Regulated sectors

Compliance Testing Your Auditor Will Accept

Hospitals, defense contractors, merchants, law firms and midsize companies answer to different rules that ask the same question: was the testing real and can you show it. These guides explain what each mandate requires and how to meet it before the deadline.

Get a free consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

The Decision Compliance Leaders Face Before the Audit Deadline

Every regulated sector has arrived at the same requirement by a different route. PCI DSS 4.0 requires penetration testing at least annually and after significant changes, with segmentation validation for the cardholder data environment. The NYDFS cybersecurity regulation requires annual penetration testing for covered entities. HIPAA requires a risk analysis and treats an unexamined ransomware encryption as a presumed breach. CMMC 2.0 moves defense contractors from self attestation to verified assessment against NIST SP 800 171, and DFARS 252.204 7012 adds a seventy two hour incident reporting clock with a media preservation duty. Compliance leaders face the same decision in each case: whether to schedule the testing early enough that remediation and retesting complete before the certification date, or to discover in the fourth quarter that a scan report is not what the assessor meant by a penetration test.

The guides in this topic are organized so that a reader in any of those sectors can find the mandate, understand what the text actually requires, and see what a deliverable looks like when an assessor accepts it. The distinction between a vulnerability scan, a manual penetration test and evidence an auditor accepts runs through all of them. A scan lists what a tool recognized. A penetration test shows what a person could reach, with reproduction steps and exploitation evidence. Audit evidence adds the scope, the dates, the roles tested, the methodology and the retest result for each finding, so the assessor can see that the control was tested rather than described. Breach forensics in these sectors follows the same logic, because the HIPAA four factor risk assessment and the DFARS compromise review both rest on evidence rather than assurance.

How to Read These Guides and in What Order

Begin with the annual compliance testing guide, which maps the clocks across NYDFS Part 500, PCI DSS 4.0, SOC 2, HIPAA and CMMC and explains why fourth quarter scheduling creates a bottleneck. Then read the guide for your sector. The PCI DSS 4.0 guide covers Requirement 11.4 and segmentation testing for merchants and service providers. The DFARS and CMMC 2.0 guide reads clause 252.204 7012 as an examiner reads it and sets out the cadence a defense contractor lives by. The healthcare cybersecurity guide and the healthcare ransomware guide cover clinical safe testing, the HIPAA clock and the evidence behind each factor of the risk assessment.

The law firm guide addresses ABA Formal Opinion 483 and the facts a lawyer must determine after a breach, and the application security guide explains what manual web, API and source code testing establishes that scanners cannot. The remaining guides supply the readiness that compliance assumes: mid market incident response planning without a security operations center, mobile and BYOD workforce controls, executive extortion response, and two publications on how proactive architecture, retainers and emergency response fit together across the cyber lifecycle. Readers with a deadline should read the sector guide and the testing guide first and return to the readiness material once the engagement is scheduled.

What GDF Does for Regulated Organizations and Their Assessors

Global Digital Forensics performs manual penetration testing, vulnerability assessments and application penetration testing for regulated organizations as part of a practice that has operated since 1992, and it brings to that work the documentation habits of examiners who have testified in federal and state courts. A GDF test report states the scope, environment, roles and dates tested and the methodology followed, lists each confirmed finding with reproduction steps, exploitation evidence, the data or function exposed and a specific remediation, and records the retest result, which is the form assessors under PCI DSS, NYDFS Part 500, HIPAA and CMMC expect. SourceScan, the firm's own code analysis tool, supports the application and source code work where a framework or a customer contract requires it.

When a regulated organization suffers an incident, the same examiners provide ransomware and data breach analysis under the direction of counsel, producing the record that the HIPAA four factor assessment, the DFARS compromise review and the state notification statutes each depend on. Incident response retainers put the terms and contacts in place in advance for organizations that cannot staff a security operations center, and privacy incident technical support gives privacy counsel the technical facts behind each notification decision. The firm serves Fortune 500 companies, AmLaw 100 firms, hospitals, defense contractors and the small and midsize businesses that face the same mandates with smaller teams, from sixteen US offices with a 24/7 hotline.

How to Begin

The initial consultation is free. Call (800) 868-8189 or request a consultation online, and tell us which frameworks apply, when the earliest audit or submission date falls, how many systems, applications and network boundaries are in scope, what last year's testing found and how quickly your change management can close findings. From those facts we propose a schedule that leaves room for remediation and retesting before the certification date, and we say which parts of the work an assessor will want to see as evidence and which are good practice but not required. If the engagement is a response to an incident, say so at the start and the call moves to preservation first.

Before the call, the audit and discovery preparation guide explains what an assessor or opposing counsel will ask to see and how to organize it, and the GDF audit preparation guide lists what we ask for before a compliance engagement begins. Defense contractors can read the DFARS compliance and certification page for the clause by clause view. Bring the prior year's report and the remediation tracker if they exist, because the fastest way to scope this year's test is to see what last year's found and what was closed. If no prior test exists, say so, and the first engagement is scoped to establish the baseline the assessor will measure future years against.

