Framework mapping
Web application testing evidence, connected to the EU requirements that matter to your team.
Start with the application.
We test your agreed scope, document verified findings and explain how to fix them. Where needed, the report links that evidence to relevant security requirements. A mapping supports your review; it does not certify compliance.
| Reference | When relevant | Testing evidence |
|---|---|---|
| GDPR · Article 32 | Applications processing personal data within GDPR’s scope. | Access control, data exposure and security testing results can support evaluation of technical safeguards. GDPR requires risk-appropriate measures, not a universal annual pentest. |
| NIS2 · Article 21 | Covered organisations, subject to applicable national implementing law. | Findings and retest records can support secure development, vulnerability handling and assessment of security measures. Applicability depends on sector, size and other scope rules. |
| DORA · Articles 24–25 | Financial entities within DORA’s scope. | Web app and API testing can form part of a risk-based resilience testing programme. A standard pentest is not the advanced threat-led testing required of selected entities under Article 26. |
Technical baseline: OWASP ASVS provides verifiable web application security requirements. We can agree the version and selected requirements during scoping. It is a technical standard, not EU law.
Building a software product? A note on the Cyber Resilience Act.
The CRA covers products with digital elements placed on the EU market, including qualifying remote data processing solutions. It does not automatically cover every website or standalone SaaS service. For an in-scope product, testing can contribute evidence towards Annex I security requirements; it is not a conformity assessment. Main obligations apply from 11 December 2027; Article 14 reporting obligations apply from 11 September 2026. European Commission overview →
Mapping is agreed against your scope and evidence needs. Organisational, operational and legal obligations extend beyond application testing. References checked 16 October 2026.
GET IN TOUCH
Let’s discuss your requirements.
Tell us what you need assessed and when. We’ll help define a clear scope for your engagement.
contact@procsecurity.com ↗Prepare your enquiry below, then send it using your email app.