Compliance

Does SOC 2 Require a Penetration Test?

By NextGarrison Security TeamPublished 5 min read

Short answer: no, SOC 2 does not strictly require a penetration test (a hired expert tries to break into your systems, with permission). In practice, almost every company going through SOC 2 does one. Here is why, and how to get it right.

In plain English

  • SOC 2 does not strictly require a penetration test, where an expert tries to break in.
  • In practice, auditors and customers expect one, so almost every company does it.
  • Test the systems in your SOC 2 scope and fix serious issues before the audit.
  • After that, test at least once a year and after big changes.

What the SOC 2 criteria actually say

The Trust Services Criteria (the rules a SOC 2 audit checks you against) ask you to check whether your controls are working. Under criterion CC4.1, penetration testing is listed as one example of how to do that. Other examples include vulnerability scanning (automated tools that look for known weak spots) and internal audits. It is a suggestion, not a hard rule.

Criterion CC7.1 also expects you to find and manage vulnerabilities (security weak spots). A penetration test is one of the clearest ways to show that you do.

Why you should do one anyway

  • Auditors look for it. Without a pentest, you need other strong evidence that your controls are tested. A pentest report is the simplest evidence you can give.
  • Customers ask for it. Large customers send security questionnaires. These almost always ask for a recent pentest summary or attestation letter (a short signed note that a test was done), SOC 2 or not.
  • It finds real problems. Scanners miss flaws in how your app works, gaps in who can see what, and attacks that chain small issues together. A test by a person finds the issues an attacker would really use.

What to include in scope

Match the test to the systems in your SOC 2 scope. For most SaaS companies that means:

  • Your live web app, including role and tenant separation (each user and customer sees only their own data)
  • Public APIs (the connections other software uses to talk to yours) and the APIs your front end uses
  • Cloud configuration (AWS, Azure or Google Cloud)
  • External network: anything reachable from the internet
  • Any AI features, such as chatbots or agents with access to customer data (see AI red teaming)

When to test

Test before your Type I audit, and fix the serious findings before the auditor arrives. For Type II, run the test inside the observation window (the months the auditor reviews). That way the report falls within the audited period. After that, test at least once a year. Also test after major changes such as a new product, a new cloud environment or a large architecture change.

If you release often, penetration testing as a service spreads testing across the year instead.

What a good SOC 2 pentest report includes

  • An executive summary that a customer or auditor can read in two minutes
  • Scope, dates, method and who did the testing
  • Each finding with severity, evidence and clear steps to fix it
  • Retest results showing which findings are now fixed
  • A short attestation letter you can share with customers without exposing details

Our penetration testing service includes all of the above, plus a retest after you fix the findings.

#SOC 2#Penetration testing

Need a hand with this?

Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.

Get a SOC 2 penetration test quoteContact Us

Written by

NextGarrison Security Team

Penetration testers, SOC analysts and compliance consultants

Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.

Frequently Asked Questions

Is a vulnerability scan enough for SOC 2?

Scans are useful proof that you keep finding and fixing weak spots. But they do not replace a penetration test. Most auditors and customers expect both: regular scans and an annual manual test.

Does SOC 2 Type II require a penetration test?

Neither Type I nor Type II strictly requires one. For Type II, a pentest done inside the observation window is common and gives strong evidence that your controls are tested.

Keep reading

Compliance

How to Tell Customers Your SOC 2 Is Underway (and Use It to Win Deals)

· 7 min read

Compliance

ISO 27001 vs SOC 2: Which One Do You Need?

· 6 min read

Compliance

SOC 1 vs SOC 2 (and SOC 3): Which SOC Report Do You Need?

· 7 min read