Read in this order

The Guides in This Topic

Compliance testing
Mandated Annual Cybersecurity Compliance Testing: How to Schedule Penetration Testing and Vulnerability Assessments Before Audit Deadlines
For compliance leads under NYDFS, PCI DSS, SOC 2, HIPAA or CMMC, settling when to schedule penetration testing so remediation and retesting finish before the deadline.
PCI DSS compliance testing
PCI DSS 4.0 Penetration Testing and Cardholder Data Environment Segmentation: Passing Your QSA Audit Without Surprises
For merchants and service providers facing a QSA, settling what PCI DSS 4.0 Requirement 11.4 demands of penetration testing and segmentation validation.
Defense contractor compliance
DFARS 252.204 7012 and CMMC 2.0 Compliance: Technical Readiness, Penetration Testing and Incident Reporting for Defense Contractors
For defense contractors and their counsel, settling what DFARS 252.204 7012 and CMMC 2.0 require for testing, incident reporting and media preservation.
Healthcare cybersecurity
Healthcare Cybersecurity and HIPAA Breach Forensics: Protecting Electronic Health Records and Connected Medical Devices
For hospital security and privacy leaders, settling how clinical safe testing and granular ePHI access forensics support the HIPAA four factor risk assessment.
Healthcare ransomware response
Healthcare and Enterprise Ransomware Defense: How Leaders Protect Clinical Operations and Preserve Breach Evidence
For healthcare and enterprise leaders facing ransomware, settling how clinical operations are protected while the breach evidence HIPAA requires is preserved.
Law firm security
Law Firm Cybersecurity and Client Data Protection: Defending Privileged Litigation Files, Deal Rooms and Trust Accounts
For managing partners and firm IT directors, settling how client files, deal rooms and trust accounts are protected and what ABA Opinion 483 asks after a breach.
Application security testing
Manual Web Application, API and Source Code Penetration Testing: Finding Business Logic Flaws That Automated Scanners Miss
For application owners and security teams, settling what manual web, API and source code testing finds that automated scanners miss and what the report must contain.
Incident response planning
Mid Market Incident Response Planning and Priority Retainers: Enterprise Grade Breach Readiness Without Full Time SOC Overhead
For mid market executives without a security operations center, settling what an incident response plan, tabletop program and priority retainer must contain.
Mobile workforce security
Securing the Modern Mobile and Remote Workforce: Essential Controls and Forensic Readiness for iOS, Android and BYOD
For IT and security leaders managing corporate and BYOD smartphones, settling which controls matter and what a mobile record can show when an incident occurs.
Executive extortion response
Corporate Extortion, Executive Blackmail and Deepfake Threats: How General Counsel and Security Leaders Respond
For general counsel and security leaders facing extortion or deepfake threats, settling how mass lures are distinguished from targeted cases and what the record establishes.
Security and forensics strategy
How Proactive Cybersecurity Architecture and Digital Forensics Work Together to Protect the Enterprise
For executives and architects, settling why proactive security and forensic readiness belong in one architecture rather than separate silos bought during a crisis.
Lifecycle cyber protection
From Proactive Cyber Risk Assessments to 24/7 Emergency Incident Response: Unified Enterprise Protection
For leaders unifying assessment, retainer and response, settling what a retainer changes at hour zero and which assessment phases build the baseline.

Frequently asked

Questions Readers Ask in This Topic

Does a vulnerability scan satisfy a penetration testing requirement?

No. PCI DSS, NYDFS Part 500 and the CMMC assessment guidance each distinguish scanning from penetration testing. A scan is an automated inventory of known weaknesses that a tool recognized. A penetration test is a person attempting to reach data or functions, documenting each path with reproduction steps and exploitation evidence, and retesting after remediation. Assessors look for the scope, dates, methodology and retest record that only a manual test produces.

How far before an audit deadline should penetration testing be scheduled?

Early enough that testing, remediation and retesting all complete before the earliest certification or submission date. The drivers are the size of the environment, the number of framework boundaries, the volume of findings in prior years and how quickly change management can close them. Organizations that test in the first half of the year certify without pressure. Those that begin in the fourth quarter compete for assessor time and often certify with open findings.

What does HIPAA require after a ransomware attack?

HHS guidance treats encryption of protected health information by ransomware as a presumed breach unless the covered entity demonstrates a low probability of compromise through the four factor risk assessment. Notice to affected individuals must go without unreasonable delay and no later than sixty calendar days after discovery, with notice to the Secretary and in larger breaches to the media. The forensic record of what the attacker reached and exfiltrated is what the risk assessment rests on.

Talk with an examiner

Bring the Question to an Examiner Who Has Testified

If your matter sits inside compliance testing your auditor will accept, call and describe it in plain words. A senior examiner will tell you which guide applies and what the first step is. The initial consultation is free.

Call (800) 868-8189 Get a free consultation

24/7 hotline: (800) 868-8189

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed October 31, 2026.