An increase in the number of security incidents is the most significant indicator of the need to

perform a penetration test, because it suggests that the organization’s IT systems or networks are

vulnerable to attacks and may not have adequate security controls in place. A penetration test is a

simulated attack on an IT system or network to identify and exploit its weaknesses and evaluate its

security posture. A penetration test can help to discover and remediate the vulnerabilities that may

have caused or contributed to the security incidents, and to prevent or reduce the likelihood and

impact of future incidents. An increase in the number of high-risk audit findings, an increase in the

percentage of turnover in IT personnel, and an increase in the number of infrastructure changes are

all possible indicators of the need to perform a penetration test, but they are not the most significant

indicator, as they do not directly reflect the actual or potential occurrence of security incidents.

Reference = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.3.2, page 200