engagement typically satisfies 2-4 frameworks simultaneously. Australian SaaS commonly bundle SOC 2 + ISO 27001 in one test. Australian FinTech commonly bundle APRA CPS 234 + PCI DSS + SOC 2. HealthTech typically bundle Privacy Act + HIPAA + ISO 27001. The testing is the same; the deliverable is engineered per framework.

The eight frameworks below are the ones that matter most to Australian buyers. Click any framework card to access the dedicated page covering scope, evidence requirements, paragraphs/requirements specifically addressing pentesting, and FAQs specific to that framework.

Certified & aligned with

Compliance Evidence Penva Security Supports

Recognised frameworks and audit-ready evidence structures used across Penva Security engagements.

CR CREST

OS OSCP

OW OWASP

Eight Frameworks

Compliance Frameworks Penva Security Aligns To

Each framework has its own dedicated page covering scope, evidence requirements, and engagement structure. Three Australian-specific (APRA, Essential Eight, IRAP), three global (ISO 27001, SOC 2, PCI DSS), one US (HIPAA), one EU + AU (GDPR / Privacy Act).

Global

ISO 27001

Annex A.8.8 (vulnerability management) and A.8.29 (security testing during development) reference penetration testing as required evidence for certification and surveillance audits.

View framework page →

Global

SOC 2

Trust Services Criterion CC7.1 specifically addresses penetration testing evidence. The most common compliance driver for Australian SaaS selling into US enterprise customers.

View framework page →

Global

PCI DSS v4.0.1

Requirement 11.4 mandates penetration testing of the Cardholder Data Environment (CDE) by qualified internal resource or external third party. v4.0.1 is the current standard.

View framework page →

Australia

APRA CPS 234

Paragraphs 27-28 mandate ‘systematic testing’ of information security controls. Applies to ADIs, insurers, and superannuation funds regulated by APRA in Australia.

View framework page →

Australia

Essential Eight

ACSC’s prioritised mitigation strategies with maturity levels ML0-ML3. Increasingly a procurement criterion for Australian Government supply-chain engagements.

View framework page →

Australia

IRAP / ISM

The Australian Signals Directorate’s IRAP program and ISM are the basis for Australian Government cloud and ICT services certification. IRAP-aligned testing for AU Gov supply chain.

View framework page →

USA / Healthcare

HIPAA

Security Rule §164.308 evaluation requirements. Relevant for Australian HealthTech vendors serving US covered entities as business associates – tested alongside Privacy Act.

View framework page →

Global

GDPR / Privacy Act

GDPR Article 32 ‘security of processing’ and Privacy Act APP 11 ‘reasonable steps’ both reference security testing. Penva Security engagements satisfy both standards.

View framework page →

Cross-Framework Overlap

Common Requirements Across the Eight

Where the frameworks overlap – the requirements that appear in multiple frameworks simultaneously. This is why a single engagement can satisfy 2-4 frameworks.

Common Requirement

Frameworks Where It Appears

Annual penetration testing

ISO 27001, SOC 2, PCI DSS v4.0.1, APRA CPS 234, HIPAA, Essential Eight ML2+

Testing after significant change

ISO 27001 (A.8.29), PCI DSS (Req 11.4.4), APRA CPS 234 (28(c))

Qualified personnel / CREST testers

ISO 27001 (implicit), SOC 2 (implicit), PCI DSS (Req 11.4.1), APRA CPS 234 (implicit), IRAP (explicit), HIPAA (implicit)

Written remediation plan

All eight – the deliverable format differs but a remediation roadmap is universally expected

Independence from system owner

PCI DSS (Req 11.4.5), APRA CPS 234 (paragraph 28), IRAP / ISM (explicit)

Network segmentation testing

PCI DSS (Req 11.4.5), IRAP / ISM (where in-scope)

Both internal and external testing

PCI DSS (Req 11.4.1, 11.4.2), Essential Eight ML2+ implicit

Retest after remediation

PCI DSS (Req 11.4.4), APRA CPS 234 (implicit), SOC 2 Type II (implicit for the next reporting period)

Letter of Attestation for auditor

All eight – format varies by audit type but a tester-signed attestation is universally accepted

Methodology citation in report

All eight reference standard methodologies (OWASP WSTG, PTES, NIST SP 800-115) as acceptable

Which Frameworks Apply to You?

Match Your Situation to the Frameworks

Six common buying scenarios, with the frameworks each one typically requires. If your situation isn’t here, our scoping call covers the framework-mapping conversation directly.

Scenario 01

Selling into US enterprise customers

The dominant driver for most Australian SaaS. US enterprise procurement requires SOC 2 Type II reports, often combined with ISO 27001 certification for international credibility.

Scenario 02

APRA-regulated entity in Australia

If you’re an ADI, insurer, or superannuation fund regulated by APRA , CPS 234 paragraphs 27-28 mandate systematic security testing. Often combined with Essential Eight maturity assessment for the broader risk picture.

Scenario 03

Handling payment card data

If your system stores, processes, or transmits cardholder data , PCI DSS v4.0.1 Requirement 11.4 mandates annual pentesting of the Cardholder Data Environment plus testing after significant change.

Scenario 04

Trading internationally with EU customers

If you process personal data of EU residents , GDPR Article 32 ‘security of processing’ applies regardless of where your business is based. The Privacy Act covers the same territory for Australian residents.

Scenario 05

Australian Government supply-chain vendor

Selling into Australian Government agencies typically requires Essential Eight ML2 alignment minimum, often ML3 for sensitive engagements. IRAP/ISM applies where the system handles official or PROTECTED information.

Scenario 06

HealthTech handling patient data

Australian HealthTech vendors handle Privacy Act APP 11 territory by default. For vendors serving US covered entities as business associates, HIPAA Security Rule applies on top.

FAQ

Compliance Pentest — Common Questions

Direct answers to the questions buyers ask when scoping a compliance-aligned pentest. Updated May 2026.

Next step

Not Sure Which Frameworks Apply to You?

Book a free 30-minute scoping call. We’ll map your situation to the right framework(s) and return a fixed-price quote within 24 hours. Most engagements satisfy 2-4 frameworks in a single test.

Not Sure Which Frameworks Apply to You?

Book a free 30-minute scoping call. We’ll map your situation to the right framework(s) and return a fixed-price quote within 24 hours. Most engagements satisfy 2-4 frameworks in a single test.