Legislative bodies and industry organizations may require certain organizations to comply with requirements to avoid sanctions or carry out business functions. Pen testing is one way to determine if an organization's policies and controls comply with pertinent requirements. Two common compliance requirements that mandate pen tests are PCI DSS and GDPR.