Logical access controls
Authentication, authorization, and role boundaries tested against real bypass attempts, not just configuration review.
SOC 2 Compliance
Penetration Testing for SOC 2 Compliance
Manual, developer-ready penetration testing mapped to SOC 2 Trust Services Criteria, built to give your auditor real evidence and your engineering team a report they can act on.
Preparing for a Type I or Type II audit? Tell me your audit window and I will scope testing around it.
- Scope call
- Manual testing
- Evidence mapping
- Auditor ready report
- Retest
SOC 2 Type ISOC 2 Type IITrust Services CriteriaAuditor-Ready Reports
trust_criteria.scan
CC6.1
CC6.6
CC6.7
CC7.1
CC7.2
CC4.1
Confidentiality
Availability
scanning trust services criteria…
Why It Matters
A SOC 2 Report Confirms Controls Exist. A Pentest Confirms They Hold.
SOC 2 doesn’t formally require a penetration test, but most auditors and enterprise security teams expect one as evidence that your access, authentication, and logic controls actually withstand testing, not just that a policy document says they should. Vendor security reviews and enterprise procurement teams increasingly ask for this evidence directly, since a clean audit report on its own does not confirm whether your access controls hold up against a real bypass attempt.
Enterprise Vendor ReviewsAuditor ExpectationsType I ReadinessType II Evidence WindowsControl EffectivenessCustomer Security Questionnaires
Trust Criteria Mapping
Testing Mapped to Trust Services Criteria
Findings are tied directly to the Common Criteria your auditor is evaluating, so your security team can hand over evidence instead of translating a generic pentest report after the fact.
Boundary protection
External-facing APIs and application entry points tested for unauthorized access paths into production systems.
Data transmission & access restriction
Validates that sensitive data in transit and in application responses is restricted to intended users and roles.
Vulnerability detection
Manual identification of exploitable weaknesses across authentication, session handling, and business logic.
Security event monitoring
Confirms whether abuse patterns and access anomalies would be detectable, not just theoretically loggable.
Control monitoring & evaluation
Independent, point-in-time evidence that controls perform as designed, closing the exact gap auditors flag when coverage relies on scanners alone.
Tenant & customer data isolation
Cross-tenant and cross-account access tested directly, relevant to any SaaS platform under the Confidentiality criterion.
Abuse & resource exhaustion paths
Reviews whether business logic can be abused to degrade service or bypass rate and usage controls.
Engagement Flow
Built Around Your Audit Timeline
Whether you’re preparing for a first Type I report or sit inside an active Type II observation window, testing is scheduled and reported to match what your auditor needs to see and when.
01Scope CallConfirm audit type, systems in scope, and target report date.
02Manual TestingAuthentication, access control, tenant isolation, and business logic testing.
03Exploit ValidationConfirm real reachability and impact, not just theoretical exposure.
04Criteria MappingFindings tied to the relevant Trust Services Criteria.
05Auditor-Ready ReportEvidence formatted for direct auditor and questionnaire use.
06RetestConfirm remediation before your evidence window closes.
Deliverables
What You Hand Your Auditor
A report built to be read by two audiences at once: engineers who need to fix findings, and auditors who need evidence the fixes hold.
Trust Criteria mapping
Every validated finding linked to the specific Common Criteria it relates to.
Reproduction steps
Clear, request-level reproduction detail engineering can act on without back-and-forth.
Business impact summary
Plain-language impact framing your auditor and leadership can both read.
Remediation guidance
Practical fix guidance scoped to your stack, not generic best-practice text.
Retest confirmation
Written confirmation that remediated findings are closed, ready to attach as evidence.
NDA & procurement-ready
NDA available on request, with scoped SOW and secure access coordination for vendor review.
FAQ
SOC 2 Penetration Testing FAQ
Answers for teams evaluating a penetration test ahead of a SOC 2 Type I or Type II audit.
Which Trust Services Criteria does this cover?
Testing is scoped primarily around Security (the Common Criteria, including CC4, CC6, and CC7), with Confidentiality and Availability coverage added when your application or SOC 2 scope calls for it.
Can this replace a vulnerability scan for our audit?
No, and it shouldn’t. Auditors generally want both: automated scanning for baseline coverage, and manual penetration testing for exploitability evidence scanners can’t produce on their own.
Will the report work with our auditor or compliance platform?
Yes. The report is written in plain, evidence-oriented language with reproduction steps and Trust Criteria mapping, so it can be attached directly to your audit evidence without reformatting.
Do you sign an NDA before testing?
Yes, an NDA is available before any scoping details or access are shared, and a scoped SOW is provided ahead of testing.
Does SOC 2 require a penetration test?
Not as a named requirement. The Trust Services Criteria do not list penetration testing explicitly. In practice most auditors expect evidence that you identify and remediate vulnerabilities, and an independent penetration test is the clearest way to show it. Many enterprise customers also ask for a recent report directly, which is often the stronger reason to have one.
What is the difference between SOC 2 Type 1 and Type 2 for penetration testing?
Type 1 looks at whether controls are designed appropriately at a point in time. Type 2 looks at whether they operated effectively across a period, usually three to twelve months. For testing, that means a Type 2 audit wants evidence that testing and remediation happen as a practice rather than once, so the date of the report and the evidence of retesting both matter.
When should the penetration test happen relative to the audit?
Before the audit period closes, with enough time left to remediate and retest. A report full of open high severity findings dated the week before an audit raises more questions than it answers. The useful sequence is test, fix, retest, then present the closed findings alongside the original.
What should a SOC 2 ready penetration test report contain?
Scope stating exactly what was tested and what was not, the methodology used, each finding with evidence and a severity rating with reasoning, remediation guidance, and retest results showing what was closed. Auditors and enterprise reviewers both read for scope and for closure, so a report without retest evidence does half the job.
Next Step
Give your auditor evidence, not assumptions
A manual penetration test scoped around your SOC 2 audit window and mapped to Trust Services Criteria.
Trust Criteria MappingAuditor-Ready ReportsRetesting Included