Which SOC 2 trust services criteria does a pentest cover?
A pentest isn’t one of the criteria. It’s evidence, and it lands on a handful of the common criteria. Here’s the exact wording and what to show your auditor for each.
SOC 2 reports are organized around the AICPA’s trust services criteria. Your auditor maps your controls to them and tests whether they work. A pentest is one control, and its results count as evidence for several criteria at once. This page quotes the wording that matters and shows what to hand over for each.
Criteria, points of focus and your controls
The criteria are fixed statements of what must be achieved. Under each sit points of focus, which describe what meeting it can look like. You choose the controls. Mike DeKock, a CPA, explains that a SOC 2 report “typically includes a control matrix that maps your controls against the applicable trust services criteria,” and that points of focus guide rather than dictate: “each organization is unique, and the application of any individual control is not universal.”1
The criterion text below is from the AICPA’s 2017 criteria2, which the 2022 revision kept. The 2022 points of focus are quoted from the open-source CISO Assistant transcription of the AICPA document3, because the AICPA’s own PDF sits behind a free account login.6
The two criteria that name testing
CC4.1 is the monitoring criterion: “The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.”2 Its point of focus on types of evaluation lists penetration testing3:
Management uses a variety of ongoing and separate risk and control evaluations to determine whether internal controls are present and functioning. Depending on the entity’s objectives, such risk and control evaluations may include … vulnerability scans, security assessment, penetration testing, and third-party assessments.
CC7.1 covers new vulnerabilities. The entity uses “detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.”2 Its point of focus on scanning reads3:
Conducts Vulnerability Scans — The entity conducts infrastructure and software vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after significant changes are made to the environment.
Criterion by criterion
Here’s where pentest findings land, with each criterion’s wording2 and what to give the auditor.
| Criterion | Wording (excerpt) | What a pentest shows | What to hand the auditor |
|---|---|---|---|
| CC2.3 | “communicates with external parties regarding matters affecting the functioning of internal control” | Whether outsiders have a way to report a security problem, such as a security.txt file | Your security contact or disclosure page, and the letter of attestation you share with customers |
| CC4.1 | “ongoing and/or separate evaluations” | That an independent evaluation happened, when, and against what scope | The full report, with dates, scope and methodology |
| CC6.1 | “logical access security software, infrastructure, and architectures over protected information assets” | Admin tools, databases or files reachable without a login | The findings, the fix tickets and the retest |
| CC6.6 | “protect against threats from sources outside its system boundaries” | Open ports, exposed services, subdomains someone else could take over | The attack-surface list and what you closed |
| CC6.7 | “protects it during transmission, movement, or removal” | TLS setup, weak ciphers, cookie flags, missing HSTS | The TLS findings and the config change that fixed them |
| CC6.8 | “unauthorized or malicious software” | Outdated JavaScript libraries with known advisories; subdomains that could serve someone else’s code | Dependency updates and DNS cleanup |
| CC7.1 | “susceptibilities to newly discovered vulnerabilities” | Known vulnerabilities and misconfigurations as of the test date | Your scan schedule, this report and timely fixes |
| CC8.1 | “tests, approves, and implements changes” | A retest showing a fix actually closed the issue | The change ticket linked to the retest result |
Two points of focus make the boundary rows concrete. Under CC6.6: “The types of activities that can occur through a communication channel (for example, FTP site, router port) are restricted.” Under CC6.7: “Encryption technologies or secured communication channels are used to protect transmission of data and other communications beyond connectivity access points.”3 An open database port or a weak TLS setup is a direct finding against each. For CC2.3, one point of focus says “External users are provided with information on how to report systems failures, incidents, concerns, and other complaints to appropriate entity personnel.”3
What a pentest doesn’t cover
DeKock calls penetration testing “an example of a control that can be used to help meet certain requirements in various categories.”1 It helps; it doesn’t carry a criterion on its own. Access reviews, onboarding and offboarding, change approvals and incident response all need their own evidence. And an external test can’t speak for anything behind your login.
Pentrail’s report includes a SOC 2 control map for CC2.3, CC4.1, CC6.1, CC6.6, CC6.7, CC6.8, CC7.1 and CC8.1. It’s an automated external test, so it supports these criteria for your internet-facing systems. It doesn’t make you compliant with any of them, and it won’t replace a manual test if your auditor asks for one.
See your own grade
Scan your domain and see what an attacker sees.
