Penetration testing is not a blanket legal requirement in the UK. No single law says “you must do a pen test.” But several regulations create obligations that are difficult to meet without one. UK GDPR requires regular testing of security measures. The NHS Data Security and Protection Toolkit explicitly mandates annual penetration testing. Financial regulators direct systemically important firms to undergo CBEST threat-led testing. This guide sets out what each UK regulation actually requires, sector by sector.
Table of contents
The Short Answer
There is no cross-sector UK law that mandates penetration testing by name. Instead, the UK uses a layered approach: principles-based legislation establishes security duties, regulatory frameworks translate those into specific testing expectations, and supervisory relationships create de facto requirements for certain sectors.
The result is that penetration testing sits on a spectrum from “explicitly required” (NHS DSPT) through “de facto mandated by your regulator” (CBEST for systemic financial firms) to “strongly implied by law” (UK GDPR Article 32). Where your organisation falls on that spectrum depends on your sector, size, and the data you handle.
UK GDPR and the Data Protection Act 2018
UK GDPR Article 32(1)(d) requires “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.” This is a legal obligation under the Data Protection Act 2018 and applies to every organisation that processes personal data.
The regulation does not use the words “penetration testing.” It is deliberately technology-neutral. However, guidance from the Information Commissioner’s Office (ICO), the UK’s data protection regulator, explicitly names penetration testing as an appropriate method: “You can undertake [testing] through a number of techniques, such as vulnerability scanning and penetration testing.”
The ICO’s Security Outcomes further reference penetration testing directly: “You undertake regular testing to evaluate the effectiveness of your security measures, including virus and malware scanning, vulnerability scanning and penetration testing as appropriate.” For any organisation processing significant volumes of personal data, penetration testing is the most credible way to demonstrate compliance with Article 32.
PCI DSS 4.0
PCI DSS 4.0 is not UK legislation, but it is a contractual requirement for any organisation that stores, processes, or transmits payment card data. Requirement 11.4 mandates both internal and external penetration testing at least annually and after any significant change to infrastructure or applications. For UK businesses that handle card payments, this is effectively a binding requirement enforced through the card schemes and acquiring banks.
Sector-Specific Requirements
Financial Services: FCA, PRA, and CBEST
UK financial services has the most mature pen testing requirements of any sector. The Bank of England, PRA, and FCA operate two threat-led penetration testing frameworks:
CBEST (since 2014) is a live penetration testing scheme targeting systemically important financial institutions. Firms in the “core” target group are directed by PRA/FCA to participate as part of the supervisory cycle. The core list is reviewed every three years. While CBEST is not written into primary legislation, refusal to participate when directed by your supervisor would have regulatory consequences. For practical purposes, it is a mandate for core firms.
STAR-FS (since March 2024) extends threat-led penetration testing to a wider range of firms beyond the CBEST core group. It operates on a supervisory-invitation basis, broadening the reach of structured pen testing across the financial sector.
Beyond CBEST and STAR-FS, the FCA expects regulated firms to maintain proportionate security testing as part of their operational resilience obligations. The FCA Cyber Coordination Group’s 2024 insights note the importance of regular, independently conducted security assessments.
Healthcare: NHS DSPT
The NHS Data Security and Protection Toolkit (DSPT) is the clearest explicit pen testing requirement in UK regulation. Assertions 9.2.1 and 9.2.2 (Data Security Standard 9 – IT Protection) require that:
- A penetration test has been scoped and undertaken at least annually
- The SIRO (Senior Information Risk Owner) has approved the scope
- Testing includes OWASP-based assessments where relevant
- Qualified testers are from CREST, The Cyber Scheme, CHECK, or hold ISO 27001/9001 certification
Every organisation that accesses NHS patient data and systems must complete the DSPT. This includes NHS trusts, GP practices, clinical commissioning groups, local authorities, and any third-party supplier handling healthcare data. The DSPT is a contractual and regulatory requirement via the NHS Standard Contract.
Telecoms: The Telecommunications Security Act 2021
The Telecommunications Security Act 2021 (TSA) imposes security duties on telecoms providers by inserting sections 105A-105D into the Communications Act 2003. The Act uses principles-based language and does not name penetration testing directly.
Ofcom operates TBEST, a threat intelligence-led penetration testing scheme derived from CBEST, using independent testing companies to simulate attacks by nation-state and organised crime actors. Ofcom has described TBEST as voluntary, but retains compulsory audit powers under section 105N to commission security assessments of providers, which could effectively include penetration testing.
The Telecommunications Security Code of Practice (December 2022) sets out detailed security measures that providers are expected to implement, including testing and monitoring. While not legally binding in itself, Ofcom uses the Code of Practice when assessing compliance with the TSA’s legal duties.
NIS Regulations 2018
The Network and Information Systems (NIS) Regulations 2018 apply to operators of essential services (OES) and relevant digital service providers in the UK. Regulation 10 requires OES to take “appropriate and proportionate” security measures, using principles-based language that does not name penetration testing.
