EVIDENCE
Compliance · What the report covers

The evidence your auditor wants.

Almost every regime requires regular testing and proof of it. The report follows BSI structure — the format auditors already know.

// Format: IS penetration test to BSI
Frameworks

Six reasons
it is on your plan.

01
NIS2
Requires risk-management measures and proof that they work.
02
DORA
Regular testing of the systems behind critical functions. Mandatory in finance.
03
GDPR
Article 32 requires regular testing of your security measures.
04
ISO/IEC 27001
A managed approach to vulnerabilities — the report maps directly onto the controls.
05
PCI DSS
Requirement 11.4 calls for a penetration test. A scan explicitly does not satisfy it.
06
IT-Grundschutz & KRITIS
Implemented safeguards must be checked regularly. The format is made for exactly that.
Report

What is
in it.

What that means for your compliance in detail is for your own legal and compliance function to assess. The test supplies the basis, not the certificate.

Request

Evidence that
survives review.

Tell us which regime is on your neck.

// Request a pentest