The proposed 2027 criteria
On October 28, 2026 the AICPA published an exposure draft of new criteria. Comments are open through January 15, 2027, and if approved, the new criteria “would be effective for engagements beginning on or after Dec. 31, 2027, with early adoption permitted.”4
The numbers will probably change. A reading of the draft by SOC2Auditors.org says it “cuts the criteria from 61 to 50 and the common criteria from 33 to 20, renumbered CC1 to CC8,” and maps today’s CC7.1 scanning content to a draft CC5.6.5 That’s a third party’s reading of a proposal that can still change. Their advice is sensible: keep the 2017 numbers “and add a column for the proposed ones rather than replace them.”5 Unless your auditor adopts the new criteria early, an engagement that begins before the effective date uses today’s.
CC4.1 lists penetration testing and CC7.1 describes vulnerability scans. Pentest findings also support CC6.1, CC6.6, CC6.7, CC6.8, CC8.1 and CC2.3. Map your evidence to the 2017 numbers until the 2027 draft is final.
Questions
Which SOC 2 controls map to penetration testing?
Do I have to meet every point of focus?
Is CC7.1 or CC7.2 the vulnerability criterion?
Will the 2027 SOC 2 criteria change pentest requirements?
Sources
- Mike DeKock, CPA (MJD Advisors), published by the Cloud Security Alliance, SOC 2 Reports and Penetration Tests:
So, thinking about it like that, completing penetration tests is an example of a control that can be used to help meet certain requirements in various categories. … A SOC 2 report typically includes a control matrix that maps your controls against the applicable trust services criteria to visualize the key controls you identify as necessary to meet your commitments to the relevant criteria. … The AICPA provides points of focus for each criterion meant to represent important characteristics of each, but each organization is unique, and the application of any individual control is not universal.
- AICPA, TSP Section 100 (2017 criteria, March 2020 update), PDF hosted by Arpio, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy:
The entity communicates with external parties regarding matters affecting the functioning of internal control. … The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. … The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives. … The entity implements logical access security measures to protect against threats from sources outside its system boundaries. … The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity’s objectives. … The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives. … To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities. … The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. … The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.
- AICPA 2017 Trust Services Criteria with revised points of focus (2022), as transcribed in the open-source CISO Assistant library, SOC 2 2017 TSC (rev. 2022), points of focus CC2.3, CC4.1, CC6.6, CC6.7 and CC7.1:
External users are provided with information on how to report systems failures, incidents, concerns, and other complaints to appropriate entity personnel. … Management uses a variety of ongoing and separate risk and control evaluations to determine whether internal controls are present and functioning. Depending on the entity’s objectives, such risk and control evaluations may include first- and second-line monitoring and control testing, internal audit assessments, compliance assessments, resilience assessments, vulnerability scans, security assessment, penetration testing, and third-party assessments. … Restricts Access — The types of activities that can occur through a communication channel (for example, FTP site, router port) are restricted. … Uses Encryption Technologies or Secure Communication Channels to Protect Data — Encryption technologies or secured communication channels are used to protect transmission of data and other communications beyond connectivity access points. … Conducts Vulnerability Scans — The entity conducts infrastructure and software vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after significant changes are made to the environment.
- AICPA (press release, October 28, 2026), AICPA Proposes Update of SOC 2® Trust Services Criteria:
The AICPA’s SOC 2 Working Group is seeking public comment on the exposure draft through Jan. 15, 2027. If approved next year, the proposed 2027 SOC 2 Trust Services Criteria would be effective for engagements beginning on or after Dec. 31, 2027, with early adoption permitted.
- SOC2Auditors.org (Peter Korpak), reading of the AICPA exposure draft, Proposed 2027 SOC 2 Trust Services Criteria: What Changes:
The draft cuts the criteria from 61 to 50 and the common criteria from 33 to 20, renumbered CC1 to CC8, and adds AI wording to the points of focus under 17 criteria but no AI-specific criterion. It is a proposal and can change. … CC7.1 Configuration and vulnerabilities CC5.6 (vulnerability scans, detecting unauthorized changes) and CC5.3 (configuration standards). … Until a final version exists, we would keep the 2017 numbers and add a column for the proposed ones rather than replace them.
- AICPA & CIMA (official listing of the 2022 criteria PDF), 2017 Trust Services Criteria (With Revised Points of Focus – 2022):
2017 Trust Services Criteria (With Revised Points of Focus – 2022) Sep 30, 2023 · 554.3 KB Download FREE ACCOUNT ACCESS