The penetration test SOC 2 and ISO 27001 auditors ask for

Neither SOC 2 nor ISO 27001 contains a line saying "you must buy a penetration test". Both are written in terms of outcomes, and both are almost always satisfied in practice by producing one. Knowing the difference saves you money and stops you buying the wrong thing.

What the frameworks actually say

SOC 2 is a set of Trust Services Criteria, not a checklist. The relevant ones — CC4.1 on monitoring and CC7.1 on identifying vulnerabilities — require you to evaluate whether your controls work, and to detect vulnerabilities in a timely way. Auditors accept independent penetration testing as evidence for both, and in practice ask for it. Your scope, your cadence and your risk assessment decide what is enough.

ISO 27001:2022 puts it in Annex A control 8.8, on management of technical vulnerabilities, supported by 8.29 on security testing in development. Again the standard describes an outcome; the certification body decides whether your evidence supports it.

The practical consequence: you are not buying a certificate, you are buying evidence. A report that clearly states scope, method, dates, findings and remediation is evidence. A scanner PDF with no coverage statement is not, whatever it cost.

What the auditor actually reads

In roughly this order: the coverage statement — what was in scope, what was excluded, which roles were tested and when; the methodology — which recognised standard was followed, named; the dates, because a report from two years and four releases ago evidences very little; the findings, with severities; and then the part most vendors skimp on, the evidence of remediation.

That last one is where engagements fail an audit. A report listing eleven findings and nothing else says you found problems and leaves open whether you fixed them. A retest appendix showing each one closed, verified and dated is what closes the control.

Common and expensive mistakes

Testing the wrong scope. Your audit boundary and your test scope should match. Testing the marketing site while the audit covers the platform helps nobody.

Leaving it until the observation window has started. SOC 2 Type II evidences a period. Test early enough that the fixes and the retest also fall inside it.

Buying a PCI ASV scan by mistake. That is a different, narrower, quarterly product for card environments. It does not substitute for a penetration test, and a penetration test does not substitute for it. If someone is selling you one as the other, stop.

Assuming the cloud provider covers you. AWS and Azure secure the infrastructure. Your application logic, your access control and your configuration are yours, and that is where findings come from.

What each framework points at, and what satisfies it

Questions