Pentest for SOC 2 and ISO 27001

Your audit starts in three months. Here is how the pentest fits.

SOC 2 and ISO 27001 don't demand a pentest in those words. Even so, nearly every auditor asks for one. Here is what they want to see, when, and how to keep the test from falling outside your audit window.

What SOC 2 asks for

The Trust Services Criteria don't mention the word pentest. They ask you to detect and manage vulnerabilities and to check that your controls work. In practice nearly every auditor translates that into an external pentest within the audited period, evidence that the findings were followed up, and a statement from the tester. In a Type II report that evidence has to come from the period itself; last year's test doesn't count.

What ISO 27001 asks for

ISO 27001 (2022 edition) is specific. Control 8.8 covers management of technical vulnerabilities; 8.29 covers security testing in development and acceptance. The certification body wants to see that you do this systematically and act on the results. An annual manual test with retest is the usual evidence.

The scope follows your system description

Your auditor looks at the system you delimited in your system description. If the pentest tests something else, you have a report but not evidence. That is why I align the scope with that description before the test — same application, same environment, same roles — and that is literally what the attestation letter (TPM) records.

Timeline

Schedule the test at the start of your audit window. Not in the last month; you need time to fix.
Five days of testing, report within three working days. From the start you have an attestation letter within fifteen working days.
Fix, then retest. Included within 90 days; every round produces a signed statement.
Hand your auditor the attestation letter and the statements. Their questions I answer myself.

Shipping continuously?

Then one test a year is a photo of a film. With Release Guard I test every release on what changed, with the annual test as the baseline. If your auditor accepts continuous verification as a complement, agree it with them first; I provide a summary of the delta tests alongside the attestation letter.

What if the questionnaire comes from a customer under NIS2?

More and more often the pentest isn't asked for by your auditor but by a large customer who is under NIS2 and has to monitor its suppliers. The answer is the same evidence: a recent test, the attestation letter and the retest statement. NIS2 doesn't require quarterly pentests; an annual, risk-based assessment is enough. For the state of transposition in Spain and the ENS, read Pentest for ENS. The full mapping — criterion by criterion, control by control — is in the 2026 guide.

What the auditor gets

The attestation letter: scope, method, period, outcome.
The retest statement per round.
On request: the methodology in detail and answers to their questions.

The technical report stays with you. An auditor doesn't need the findings to check that you have resolved them; that is what the statement is for.

FAQ

Frequently asked questions

Does the pentest have to fall within the audited period?

For a SOC 2 Type II, yes. For ISO 27001 the auditor wants to see a recent test; older than a year is rarely accepted.

Does the interim test in the Annual plan count as evidence?

Yes, as a complement to the full test. The interim test focuses on what changed since the previous test; the full test remains the baseline.

My auditor wants to see the full report. Do I have to hand it over?

That is your call. Most auditors are satisfied with the attestation letter and the retest statement. If yours wants more, share the report under confidentiality, not as an annex to the file.

A 30-minute call is enough to know whether this fits.

Book a scoping call

Prefer email? Send your scope to info@hacketico.es — within 24 hours on working days you'll know whether it fits in 5 days and what it costs.