Run penetration testing
Security and data protection: Run penetration testing. Starts when: Annual. Steps: Scope; Test; Findings; Fix; Retest. Done when: Findings are closed and retested with receipts. Rules that apply: FCA SYSC 15A; CBEST where applicable.