However, the NCSC’s Cyber Assessment Framework (CAF), which sector-specific competent authorities use to assess compliance, explicitly names penetration testing under Objective B4 (System Security): “regular vulnerability and security assessments, such as penetration tests and vulnerability scans.” Since competent authorities (Ofgem, DfT, CAA, DHSC, Defra, Ofcom, ICO) use the CAF to determine whether an OES meets its legal duties, the inclusion of pen testing in the CAF makes it a strong regulatory expectation.
DORA and UK Financial Firms
The Digital Operational Resilience Act (DORA) is an EU regulation. Post-Brexit, it has no direct application in the UK. UK regulators built their own Critical Third Party (CTP) regime, effective January 2025, which aligns closely with DORA but is separate.
DORA may still affect UK firms indirectly. If your organisation is a subsidiary of an EU-regulated entity, provides ICT services to EU financial institutions, or operates an EU branch, the EU entity’s DORA obligations – including TLPT every three years – could flow through contractually. In January 2026, UK regulators signed an MoU with the European Supervisory Authorities to reduce duplication for entities subject to both regimes.
Cyber Essentials Plus
A common misconception is that Cyber Essentials Plus involves penetration testing. It does not. The NCSC’s test specification describes CE Plus as “remote and on-site vulnerability testing” and “technical audit” – not penetration testing. The assessment checks whether the five Cyber Essentials controls are implemented via scanning and configuration checks, not via exploitation.
Cyber Essentials Plus is a voluntary certification, though it is required for certain UK government contracts involving sensitive or personal data. It is a useful baseline security measure, but it is not a substitute for a proper penetration test.
Summary: What the Law Actually Requires
| Framework | Pen Test Named? | Classification | Enforcement Body |
|---|---|---|---|
| UK GDPR Art 32 | No (ICO names it as method) | Legal mandate to test security; pen test is best practice | ICO |
| PCI DSS 4.0 | Yes (Req 11.4) | Contractual requirement (annual + after changes) | Card schemes / acquirers |
| FCA/PRA CBEST | Yes | De facto mandate for core systemic firms | FCA / PRA / BoE |
| FCA/PRA STAR-FS | Yes | Supervisory tool (wider reach) | FCA / PRA / BoE |
| NHS DSPT (9.2.1-9.2.2) | Yes (annual) | Regulatory requirement | NHS England |
| TSA 2021 | No (TBEST voluntary) | Regulatory expectation | Ofcom |
| NIS Regs 2018 | No (statute); Yes (CAF B4) | Legal duty; pen test via CAF assessment | Sector-specific CAs |
| DORA | N/A | Not directly applicable in UK | FCA/PRA/BoE (CTP equivalent) |
| Cyber Essentials Plus | No (vuln assessment only) | Voluntary certification | NCSC / IASME |
What This Means in Practice
If you are asking “do we legally have to do a pen test?”, the honest answer for most UK organisations is: not in those exact words, but yes in practice. UK GDPR requires you to regularly test your security measures. The ICO considers penetration testing an appropriate method. If you suffer a breach and cannot demonstrate that you tested your defences, you will find it difficult to argue that you took “appropriate technical and organisational measures” under Article 32.
For regulated sectors, the expectations are more direct. NHS organisations must pen test annually. Financial firms in the CBEST core group are directed to participate. Telecoms providers face Ofcom’s assessment powers. Operators of essential services are assessed against the CAF, which names pen testing explicitly.
FORTBRIDGE is a CREST-accredited penetration testing company based in the UK. We test web applications, APIs, mobile apps, networks, and cloud environments for organisations across the UK. If you need help understanding your regulatory obligations or scheduling a test, get in touch.
Frequently Asked Questions
Is penetration testing a legal requirement in the UK?
Not in those exact words. No single UK law says “you must do a penetration test.” However, UK GDPR Article 32 requires regular testing of security measures, and the ICO names penetration testing as an appropriate method. For specific sectors like healthcare (NHS DSPT) and financial services (CBEST), pen testing is either explicitly required or directed by the regulator.
Does UK GDPR require penetration testing?
UK GDPR requires a process for regularly testing and evaluating the effectiveness of security measures (Article 32(1)(d)). It does not name penetration testing specifically. The ICO’s guidance names pen testing as an appropriate technique. For organisations processing significant personal data, annual pen testing is the practical expectation.
What is CBEST and do I need it?
CBEST is a threat intelligence-led penetration testing framework operated by the Bank of England, PRA, and FCA. It targets systemically important financial institutions. If your firm is in the CBEST core group, you will be directed to participate by your supervisor. The core list is reviewed every three years. STAR-FS extends similar testing to wider financial firms on an invitation basis.
Does the NHS require penetration testing?
Yes. The NHS Data Security and Protection Toolkit (DSPT) assertions 9.2.1 and 9.2.2 explicitly require annual penetration testing. All organisations that access NHS patient data must complete the DSPT, including NHS trusts, GP practices, and third-party suppliers. Testers must be from CREST, The Cyber Scheme, CHECK, or hold ISO 27001/9001 certification.
Does Cyber Essentials Plus count as a penetration test?
No. Cyber Essentials Plus involves vulnerability scanning and configuration checks, not penetration testing. The NCSC describes it as “remote and on-site vulnerability testing” – it checks whether controls are in place but does not attempt to exploit vulnerabilities or test business logic. CE Plus is a useful security baseline but is not a substitute for a penetration test.
About Post Author
