Typically a company should test their network, applications and devices when the company has added new network infrastructure devices or applications. Additionally, when Upgrades or Modifications are made to infrastructure,  a Penetration Test should be performed.  New Policies, Compliance, and Regulation changes also dictate when a company should perform cybersecurity testing. NIST SP 800-53 includes recommendations for keeping risk assessments up-to-date and performing periodic cybersecurity testing.