Best practice is that penetration testing of systems and networks is conducted at least annually, and also whenever there are any significant changes.