Does SOC 2 require a penetration test?
No. SOC 2 is built on criteria, and criteria describe outcomes. None of the 33 common criteria says "perform a penetration test". The AICPA has never published a list of mandatory security tests for SOC 2.
What exists is softer. Under each criterion the AICPA lists points of focus, which are examples of what a good control might look like. They're guidance. An auditor may not fail you for skipping one, as long as the criterion itself is met some other way.
Which Trust Services Criteria relate to pen testing?
CC4.1: monitoring that controls work
This criterion asks you to evaluate whether your controls are present and functioning. One of its points of focus says management uses a variety of evaluations, "including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments."
That is the only place penetration testing is named, and it sits in a list of options.
CC7.1: finding vulnerabilities
This criterion asks you to detect new vulnerabilities and risky configuration changes. Its point of focus on scanning describes running vulnerability scans periodically and after significant changes to the environment, then fixing what they find.
So scanning is named directly and pen testing is named as an example. Neither comes with a required frequency.
The rulebook vs the auditor
Flip the switch to see the two answers side by side.
By the book, or in practice
| Is a pen test required? | No. It is an example under CC4.1. |
|---|---|
| Are vulnerability scans required? | Named in a point of focus under CC7.1. Not mandatory by the letter, though some audit firms treat scans as effectively required. |
| How often? | No frequency given. Scans are "periodic". |
| Who performs it? | Not specified. |
| What if you skip it? | Fine, if CC4.1 is met another way. |
What do SOC 2 auditors expect from a pen test?
- The right target. The test should cover the system named in your SOC 2 scope, not a marketing site.
- Independence. Someone who didn't build the system.
- A real report. Scope, method, findings by severity and dates.
- Proof you fixed things. Tickets for each finding and, ideally, a retest. Auditors care more about the fixes than about the findings.
- A date that fits. For a Type 2, inside the observation period.
Is vulnerability scanning enough for SOC 2?
A scan and a pen test aren't the same thing. A scan is an automated check for known weaknesses. A pen test is a person trying to break in, chaining issues together the way an attacker would.
Some auditors accept regular scanning with documented fixes for a small, simple system, particularly on a first Type 1. Many don't. Scans alone often leave an auditor unsure that CC4.1 is met. Ask your CPA firm in writing before the period starts, because finding out afterwards is too late to fix.
How often do you need a pen test for SOC 2?
Once a year is the convention, plus a fresh test after a major change such as a new product or a new cloud. SOC 2 itself is silent on frequency.
Be careful what you write down, though. If your security policy says "penetration testing is performed annually" and you miss a year, the auditor records an exception against the policy you wrote yourself.
So should you get one?
For almost every company selling to businesses, yes. Three reasons, none of them the AICPA:
- Your auditor will probably expect it, and arguing costs more than testing.
- Enterprise security questionnaires ask for a recent pen test whether or not you have a SOC 2 report.
- Finding and fixing a serious flaw before anyone else does strengthens the story your report tells.
It doesn't need to be a huge engagement. See what a SOC 2 pen test costs.
With AccuSights: light pen testing is available in-house, and our partners handle a full external test when you need one. The report and the fix evidence go straight into your Auditor Portal.