Does SOC 2 require penetration testing?
No, not in writing. In practice most auditors and enterprise buyers expect one, and the criteria themselves explain why.
The short answer is no. SOC 2 doesn’t require a penetration test, or any other specific control, in writing. The longer answer is that the criteria ask for things a pentest proves well, so most auditors expect one, and enterprise customers often require it in their contracts.
What an auditor says
Mike DeKock, a CPA who runs a firm that issues SOC reports, answered the question for the Cloud Security Alliance1:
The short version of the answer is “no” - there are no explicit requirements for penetration testing (or any controls) within a SOC 2 report.
He adds the part founders tend to miss: “a penetration test isn’t required to complete a SOC 2 report, but it is highly advisable.” And there’s one case where it is required: “Do you have any customer contracts requiring a penetration test? If yes, then it’s required.”1
Why it ends up in most reports anyway
SOC 2 is built on criteria, not a list of controls. You design the controls, and the auditor checks them against the criteria. Two criteria point straight at testing.
CC4.1 asks the entity to perform “ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.”2 Its 2022 point of focus names the evaluations it has in mind3:
Depending on the entity’s objectives, such risk and control evaluations may include … vulnerability scans, security assessment, penetration testing, and third-party assessments.
The 2017 wording was even more direct and put penetration testing first: “Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments.”2
CC7.1 covers vulnerabilities. Its point of focus on scanning describes infrastructure and software scans “on a periodic basis and after significant changes are made to the environment.”3 Vanta reads the two together: SOC 2 “does require you to identify vulnerabilities in your systems so most auditors will require you to do a penetration test as part of the SOC 2 process.”4
What the people who prepare you for audit say
| Source | Their answer |
|---|---|
| Mike DeKock, CPA | Not required, “but it is highly advisable”1 |
| Vanta | “most auditors will require you to do a penetration test”4 |
| Secureframe | “almost all SOC 2 reports include them and many auditors require one”5 |
| Drata | “Though not always required by SOC 2, many customers demand an annual pen test”6 |
| Software Secured | “auditors and enterprise buyers expect evidence of vulnerability management”7 |
When scans might be enough
Not every auditor insists on a pentest. Secureframe says that where auditors don’t require one, “they will still typically require you to run vulnerability scans, rank risks resulting from these scans, and take steps to mitigate the highest risks on a regular basis.”5 On Hacker News, one commenter was blunter: “You literally do not need a pen test to pass SOC2 Type 1, for example.”8 That’s one person’s experience, not a rule, and it says nothing about what your customers will ask for.
So the useful question isn’t whether SOC 2 requires a pentest. It’s whether your auditor, your customers and your contracts do. Ask all three before you buy anything.
Type 1 and Type 2 change the timing
A Type 1 report looks at the design of your controls on a single date. A Type 2 looks at whether they worked over an observation period, which Software Secured says is “usually 6–12 months.”7 For a Type 2, Vanta says the test “must be completed before the end of your SOC 2 observation period in order to be included in your control matrix.”4 Software Secured adds that many firms want evidence of remediation, not just the report.7 More in Type 1 vs Type 2 pentesting.
Having the evidence without a five-figure bill
Drata puts a SOC 2 pentest at $5,000 to $15,0006, and most published prices start around there (see what SOC 2 pentests cost). If your auditor accepts an automated external test, or you want the obvious problems fixed before a manual tester bills by the hour, Pentrail does that for $20 per domain: a non-destructive test of your ports, exposed files, redirects, TLS and subdomains, with a report mapped to SOC 2 criteria and a letter of attestation.
It doesn’t cover anything behind your login, and no test makes a company SOC 2 compliant. What it gives you is evidence for CC4.1 and CC7.1 and a cleaner external surface before the audit.
See your own grade
Scan your domain and see what an attacker sees.
No SOC 2 criterion requires a penetration test by name. CC4.1 lists it as one kind of evaluation and CC7.1 expects regular scans. Most auditors and many customers expect a pentest anyway, so ask your auditor and read your contracts before deciding.
Questions
Can you pass SOC 2 without a penetration test?
Does the type of SOC 2 report change the answer?
Which SOC 2 criteria relate to penetration testing?
Do SaaS startups need a pentest for SOC 2?
Sources
- Mike DeKock, CPA (MJD Advisors), published by the Cloud Security Alliance, SOC 2 Reports and Penetration Tests:
The short version of the answer is “no” - there are no explicit requirements for penetration testing (or any controls) within a SOC 2 report. … Do you have any customer contracts requiring a penetration test? If yes, then it’s required. … So, a penetration test isn’t required to complete a SOC 2 report, but it is highly advisable.
- AICPA, TSP Section 100 (2017 criteria, March 2020 update), PDF hosted by Arpio, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy:
CC4.1 COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. … Considers Different Types of Ongoing and Separate Evaluations — Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments.
- AICPA 2017 Trust Services Criteria with revised points of focus (2022), as transcribed in the open-source CISO Assistant library, SOC 2 2017 TSC (rev. 2022), points of focus CC4.1 and CC7.1:
Depending on the entity’s objectives, such risk and control evaluations may include first- and second-line monitoring and control testing, internal audit assessments, compliance assessments, resilience assessments, vulnerability scans, security assessment, penetration testing, and third-party assessments. … Conducts Vulnerability Scans — The entity conducts infrastructure and software vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after significant changes are made to the environment.
- Vanta, Penetration testing 101:
If your penetration test is for SOC 2 compliance, the penetration test must be completed before the end of your SOC 2 observation period in order to be included in your control matrix. … That said, SOC 2 does require you to identify vulnerabilities in your systems so most auditors will require you to do a penetration test as part of the SOC 2 process.
- Secureframe, Penetration Testing 101: A Guide to Testing Types, Processes, and Costs:
While a pen test is not an explicit requirement for SOC 2 compliance, almost all SOC 2 reports include them and many auditors require one. … In cases where auditors don't require you to have a third-party pen test completed, they will still typically require you to run vulnerability scans, rank risks resulting from these scans, and take steps to mitigate the highest risks on a regular basis.
- Drata, How Much Does a SOC 2 Audit Cost?:
Penetration Testing ($5,000 - $15,000): Though not always required by SOC 2, many customers demand an annual pen test as part of their due diligence.
- Software Secured (penetration testing firm), SOC 2 Penetration Testing Services:
SOC 2 Penetration testing isn’t explicitly mandated, but auditors and enterprise buyers expect evidence of vulnerability management. … A SOC 2 Type 2 audit assesses whether controls operated effectively over an observation period (usually 6–12 months). For Type 2, auditors expect annual testing, and many firms require evidence of remediation in addition to the pentest report itself.
- Hacker News user TameAntelope, in the thread “Tailscale is officially SoC 2 compliant”, Comment on Hacker News:
You literally do not need a pen test to pass SOC2 Type 1, for example.