Audit-ready by design.

Requirement 11.4 asks for internal and external penetration testing performed to a defined, documented methodology, at least once every 12 months and after any significant infrastructure or application change. Sub-requirement 11.4.4 requires that exploitable vulnerabilities and weaknesses found during testing are corrected and that testing is repeated to confirm the fix.

A Vexera engagement runs to a written scope and rules of engagement across the agreed perimeter and application layers, whitebox, blackbox, or both cross-checked. Every finding ships with reproduction evidence and the exact path taken, which is what a QSA reads as test results. Retest is part of the engagement, so corrected issues are re-exercised and the outcome recorded rather than assumed.

CC4.1 expects the entity to perform ongoing or separate evaluations to confirm that internal controls are present and functioning, and an independent penetration test is a common separate evaluation. CC7.1 expects detection and monitoring procedures that identify configuration changes introducing new vulnerabilities and susceptibility to newly discovered ones.

Vexera delivers a scoped, independent assessment with dated, evidence-backed findings that a service auditor can cite as a separate evaluation. Because engagements can be re-run after each release, they also work as an ongoing control that surfaces newly introduced weaknesses, and the report ties each finding to the affected systems for CC7.1.

Annex A 8.8 requires that information about technical vulnerabilities is obtained, the organization's exposure evaluated, and appropriate measures taken. A 8.29 calls for security testing across the development life cycle, and A 5.35 for independent review of the security approach at planned intervals or after significant change.

An engagement obtains that vulnerability information through active exploitation rather than a signature list, and grades each finding by demonstrated impact so exposure can be evaluated and prioritized. Delivered by an external party, it also serves as the independent review under A 5.35, and it can be scheduled against your release cycle to support A 8.29.

Article 21(2) sets the minimum risk-management measures essential and important entities must take, including vulnerability handling under point (e). Point (f) requires policies and procedures specifically to assess whether those measures are effective in practice.

Testing that produces a reproducible exploit is direct evidence of effectiveness, or the lack of it, rather than a policy attestation. A Vexera engagement gives your management body and, where asked, supervisory authorities concrete results tied to named systems, and the retest step shows that remediation actually closed the issue.

Articles 24 and 25 require financial entities to run a digital operational resilience testing programme that includes, among other tests, vulnerability assessments and penetration testing of the ICT systems supporting critical functions. Articles 26 and 27 add threat-led penetration testing at least every three years for entities designated by competent authorities, with specific requirements for the testers.

Vexera covers the general programme with scoped, evidence-backed penetration testing of the systems you nominate. For TLPT, our threat-led, intelligence-driven method and senior human oversight fit the model in Articles 26 and 27, though the formal designation, TIBER-EU alignment, and tester attestations are handled per engagement with your competent authority.

The evaluation standard requires a periodic technical and nontechnical evaluation establishing the extent to which security policies and procedures meet the Security Rule, in response to environmental or operational changes that affect the security of electronic protected health information.

A Vexera engagement provides the technical half of that evaluation: hands-on testing of the systems that store or transmit ePHI, with findings evidenced and ranked by demonstrated risk. Re-running after significant changes keeps the evaluation current instead of a once-a-year snapshot.