Staying Compliant with Penetration Testing and Vulnerability Assessments