Minimum once annually. We highly recommend to conduct penetration testing two times. It becomes mandatory if any component is added to the infrastructure or if the application is modified.