When You Require Penetration Testing?

Main reasons are:
1) Manage risk by defending against vulnerabilities and warding off threats, which have the potential to become actual events.
2) Save on costs associated with recovery and remediation after a breach.
3) Reduce chances of network and application downtime, leading to loss of productivity and availability.

When you implement a new IT system, or yearly, if you have sensitive data or customer data stored in your system.

Yearly at least and it should be part of IT governance policy.

Pen testing should be undertaken after deployment of new infrastructure and applications as well as after major changes to infrastructure and applications (e.g. changes to firewall rules, updating of firmware, patches, and upgrades to software). IT Governance provides comprehensive pen testing and PCI QSA services.

to simply to prevent websites from crber attacks