Guide · version 1.0 · 27 September 2026
Penetration testing for SOC 2, ISO 27001, ENS and NIS2 in Spain (2026)
A 32-page regulatory intelligence report: what each framework actually requires, what auditors expect in practice, and how one testing programme can evidence all four. Legal position as at 27 September 2026. Free, no email address required.
Download the guide (PDF, 0.7 MB)
The position in one table
| Framework | What the text says | Badge | Frequency · who checks |
|---|---|---|---|
| SOC 2 | The Trust Services Criteria never name a pentest (CC4.1, CC7.1–CC7.4, CC6.1, CC6.6, CC6.7, CC8.1, CC9.2). It becomes auditable the moment your system description names one. | C → B | At least one test per review period, with remediation and retest evidence. Checked by a licensed CPA firm. |
| ISO/IEC 27001:2022 | No Annex A control is called "penetration test"; 8.8 and 8.29 depend on one. Auditable once the Statement of Applicability names it. | C → B | Risk-based; auditors expect an annual cycle aligned to surveillance audits. ENAC-accredited certification body. |
| ENS (RD 311/2022) | The only text that names the test: [op.mon.3.r6.3] penetration tests at category ALTA; [mp.s.2] security audits of web applications at every category; [op.nub.1.2] for third-party cloud services. | A | No numeric frequency: set by the audit procedure and the risk analysis. Art. 31 audit at least every two years. Certification body (MEDIA, ALTA); self-assessment (BÁSICA). |
| NIS2 | Directive Art. 21(2)(f) expects effectiveness assessments; Implementing Regulation (EU) 2024/2690 point 6.5 mandates a security-testing policy for the digital entities it lists. Spain's transposition law is not in force as at 27 September 2026. | B / A | As set in your own security-testing policy. Supervision pending the designation of national authorities. |
"A" means the legal text itself requires the test; "B" that the scheme or your own declared controls make it auditable; "C" that auditors expect it in practice. The guide keeps the four apart on every page.
Three findings that change how you plan 2026
Only two texts mandate a test in Spain today. ENS Annex II does so at category ALTA ([op.mon.3.r6.3]) and for web applications at every category ([mp.s.2]); Implementing Regulation (EU) 2024/2690 point 6.5 does so for the digital-infrastructure and digital-provider entities it lists.
SOC 2 and ISO/IEC 27001 never legally require a penetration test. Neither names one. Both become auditable the moment your own system description or Statement of Applicability names one — and both are examined against what you wrote.
Spain's NIS2 law is not in force. As at 27 September 2026 the transposition bill has not been published in the BOE. The directive's Arts 20, 21 and 23 already fix the substance and the Implementing Regulation applies directly; the penalty regime becomes enforceable in Spain only once the national law is published. There is no "October 2026 NIS2 deadline" in Spain.
What is inside
- Executive summary: the framework × badge matrix.
- Why 2026 is different in Spain: NIS2, the ENS mid-cycle, DORA, the CRA — with a dated timeline 2022 → 2027.
- Pentesting fundamentals for compliance: test types, scan vs pentest vs red team, methodology standards, severity scoring.
- SOC 2: criterion mapping, the evidence auditors request, sample control language for the system description.
- ISO/IEC 27001:2022: control mapping, the clauses that consume the test, Statement of Applicability wording.
- ENS: categories, testing-related measures by category, the certification cycle, the CCN-STIC guides the auditor applies.
- NIS2 in Spain: status board, what binds in substance now, what changes on publication in the BOE.
- One programme, four frameworks: unified annual calendar, frequency matrix, artefact cross-mapping.
- Legal and contractual basis in Spain: Código Penal, rules of engagement, GDPR Art. 28 terms, cloud-provider policies, evidence retention.
- Procuring a provider: qualifications, independence, insurance, 21 RFP requirements, red flags, evaluation sheet.
- Reporting: anatomy of an audit-ready report, remediation SLAs, retest statuses, attestation letter wording.
- Checklists per framework and a 90-day plan.
- Glossary (English/Spanish), references, regulatory watch list, change log.
Who it is for
CISOs, security and GRC leads, DPOs and CTOs of organisations operating in Spain — SaaS and cloud providers, managed service providers, fintech, public-sector suppliers and multinationals with Spanish entities — and the penetration-testing providers who serve them. It assumes technical literacy and no legal background. Sections 9 to 12 are written so procurement and delivery teams can use them as they stand.
How current it is
Every page that describes regulatory status carries "legal position as at 27 September 2026". Next review: March 2027, or earlier if Spain publishes its NIS2 transposition law in the BOE. Section 13.3 lists the events that would trigger a re-issue and section 13.4 the items still to verify. The guide is general information for practitioners, not legal advice.
The shorter pages on this site cover the same questions: pentest for ENS · pentest for SOC 2 and ISO 27001 · what is an attestation letter?
FAQ
Frequently asked questions
Is the guide free?
Yes. Download the PDF directly; no form, no email address. It is published by Hacketico (CyberScore B.V.) as general information for security and compliance practitioners, not as legal advice.
Is there a Spanish or Catalan version?
The guide is in English (UK spelling). The Spanish and Catalan pages of this site summarise the ENS and NIS2 positions; a translation follows if there is demand.
How do I know it is still current?
Every page carries "legal position as at 27 September 2026". The next review is March 2027, or earlier if Spain publishes its NIS2 transposition law in the BOE; the regulatory watch list in section 13.3 says what would trigger a re-issue.
Can I share it with my auditor or my customers?
Yes. Share it whole, with its version and date, so that everyone reads the same position.
A 30-minute call is enough to know whether this fits.
Book a scoping callPrefer email? Send your scope to info@hacketico.es — within 24 hours on working days you'll know whether it fits in 5 days and what it costs.