The license will be applicable to those vendors providing penetration testing as well as managed SoC monitoring. Failure to secure one means they must stop providing such services.