Do you need a pentest for SOC 2? What auditors actually ask.
While the AICPA standard doesn't use the word 'pentest' in CC7.1, 95% of auditors reject evidence without one. Here is how to satisfy the requirement cleanly.
8 min read
One of the most persistent myths in SaaS compliance is that SOC 2 does not mandate a penetration test because the AICPA Trust Services Criteria (CC7.1) only specifies 'vulnerability management and boundary protection'. In practice, modern auditors like Schellman, Coalfire, and A-LIGN almost universally demand third-party penetration testing evidence.
What auditors actually demand
When an auditor opens request item CC7.1.3, they are looking for specific verifiable attributes:
- Independence: The assessment was conducted by a qualified third party, not self-certified.
- Recency: The report falls within the audit observation window (typically 12 months for Type II).
- Defined Scope: The test encompassed production infrastructure, public web apps, and external APIs hosting customer data.
- Remediation Evidence: High and critical vulnerabilities have verified re-test certificates or formal risk acceptance documentation.
How to avoid audit re-test delays
The #1 reason pentests derail compliance timelines is open critical findings at the end of the window. By scheduling assessments 45 days before your audit closes, you leave ample time for engineering fixes and retest verification.
keep reading
Compliance · 8 min