Crowdfunding platform operators must ensure cyber-security at all times including conducting IT security penetration testing semiannually by an independent consultant.