The Microsoft 365 Certification specification does not require ISVs to undertake penetration testing retests, providing adequate remediation evidence can be provided to demonstrate that issues identified within the penetration testing report are remediated.