FTC GLBA Safeguards Rule (16 CFR Part 314) 314.4(d)(2): 314.4(d)(2) Continuous monitoring or annual penetration testing and six-monthly vulnerability assessment

For information systems, monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments; absent effective continuous monitoring or other systems that detect changes creating vulnerabilities on an ongoing basis, the institution conducts annual penetration testing of its information systems, scoped each year to the relevant risks identified in the risk assessment, and vulnerability assessments including systemic scans or reviews reasonably designed to find publicly known vulnerabilities, at least every six months, whenever there are material changes to operations or business arrangements, and whenever circumstances may have a material impact on the program. Not required of institutions holding information on fewer than 5,000 consumers (314.6).