Short answer: SOC 2 doesn’t name a penetration test. Longer answer: your auditor and your enterprise customers will almost certainly ask for one.
Who it’s for
SaaS and technology companies selling to larger businesses
You’ll learn
- · What SOC 2 asks for
- · Why customers expect a pentest
- · How to time it
Reading time
6 min read
Key takeaways
- SOC 2 does not name a penetration test explicitly.
- Auditors and customers usually expect one.
- Time it within your observation period.
SOC 2
Global- The requirement
- CC4.1 and CC7 — monitoring activities and control effectiveness.
- Auditors look for
Annual penetration test report
Risk-rated findings with retest results
Tracked remediation of findings
- How we help
- Annual penetration testing and test evidence your auditor can rely on.
- 1
What SOC 2 says
The SOC 2 trust services criteria focus on monitoring activities and the effectiveness of controls (for example CC4.1 and CC7). They do not name a specific test.
- 2
Why teams test anyway
An annual penetration test is one of the most direct ways to show that controls work in practice. Enterprise customers also ask for a recent report during security reviews.
- 3
Timing it right
Schedule the test inside your audit observation period, and leave time to fix findings and retest before the window closes.
- 4
Type I vs Type II
A Type I report looks at your controls at a point in time; a Type II report looks at how they operated over a period. For Type II, plan testing inside the observation period so the evidence counts.
- 5
Answering customer questionnaires
Enterprise buyers often ask for a recent penetration test summary. A clean executive summary and attestation letter answers most questionnaire questions without sharing sensitive detail.
How our team helps
- 01Test the systems in your SOC 2 scope
- 02Deliver an executive summary customers can review
- 03Retest fixes within your audit window
- 04Provide an attestation letter
- 05Time testing inside your observation period
- 06Write a summary suitable for customers
- 07Help answer security questionnaires
We time tests inside your observation window, with retest results ready for the auditor.
— The CRIS InfoTech security team