Skip to content

Pentest for ISO 27001: not required by name, but strong evidence

ISO/IEC 27001 does not literally require a penetration test. It does require you to manage technical vulnerabilities (Annex A 8.8) and to test security in development and acceptance (Annex A 8.29). A pentest report is one of the clearest ways to show your auditor that you do both, and that you fixed what was found.

See my fixed price

Prefer to talk first? Book a call

To be clear: we don’t certify, and a pentest alone does not get you certified. Only an accredited certification body certifies; we deliver test results it can work with.

What ISO 27001 asks for. And where a pentest helps.

  • Annex A 8.8: Management of technical vulnerabilities

    Obtain information about technical vulnerabilities, evaluate your exposure and take appropriate measures. A pentest finds and rates vulnerabilities in your systems; the retest shows they were fixed.

  • Annex A 8.29: Security testing in development and acceptance

    Define security testing and carry it out in the development life cycle. A pentest before go-live or after a major change is the typical acceptance test.

  • Clause 9.1: Evaluate effectiveness

    The standard requires you to evaluate information security performance and the effectiveness of the ISMS. Dated test results and retest confirmations are measurable input for that.

  • ISO/IEC 27002 as guidance

    The implementation guidance for 8.8 names penetration tests and vulnerability assessments among the ways to identify technical vulnerabilities.

Numbering as in ISO/IEC 27001:2022. In the 2013 edition, 8.8 corresponded to control A.12.6.1.

How a pentest report serves as evidence

Your auditor wants to see that you find, assess and fix vulnerabilities, in a way they can follow. That is how the report is built.

What you get

  • Documented scope, timeframe and methodology
  • Findings with CVSS 3.1 rating, business risk and recommendation
  • Free retest within 60 days, confirmed in writing
  • Attestation letter: one page with scope, timeframe and status after the retest
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price

Which tests fit your ISMS scope.

Test what is inside the scope of your ISMS, starting with the systems that carry the most risk.

ISO 27001 and penetration testing: FAQ

Does ISO 27001 require a penetration test?
Not by name. Annex A 8.8 requires management of technical vulnerabilities, Annex A 8.29 security testing in development and acceptance. In practice, many auditors expect regular technical testing, and a pentest is a common, accepted way to provide it.
Is a vulnerability scan enough for ISO 27001?
It can support Annex A 8.8 for known vulnerabilities. Whether your auditor accepts it on its own depends on your risks and scope; for applications you develop and for critical systems, a pentest is usually expected. The comparison: Pentest or vulnerability scan?.
How often should we test for ISO 27001?
The standard sets no fixed interval. At least once a year and after significant changes is common practice, aligned with your audit cycle.
Do we get an ISO 27001 certificate from you?
No. Only accredited certification bodies certify. You get an audit-ready report, a retest confirmation and a one-page attestation letter.
What does a pentest for ISO 27001 cost?
It depends on the scope. An external network pentest starts at €1,900; all fixed prices are on the Pricing page. The quote form shows your binding fixed price instantly.

Also useful: NIS2 & CompliancePentest or vulnerability scan?TISAX pentestPentest for cyber insurance

What should we test?

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call