Apart from vulnerability scans, do you perform penetration testing on your network? If so, please describe the frequency.

Yes penetration testing for application is performed annually