One test that satisfies the auditor and would stop the attacker.
Compliance and security aren’t the same purchase, but they should be the same test. We run one engagement that clears the requirement and would stop the attacker.
What it actually requires.
“You need a pen test” isn’t always true. Hover a region, pick a framework, and the real requirement opens beside it.
Your controls hold against a real attacker.
We map your obligations to the controls that satisfy them, then test that those controls hold against a real attacker, not just an auditor.
You fix in priority order, on a plan.
Findings come sequenced into a remediation roadmap your team can actually work, tied to the frameworks you answer to.
One test, every framework you answer to.
SOC 2, PCI, ISO, HIPAA and DORA overlap far more than they differ. One real engagement satisfies what each of them asks for, not a separate scramble for every audit.
Proof an auditor and an attacker both accept.
Incenter automates evidence collection and keeps it current against your control set continuously.
See the platform →Expert engagements satisfy the testing requirements auditors expect: penetration testing, control validation, and more.
Meet the team →What each one asks of you, and the evidence it leaves.
- Directive (EU) 2022/2555
NIS2 Directive
NIS2 does not ask you to pass a test.
· Transposition deadline - Regulation (EU) 2022/2554
Digital Operational Resilience Act
DORA requires financial entities designated by their competent authority to run threat-led penetration testing of the live systems behind their critical functions at least every three years, with qualified testers.
· Applies from - Regulation (EU) 2024/2847
Cyber Resilience Act
The CRA makes the manufacturer responsible for the security of a product with digital elements for its whole support period, and since 11 September 2026 it has had reporting duties with a clock: 24 hours from learning that a vulnerability in your product is being exploited.
· Reporting obligations apply (Article 14) - Directive (EU) 2024/2853
Product Liability Directive
From 9 December 2026, software is a product under EU liability law, and a product can be defective because of a security weakness it should not have had or an update it should have received.
· Applies to new products from - 23 NYCRR Part 500, as amended with effect from 1 November 2023
NYDFS Cybersecurity Regulation
Part 500 is the one regulation on this list that names penetration testing.
· Annual certification due