The global regulatory landscape for cybersecurity has never been more demanding — or more explicit about the need for penetration testing. For enterprise security leaders planning their 2027 security budgets, here's a comprehensive map of the regulations that mandate or strongly recommend VAPT across the markets that matter most.
APAC
Japan — ACDA (Active Cyberdefense Ability Act) Taking effect November 2026, the ACDA mandates cybersecurity measures for critical infrastructure operators across 14 sectors. Combined with METI's Cyber/Physical Security Guidelines for Factory Systems and the JAMA/JAPIA cybersecurity guidelines for the automotive supply chain, Japan is creating the most comprehensive cybersecurity compliance framework in APAC.
Australia — SOCI Act & APRA CPS 234 The Security of Critical Infrastructure Act covers 11 sectors with enhanced cybersecurity obligations and penalties up to AUD 15.6 million. APRA CPS 234 mandates information security capability — including penetration testing — for all APRA-regulated financial entities.
Singapore — MAS TRM & Cybersecurity Act MAS Technology Risk Management Guidelines mandate regular penetration testing for all financial institutions. The amended Cybersecurity Act introduces enhanced obligations for Critical Information Infrastructure operators.
Philippines — BSP Circular 982 The Bangko Sentral ng Pilipinas mandates cybersecurity frameworks for banks, with VAPT explicitly required.
Europe
NIS2 Directive Active across 27 EU member states, NIS2 Article 21 requires essential and important entities to implement risk-based security measures — including regular security testing. The scope is enormous: energy, transport, banking, health, digital infrastructure, and more.
DORA (Digital Operational Resilience Act) Mandatory for the EU financial sector since January 2025, DORA requires regular ICT risk assessments and — for significant financial entities — Threat-Led Penetration Testing (TLPT) at least every three years.
Cyber Resilience Act Taking effect December 2027, the CRA introduces mandatory cybersecurity requirements for products with digital elements sold in the EU.
Middle East
UAE — Central Bank Cybersecurity Framework & PDPL The UAE Central Bank cybersecurity framework mandates security testing for financial institutions. The Federal Decree-Law on Personal Data Protection adds security obligations for data processors.
Saudi Arabia — NCA ECC & SAMA The National Cybersecurity Authority's Essential Cybersecurity Controls are mandatory for government and critical infrastructure. SAMA mandates cybersecurity frameworks for financial institutions.
What This Means for Enterprise Budgets
The convergence of these regulations creates a simple reality: penetration testing is no longer optional for any enterprise operating across borders. The question isn't whether to test, but how frequently and how rigorously. Organizations operating in multiple jurisdictions need a VAPT partner who understands compliance mapping across frameworks — delivering reports that satisfy multiple regulators simultaneously.