It means the requirement can’t be satisfied just once. It needs to be maintained. For example, suppose you work in academia. Publishing a journal paper requires only that it be accepted. Even if you stop publishing from then on, the paper will stay in the journal. In contrast, your university contract might require you to publish 2 papers every year. Just because you published 2 papers last year doesn’t mean you can avoid publishing any next year - it’s an ongoing requirement.
In the case of security, just because you showed last month that nothing could get through your firewall, it doesn’t mean you’re allowed to stop testing - maybe a new virus could get through next month. So penetration testing is an ongoing requirement - you need to keep doing it.