Does SOC 2 Type 2 require a penetration test?

Type 2 adds no penetration testing requirement. It changes evidence timing: controls must be shown to have operated effectively across an observation period, so the evidence has to fall inside that period.

How often do you need a penetration test for SOC 2?

SOC 2 sets no frequency. In practice companies test annually to align with the audit cycle, and whatever cadence you choose needs to be documented as part of your own programme and actually followed.

Answer

Does SOC 2 require a penetration test?

No. No criterion in SOC 2 names penetration testing as a required procedure.

And yet almost every company going through SOC 2 is asked for one. Both of those statements are true, and the gap between them is where the money gets wasted.

Why the answer is no

SOC 2 is an attestation against the AICPA Trust Services Criteria. The criteria are written as objectives a control must achieve. They ask whether vulnerabilities in your system are identified, evaluated and acted upon. They do not prescribe how.

Because the criteria state objectives, your auditor decides what evidence satisfies them. That is the mechanism. There is no rule to look up; there is an auditor to ask.

Why your auditor asks anyway

An independent, dated report from a third party with no stake in the outcome is the fastest evidence an auditor can accept for vulnerability identification. The alternative is reading your internal programme's records.

That alternative is legitimate. It is also more work to evidence: scan schedules, triage decisions, remediation tickets with dates, proof the loop closed. If you run that programme well, say so and show it. If you do not, the test is cheaper than building it before the window closes.

Ask these before you buy

One email to your auditor prevents the two expensive mistakes: buying the wrong engagement, and buying it at the wrong time.

Which criteria do you expect this report to support?
Will a vulnerability assessment satisfy them, or do you want exploitation evidence?
What has to be in scope: the product only, or internal systems too?
When does the Type 2 observation window open and close?

Timing is the part people get wrong

For a Type 2, evidence has to sit inside the observation period. A test performed before the window opened may not count toward it.

And a report delivered the week of the audit documents open findings with no time left to close them. Test early enough that the retest also lands inside the window.

Questions

Does SOC 2 require a penetration test?: No. The Trust Services Criteria state control objectives rather than required procedures and no criterion names penetration testing. Auditors commonly request one because it is the most readily accepted evidence for the vulnerability identification objective.
Does SOC 2 Type 2 require a penetration test?: Type 2 adds no penetration testing requirement. It changes evidence timing: controls must be shown to have operated effectively across an observation period, so the evidence has to fall inside that period.
How often do you need a penetration test for SOC 2?: SOC 2 sets no frequency. In practice companies test annually to align with the audit cycle, and whatever cadence you choose needs to be documented as part of your own programme and actually followed.

Sources

AICPA SOC 2 and the Trust Services Criteria

Standards and legislation are quoted from the sources above and change over time. Read the primary source before relying on it. Nothing on this page is legal advice.

Next step

Start with a scoping call.

Tell us what you need tested. Before any testing begins, the scope is written down and the agreement and rules of engagement are signed.

Book a scoping call