Sponsor and Partner Audits: Do Pharma Companies Need a Penetration Test?

No public rule makes a sponsor or partner audit require a penetration test from a pharma or life sciences company. The request comes from the sponsor’s, customer’s or partner’s own qualification process. In our experience it is asked for alongside your validation records, as independent evidence that the systems holding trial, laboratory or patient data have been tested by someone outside your team.

Does a sponsor or partner audit require a penetration test?

Not by any law or published standard that we can point you to. A sponsor qualifying a contract research organisation, a pharma company qualifying a software supplier, or a partner reviewing a laboratory is applying its own vendor qualification terms. Those terms are private, so the only reliable source is the audit document you were sent.

Who is being audited changes the question. A biotech with no external users is rarely asked for a test. A CRO that hosts an investigator portal for a sponsor, a software supplier whose product captures trial data, or a laboratory that sends results through an online platform is much more likely to be asked. In our experience the questions follow the data: the more a customer’s trial data passes through your systems, the more detailed the security section becomes.

The request often arrives in a regulated setting where computerised systems are validated before go-live. Validation and penetration testing are different disciplines and one does not replace the other. A validation record shows a system does what it was specified to do. A penetration test shows whether someone could make it do something else. Sponsors increasingly ask to see both.

What does a vendor qualification audit actually ask for?

Vendor qualification questionnaires are private, and there is no public template for life sciences suppliers to quote. In our experience they ask for one or more of four things: the date and scope of your last independent penetration test, a summary of findings and fixes, Cyber Essentials Plus or ISO 27001, and how you separate sponsor, site and participant access.

• A penetration test report or letter. This is the evidence to send when the question says “independent penetration test” or “security test”. It should name the systems tested, the date and the outcome.
• Cyber Essentials Plus. The NCSC describes it as the same protections as Cyber Essentials “but with more rigorous independent technical testing”. It is an assessor-led technical audit, not a penetration test, and neither Cyber Essentials tier requires one. See our page on Cyber Essentials Plus.
• ISO 27001. A management system certificate. It shows you run an information security process, and it does not by itself include a test of a specific system.
• Role separation evidence. Sponsors want to know that a site user cannot see another site’s participants, and that a monitor cannot reach data outside their study.

If the wording is unclear, ask the sponsor’s quality or IT security contact which of these they need. The answer decides what you spend.

Which public rules sit behind the request?

One public rule applies to nearly every pharma and life sciences company, and it does not name a penetration test. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method.

It weighs more here because the data is more sensitive. Article 9 of UK GDPR lists genetic data and data concerning health among the special categories of personal data, and trial, laboratory and pharmacy platforms hold both. The ICO’s data security guide says testing can be done through techniques “such as vulnerability scanning and penetration testing”. That is a list of options, not an instruction. See our page on GDPR penetration testing.

One more rule applies only to some companies. A pharma business that runs an online pharmacy or e-prescribing platform connected to NHS systems, or that otherwise handles NHS patient data, may need to complete the NHS Data Security and Protection Toolkit, which keeps an annual penetration test under its IT protection standard. If you do not handle NHS data, it does not apply. Our DSPT penetration testing cost page covers it.

Who can carry out the test?

Sponsor audits rarely name an accreditation, and where one does, use the one it names. Pharma and life sciences organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the document is silent, a CREST-accredited company is a sensible default.

CHECK is the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and CNI systems and networks. A sponsor or pharma partner is not normally in that position, so a requirement naming CHECK would be unusual. The NCSC’s penetration testing guidance says a well scoped test can give confidence that the products and security controls tested have been configured in accordance with good practice.

Whichever route applies, ask two practical questions. Which legal entity holds the accreditation, and can you see it on the scheme’s own register. And how will the company protect trial data during the test, because the best answer is a non-production environment loaded with synthetic or de-identified data.

What should a pharma or life sciences company test?

Test the systems the sponsor’s audit is really asking about: anything that holds trial, laboratory or patient data, and anything several parties log in to. Start with the system named in the questionnaire. Add others where the data is sensitive or the network is shared.

• Clinical trial and eConsent portals. Participant enrolment, consent capture, and whether randomisation and blinding hold so that treatment allocation cannot leak.
• Investigator and CRO collaboration portals. Separation between sponsor, CRO monitor, lead investigator and site coordinator, and the boundaries around shared data rooms.
• Laboratory information systems and data feeds. Sample chain of custody, and the integrity of results and audit trails between instruments and storage.
• Online pharmacy and e-prescribing. Prescriber, pharmacist and patient role boundaries, and the approval and signature flows.
• Research and genomic data platforms. Dataset access scoping, whether de-identification holds, and export paths out of the platform.
• Cloud environments. Encryption, access scoping and audit logging for trial and laboratory data. See cloud penetration testing.
• Laboratory, manufacturing and corporate networks. The separation between office IT and production or laboratory equipment.

What evidence do you hand back to the sponsor?

Hand back a dated report that states the scope, the method, each finding with a severity score, and what was fixed. No public rule sets a format for life sciences suppliers, so match the evidence to the question. A sponsor’s quality team often wants more traceability than a typical customer: which systems, which version, which date.

In our experience a summary letter naming the scope, the testing company and the outcome answers most questionnaires, with the full report available under a confidentiality agreement. Add the retest confirmation, so the sponsor can see that high and critical findings were closed, and file the scope document with your validation records so the change history of the system and the test sit side by side. This is practice, not a rule.

If a system changes materially after the test, expect the sponsor to ask whether the evidence still applies. A short re-test of the changed component is usually easier to defend than an old report.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for pharma and life sciences companies

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated pharma and life sciences service. We test clinical trial and eConsent portals, investigator and CRO collaboration portals, laboratory information systems and data feeds, online pharmacy and e-prescribing platforms, research data platforms, cloud environments and the networks around them, with participant, investigator, site and sponsor role separation built into each test.

Testing runs against non-production environments with synthetic or de-identified trial and participant data wherever possible, and safe testing windows are agreed around trial, laboratory and manufacturing operations. Testing is safe by default on production, with no denial of service, and out of hours slots are available.

The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Does a sponsor audit require a penetration test?

No public rule says so. Sponsors and partners set their own vendor qualification terms, which are private. In our experience some ask for an independent test report alongside your validation record, and others ask for Cyber Essentials Plus or ISO 27001. Read the wording you were sent and ask which evidence they need.

Does GxP validation replace a penetration test?

No. Validation shows a computerised system does what it was specified to do, and a penetration test checks whether someone could make it do something else. They are different disciplines and one does not replace the other. In our experience sponsors increasingly ask for independent security testing evidence next to the validation record.

Is Cyber Essentials Plus the same as a penetration test?

No. Cyber Essentials Plus is an assessor-led technical audit of your devices and settings. Neither Cyber Essentials tier requires a penetration test. If the sponsor asks for a penetration test report, the certificate alone will not answer the question, and the reverse is also true.

Does the testing company need to be CREST-accredited or a CHECK provider?

Sponsor audits rarely name one. Pharma and life sciences organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Use the accreditation your sponsor, partner or internal standard names, and ask them if it is not stated.

Can a penetration test use real trial data?

It does not need to. Testing is best run against a non-production environment with synthetic or de-identified participant data wherever possible. EJN Labs works this way by default, and agrees safe testing windows around trial, laboratory and manufacturing operations when production systems have to be included.

Get a quote for your pharma or life sciences company

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Pharma and Life Sciences Companies, Best Penetration Testing Companies for UK Pharma and Life Sciences, penetration testing for UK pharma and life sciences, Cyber Essentials Plus, GDPR penetration testing and DSPT penetration testing cost.