--- title: "Pentest for ISO 27001: Evidence for Annex A 8.8 | Mr Cyber" url: https://mr-cyber.com/iso-27001-penetration-testing language: en description: "Does ISO 27001 require a pentest? Not literally. A pentest gives your auditor evidence for Annex A 8.8 and 8.29. Fixed price, retest included." --- # Pentest for ISO 27001: not required by name, but strong evidence ISO/IEC 27001 does not literally require a penetration test. It does require you to manage technical vulnerabilities (Annex A 8.8) and to test security in development and acceptance (Annex A 8.29). A pentest report is one of the clearest ways to show your auditor that you do both, and that you fixed what was found. [See my fixed price](https://mr-cyber.com/quote) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) To be clear: we don’t certify, and a pentest alone does not get you certified. Only an accredited certification body certifies; we deliver test results it can work with. ## What ISO 27001 asks for. And where a pentest helps. - ### Annex A 8.8: Management of technical vulnerabilities Obtain information about technical vulnerabilities, evaluate your exposure and take appropriate measures. A pentest finds and rates vulnerabilities in your systems; the retest shows they were fixed. - ### Annex A 8.29: Security testing in development and acceptance Define security testing and carry it out in the development life cycle. A pentest before go-live or after a major change is the typical acceptance test. - ### Clause 9.1: Evaluate effectiveness The standard requires you to evaluate information security performance and the effectiveness of the ISMS. Dated test results and retest confirmations are measurable input for that. - ### ISO/IEC 27002 as guidance The implementation guidance for 8.8 names penetration tests and vulnerability assessments among the ways to identify technical vulnerabilities. Numbering as in ISO/IEC 27001:2022. In the 2013 edition, 8.8 corresponded to control A.12.6.1. ## How a pentest report serves as evidence Your auditor wants to see that you find, assess and fix vulnerabilities, in a way they can follow. That is how the report is built. ### What you get - Documented scope, timeframe and methodology - Findings with CVSS 3.1 rating, business risk and recommendation - Free retest within 60 days, confirmed in writing - Attestation letter: one page with scope, timeframe and status after the retest - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 [See my fixed price](https://mr-cyber.com/quote?service=unsure&driver=iso27001) ## Which tests fit your ISMS scope. Test what is inside the scope of your ISMS, starting with the systems that carry the most risk. - [External network pentest Fixed price from €1,900.](https://mr-cyber.com/services/external-network-penetration-testing) - [Web application pentest Fixed price from €2,900.](https://mr-cyber.com/services/web-application-penetration-testing) - [API pentest Fixed price from €2,400.](https://mr-cyber.com/services/api-penetration-testing) - [Internal network pentest Fixed price from €3,800.](https://mr-cyber.com/services/internal-network-penetration-testing) - [Active Directory pentest Fixed price from €3,400.](https://mr-cyber.com/services/active-directory-penetration-testing) - [Cloud pentest Fixed price from €3,300.](https://mr-cyber.com/services/cloud-penetration-testing) ## ISO 27001 and penetration testing: FAQ Does ISO 27001 require a penetration test? Not by name. Annex A 8.8 requires management of technical vulnerabilities, Annex A 8.29 security testing in development and acceptance. In practice, many auditors expect regular technical testing, and a pentest is a common, accepted way to provide it. Is a vulnerability scan enough for ISO 27001? It can support Annex A 8.8 for known vulnerabilities. Whether your auditor accepts it on its own depends on your risks and scope; for applications you develop and for critical systems, a pentest is usually expected. The comparison: [Pentest or vulnerability scan?](https://mr-cyber.com/pentest-vs-vulnerability-scan). How often should we test for ISO 27001? The standard sets no fixed interval. At least once a year and after significant changes is common practice, aligned with your audit cycle. Do we get an ISO 27001 certificate from you? No. Only accredited certification bodies certify. You get an audit-ready report, a retest confirmation and a one-page attestation letter. What does a pentest for ISO 27001 cost? It depends on the scope. An external network pentest starts at €1,900; all fixed prices are on the [Pricing](https://mr-cyber.com/pricing) page. The [quote form](https://mr-cyber.com/quote) shows your binding fixed price instantly. Also useful: [NIS2 & Compliance](https://mr-cyber.com/nis2-penetration-testing) [Pentest or vulnerability scan?](https://mr-cyber.com/pentest-vs-vulnerability-scan) [TISAX pentest](https://mr-cyber.com/tisax-penetration-testing) [Pentest for cyber insurance](https://mr-cyber.com/cyber-insurance-penetration-testing)