Does SOC 2 or ISO 27001 Require a SaaS Penetration Test? What Enterprise Buyers Ask For

No. Neither SOC 2 nor ISO 27001 mandates a penetration test. SaaS companies still get asked for one, because an enterprise customer’s security review or vendor questionnaire usually asks for a recent independent report, and SOC 2 auditors commonly expect one for a Type II report. No public rule sits behind the questionnaire, so the customer’s own wording sets what you need to hand over.

Does SOC 2 or ISO 27001 require a penetration test?

No. SOC 2 is built on the AICPA’s 2017 Trust Services Criteria, and no criterion in them mandates a penetration test. Criterion CC4.1 names penetration testing as one example of an evaluation method, and CC7.1 covers vulnerability scanning. Auditors commonly expect a recent third-party test for a Type II report, but that is audit practice, not a criterion.

ISO 27001 does not require a penetration test either. The phrase never appears in the standard. Annex A 8.8 requires you to identify and evaluate technical vulnerabilities once you declare that control applicable. The guidance standard ISO 27002 lists periodic, documented penetration tests under that control, carried out by your own staff or an authorised third party. That is guidance, not a mandate, and your Statement of Applicability records your reasoning either way.

So why do SaaS companies buy a test? Because the framework is not the asker. The asker is the enterprise customer’s security team, which cites SOC 2 or ISO 27001 as evidence of maturity and then asks for the test itself as a separate item. For the wider picture, read our general guide to penetration testing for SaaS, and see our pages on SOC 2 penetration testing and ISO 27001 and penetration testing.

What does an enterprise security review actually ask for?

There is no public rule that an enterprise customer applies to its software suppliers, so the ask is private and varies by buyer. In our experience, a security questionnaire or procurement review asks whether you run penetration tests, how often, who carried out the last one, and whether the serious findings were fixed. Some buyers ask to see the report or a summary.

Two public texts sit underneath the private ask, and both are worth knowing because buyers lean on them. UK GDPR Article 28(3)(h) requires a contract between a controller and its processor to oblige the processor to allow for and contribute to audits, including inspections, conducted by the controller or an auditor the controller mandates. If your customers’ data sits in your platform, that contract clause is why a customer feels entitled to ask.

The second is UK GDPR Article 32(1)(d), which requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method. The ICO’s guide to data security says you can undertake that testing through techniques such as vulnerability scanning and penetration testing.

Questionnaires differ from one another, but a SaaS company usually sees the same few items:

• The date of the last independent test, and whether it covered the production application rather than a marketing site.
• Whether tenant isolation was tested: can one customer’s user reach another customer’s data?
• Whether the API, single sign-on and role handling were in scope.
• Whether high and critical findings have been fixed and retested.
• Which accreditation the testing company holds.

Treat these as practice, not law. Answer the questions in front of you, and keep the exact wording of each one, because it decides the scope of the test you buy.

Who can carry out the test for a SaaS company?

Neither SOC 2 nor ISO 27001 names an accreditation. SaaS organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Start with the customer questionnaire or contract clause that triggered the request and use the accreditation it names.

CHECK is the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and critical national infrastructure systems and networks. It matters to a SaaS company mainly when a public sector customer’s requirement names it. Where a questionnaire asks for a CREST-accredited penetration test, a CREST-accredited company such as EJN Labs meets it.

Whichever route applies, ask which legal entity holds the accreditation and whether you can see it on the scheme’s own register. Ask also whether the testers who will work on your platform are certified individually.

What should a SaaS company test?

Test the boundaries between customers first. In a multi-tenant product, the failure that worries an enterprise buyer most is one tenant seeing another’s data. Then test the interfaces that carry tenant data, and the identity layer that decides who gets in. Our multi-tenant SaaS testing page explains the method.

• Web applications. Multi-tenant logic, tenant isolation, delegated administrators, organisation invites, data export paths and insecure direct object references across tenant boundaries.
• APIs. REST and GraphQL: broken object-level authorisation, mass assignment, rate limiting and tenant-data scoping. See API penetration testing.
• Single sign-on and provisioning. SAML and OIDC login, just-in-time and SCIM provisioning, account linking, custom domains and API keys.
• Cloud configuration. AWS, Azure or GCP identity and access, storage, key management and secrets, including segregation for multi-tenant deployments.
• Source code. Hard-coded secrets, unsafe deserialisation, cryptographic misuse and supply-chain dependencies, where a customer asks about code review.
• Engineering and admin users. Phishing against the people who hold production access.

What evidence do you hand back to the customer’s security team?

Hand back a dated report that states the scope, the method, each finding with a severity score and what was fixed. No public rule sets the format for a SaaS vendor. In our experience, a security team wants the date, the scope, the testing company and the status of high and critical findings.

Most SaaS companies answer many customers with one test, so keep two documents. The full report stays under a confidentiality agreement, and a short summary letter naming the scope, the date and the retest result goes into questionnaires and procurement packs. For your own audit, the scope document and the retest evidence sit in the evidence pack your SOC 2 auditor or ISO 27001 certification body reviews, and the report’s findings can be mapped to the controls you have chosen.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for SaaS companies

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated SaaS and cloud service. We test the systems an enterprise reviewer asks about: multi-tenant web applications, customer portals, admin consoles, APIs, single sign-on and provisioning, and the cloud accounts behind them.

The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. Testing is safe by default on production, with no denial of service, and out of hours slots are available.

Frequently Asked Questions

Does SOC 2 require a penetration test?

No. The AICPA Trust Services Criteria do not mandate a penetration test. Criterion CC4.1 names it as one example of an evaluation method. Auditors commonly expect a recent third-party test for a Type II report, but that is audit practice, so ask your auditor what evidence they will accept.

Does ISO 27001 require a penetration test?

No. ISO 27001 does not require a penetration test. Annex A 8.8 requires you to identify and evaluate technical vulnerabilities once you declare that control applicable. The guidance standard ISO 27002 lists periodic penetration tests under that control, as guidance only.

Can one penetration test report answer every customer questionnaire?

Often, but no public rule says so. Different customers ask different questions, so check the wording of each one. In our experience a dated summary letter naming the scope and retest result answers most requests, with the full report shared under a confidentiality agreement for customers who ask for it.

How often should a SaaS company run a penetration test?

No rule for SaaS companies sets a frequency. A common pattern is one full test a year, plus a targeted retest after a major release that changes authentication, tenancy or data export. Check what your auditor and your largest customers ask for, and plan around the strictest.

Does the testing company need to be CREST-accredited or a CHECK provider?

Neither SOC 2 nor ISO 27001 names an accreditation. SaaS organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Use the accreditation named in the customer questionnaire or contract that triggered the request.

Get a quote for your platform

Tell us which systems are in scope and which customer or auditor asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK SaaS Companies, Best Penetration Testing Companies for UK SaaS Companies, penetration testing for SaaS companies, penetration testing for SaaS: what modern businesses need to know, multi-tenant SaaS penetration testing and SOC 2 penetration testing.