Penetration testing is performed at least annually, or after major changes, to assess the effectiveness of implemented controls.