I guess the regulation wouldn't require a pentest in my mind, at least not for all classes of devices. Something along the lines of self-regulation/providing ba

I guess the regulation wouldn't require a pentest in my mind, at least not for all classes of devices. Something along the lines of self-regulation/providing basic documentation that you've adhered to some set guidelines would be a good step in my mind. If you're found in violation of those guidelines though, by all means require a pentest going forward. I honestly haven't a clue whether or not that might work in practice though.