Skip to content
CyberArc
Menu
Book a scoping call

Framework

SOC 2 does not require a penetration test. Your auditor probably still wants one.

This is the most common misunderstanding in SOC 2 preparation, and getting it wrong costs money in both directions: some companies buy a test they did not need yet, and others skip one and get a finding.

SOC 2 is an attestation against the AICPA Trust Services Criteria. The criteria describe outcomes a control must achieve, not procedures you must run. Nowhere do they say "perform a penetration test".

What the Trust Services Criteria actually ask for

The security criteria are written as objectives. They ask whether you identify vulnerabilities in your system, whether you evaluate them, and whether you act on what you find. The common criteria covering risk assessment, monitoring of controls and detection of security events are the ones a tester's report ends up supporting.

Because the criteria are objectives, your auditor decides what evidence satisfies them. That is the entire mechanism behind "SOC 2 requires a pentest": it does not, but a penetration test report is the evidence most auditors recognize fastest for the vulnerability identification objective.

Why a test is usually the cheapest way to satisfy the objective

You can satisfy a vulnerability identification objective with a documented internal programme: scheduled scanning, triage records, remediation tickets with dates, and evidence the loop closes. That is legitimate and some companies run it well.

It is also more work to evidence than one independent report. An external test gives the auditor a dated artifact from a party with no stake in the result, which is why it tends to be the path of least resistance rather than the path of least cost.

Type 1 and Type 2 change the timing, not the requirement

A Type 1 report describes your controls at a point in time. A Type 2 report tests whether they operated effectively across a period, typically several months.

This matters for scheduling. For a Type 2, evidence has to fall inside the observation window, so a test run before the window opened may not count for that period. Ask your auditor where the window starts before booking, not after.

What to ask your auditor before you buy anything

These four questions settle the scope and stop you buying the wrong engagement. They take one email.

  • Which criteria are you expecting the test report to support?
  • Does a vulnerability assessment satisfy them, or do you specifically want exploitation evidence?
  • Which systems have to be in scope, and does that include internal networks or only the product?
  • For a Type 2, when does the observation window open and close?

How CyberArc fits a SOC 2 timeline

The engagement produces a written report with every finding ranked by severity and the remediation steps, which is the form auditors ask for. One retest is included, so findings you fix can be shown as closed rather than open.

Scope is agreed and signed first. If your auditor has told you which criteria the report must support, bring that to the scoping call and the scope gets written to match it.

Questions

Does SOC 2 require a penetration test?
No. SOC 2 is an attestation against the AICPA Trust Services Criteria, which state control objectives rather than required procedures, and no criterion names penetration testing. Auditors commonly request a test because it is the evidence they recognize most readily for vulnerability identification.
Does SOC 2 Type 2 require a penetration test?
Type 2 does not add a penetration testing requirement. It changes the evidence timing: controls must be shown to have operated effectively throughout an observation period, so evidence needs to fall inside that window.
Can a vulnerability assessment satisfy SOC 2 instead?
Often yes, if your auditor accepts it. The criteria ask that vulnerabilities be identified, evaluated and acted on. A documented assessment with triage and remediation records can meet that. Confirm with your auditor before deciding.
How soon before the audit should the test happen?
Early enough that findings can be fixed and retested before the window closes. A report delivered the week of the audit tells the auditor you have open findings and leaves you no time to close them.

Sources

Standards and legislation are quoted from the sources above and change over time. Read the primary source before relying on it. Nothing on this page is legal advice.

Related

Next step

Start with a scoping call.

Tell us what you need tested. Before any testing begins, the scope is written down and the agreement and rules of engagement are signed.

Book a scoping call