Home
Penetration testing
SOC 2 penetration testing

SOC 2 penetration testing that auditors accept as evidence

SOC 2 never names a pentest — but it’s how you prove the Security criteria work. We map every finding to CC6 and CC7, and time the test to your observation period.

Get a quote See a sample report

Trust Service CriteriaSOC 2

What a pentest evidences for SOC 2

CC6.1Logical access controls
CC6.6Controls against external threats
CC7.1Vulnerability identification
CC7.2Security event evaluation

Mapped to your control narrativeAudit-ready

01 · Where it fits

SOC 2 doesn’t name a pentest. Auditors expect one anyway

The Trust Service Criteria don’t mention penetration testing by name. But a pentest is how you show the Security criteria actually work — not that a policy says they should. Enterprise buyers and cyber insurers now ask for the report directly.

Criterion

What it requires

How a pentest evidences it

CC6.1

Logical access controls prevent unauthorised access

The test proves controls can’t be bypassed, not just that they exist

CC6.6

Measures against threats outside the system boundary

An external test validates the perimeter from the attacker’s side

CC7.1

Detect and manage vulnerabilities

Manual testing finds what scanners miss, with tracked remediation

CC7.2

Evaluate and respond to security events

The test can reveal gaps in logging and detection

Your report maps each finding to the criteria above, so it drops straight into your control narrative. One test can also serve ISO 27001.

Talk to a SOC 2 consultant

02 · Timing

Test before the observation period, not after

For SOC 2 Type II, auditors want evidence that controls worked across the whole period. The clean sequence is test, fix, then start the clock.

Scope

Define the system boundary — the infrastructure, apps and APIs your SOC 2 report covers.

Test & fix

Run the pentest, remediate critical findings, and keep the evidence.

Observation

Start your Type II observation period with controls already proven.

Retest

We re-test the fixes and attest to closure — clean evidence for the auditor.

Type I attests that controls are designed well; Type II attests that they worked over 6–12 months. A pentest matters most for Type II — do it before the period begins.

Plan your test timing

03 · The evidence

What the auditor actually receives

A pentest report an auditor can use: findings mapped to the Trust Service Criteria, with proof and tracked remediation.

Criteria-mapped reportEvery finding tagged to the CC6/CC7 control it evidences.
Attestation letterA signed retest attestation for your auditor and your customers’ due-diligence teams.
Customer-ready summaryA shareable summary you can send to enterprise buyers who ask for the report.

Want the full sample report? Ask for it in the form and we’ll send it.

S2-CC6.1Sample finding · redacted

Access control bypass on a tenant-scoped endpoint

SeverityHigh

CriterionCC6.1

StatusClosed

Evidence

finding raised → fix deployed → retest: passed
evidence pack → attestation letter → auditor

Business impact

Without a validated test, the auditor has only your policy. With one, they have proof the control works and was fixed when it didn’t.

Fix

Each finding carries a criterion reference, proof, remediation and a retest result, so it maps straight onto your control matrix.

Mapped to CC6.1 for the control narrative.Retest: fixed

See the deliverables

Starting from€5,000

Scoped to your SOC 2 system boundary

A SOC 2 test is a web, cloud or network test scoped to your report boundary. The type and size set the price. See penetration testing pricing.

Get a fixed quote

05 · Questions

SOC 2 penetration testing FAQ

Get a quote

More in our SOC 2 penetration testing guide.

Does SOC 2 require a penetration test?

Not explicitly. The Trust Service Criteria don’t name penetration testing. But it’s become the standard way to evidence the Security criteria (CC6 and CC7), and auditors, enterprise buyers and cyber insurers increasingly ask for the report.

When should we run the test — before or during the observation period?

For Type II, before. Test, fix the critical findings, then start your observation period with controls already proven. A test conducted during the period also works; one conducted after it closes is too late for that report.

Which Trust Service Criteria does a pentest support?

Mainly CC6.1 (logical access), CC6.6 (external threats), CC7.1 (vulnerability management) and CC7.2 (event evaluation). Your report tags each finding to the criterion it evidences so it fits your control narrative.

Can one test cover SOC 2 and ISO 27001?

Yes, if the scope and method are aligned. Many of our clients run SOC 2 for North America and ISO 27001 for Europe; a single engagement can evidence both, plus NIS2 or DORA where relevant.

How recent does the report need to be?

There’s no fixed age in the standard, but for Type II a test within the observation period is best, and enterprise buyers typically expect one within the last 12 months.