Control evaluations
Ongoing and separate checks that controls work.
home / compliance
compliance · SOC 2
SOC 2 penetration testing: evidence for the audit
The SOC 2 criteria require evaluating controls and identifying vulnerabilities in the system (CC4.1 and CC7.1). A documented test is direct evidence.
what the standard asks
What the criteria ask.
Identification of vulnerabilities
Detection of vulnerabilities and changes that affect the system.
what we produce
The evidence we deliver.
Test report
Scope, dates, method and vulnerabilities with reproduction steps.
Severity and fix
Each vulnerability with a severity assigned by a person and a fix.
Verification of fixes
Repeat of the test on fixed points, if agreed.
Scope letter
The scope and dates, for the auditor.
summary
At a glance.
| Item | Detail |
|---|---|
| Who judges | The independent auditor (CPA firm) that issues the opinion |
| Related services | OWASP Top 10 testing, access and business logic |
| Typical frequency | At least yearly and after significant changes |
Limits. The criteria do not explicitly mention penetration testing, but in practice auditors accept it as evidence.
Want test evidence for your SOC 2 audit?
We reply by hand with a written proposal.