Does ISO 27001 require a penetration test?
No, not by name. ISO/IEC 27001:2022 never uses the words "penetration test". Annex A controls A.8.8 (management of technical vulnerabilities) and A.8.29 (security testing in development and acceptance) are the two an auditor will ask you to evidence, and a current pentest report is the accepted proof. Test at least annually and after significant change.
| ISO 27001:2022 control | 2013 equivalent | What a pentest evidences |
|---|---|---|
| A.8.8 Management of technical vulnerabilities | A.12.6.1 | Exploitable weaknesses found, rated and remediated |
| A.8.29 Security testing in development and acceptance | A.14.2.8, A.14.2.9 | Application and API tested before and after release |
| A.8.20 Network security | A.13.1.1 | Segmentation and exposed services verified |
| A.5.36 Compliance with policies and standards | A.18.2.3 | Independent technical review of controls |
ISO 27001 Penetration Testing Requirements
ISO 27001 is the international standard for information security management systems (ISMS). Organizations pursuing certification must demonstrate that their security controls are effective, and penetration testing is the primary method auditors rely on to verify this.
This guide breaks down which Annex A controls require penetration testing, what the certification process expects, and how Budget Security delivers pentest engagements built for auditor scrutiny.
What ISO 27001 Requires for Security Testing
ISO 27001 takes a risk-based approach to information security. The standard itself defines the ISMS framework, while Annex A provides a catalogue of 93 controls (in the 2022 revision) grouped across four themes. Several of these controls directly or indirectly require penetration testing:
A.8.8 (2013: A.12.6) - Vulnerability Management
Requires timely identification of technical vulnerabilities and appropriate measures to address the associated risk
A.8.29 (2013: A.14.2.8) - Security Testing
Mandates that security testing is performed during development and after changes to verify control effectiveness
A.5.36 (2013: A.18.2) - Compliance Reviews
Requires independent review of information security, including technical compliance checks against policies and standards
Risk Assessment (Clause 6.1)
The ISMS risk assessment process must identify threats, and pentesting provides concrete evidence of exploitable weaknesses
Certification auditors at Stage 2 will look for evidence that these controls are implemented and effective. A recent penetration test report is one of the strongest pieces of evidence you can present.
Controls That Require Pentesting
While a full ISO 27001 implementation covers all applicable Annex A controls, three areas create a direct need for penetration testing:
A.8.8 (2013: A.12.6.1) - Management of Technical Vulnerabilities
This control requires that information about technical vulnerabilities is obtained in a timely fashion, exposure is evaluated, and appropriate measures are taken. Penetration testing goes beyond automated scanning by validating whether vulnerabilities are genuinely exploitable in your specific environment.
A.8.29 (2013: A.14.2.8) - Security Testing in Development and Acceptance
This control explicitly calls for security testing of systems. It applies during development, after changes, and on a periodic basis. A penetration test fulfils this requirement by simulating real attacker techniques against your applications, networks, and APIs.
A.5.36 (2013: A.18.2.3) - Compliance With Policies and Standards
Information systems must be regularly reviewed for compliance with security policies and technical standards. Penetration testing serves as an independent technical review that identifies gaps between your documented policies and the actual security posture of your systems.
ISO 27001 Certification Process and Pentesting
ISO 27001 certification involves two audit stages conducted by an accredited certification body. Understanding where penetration testing fits in the process helps you time your engagements correctly:
Stage 1 - Documentation Review
The auditor reviews your ISMS documentation, risk assessment, and Statement of Applicability. Having a pentest scheduled or recently completed shows your commitment to control A.14.2.8.
Stage 2 - Implementation Audit
The auditor verifies that controls are implemented and effective. A pentest report from the past 12 months provides direct evidence for vulnerability management and security testing controls.
Surveillance Audits (Annual)
After certification, annual surveillance audits check that your ISMS remains effective. Regular pentesting demonstrates ongoing compliance and continuous improvement.
Recertification (Every 3 Years)
The full audit cycle repeats. A track record of annual penetration tests with documented remediation strongly supports recertification.
We recommend completing your penetration test no more than three months before your Stage 2 audit. This ensures findings are current while allowing time for remediation.
How Budget Security Helps You Get Certified
Budget Security delivers penetration testing built specifically for organizations pursuing or maintaining ISO 27001 certification. Our platform lets you define scope and launch engagements on your timeline, at $985 per tester-day for US clients (€849 per day in the EU).
Scope your test in minutes
Use our online scoping tool to define which applications, networks, and APIs need testing. Intelligent scoping ensures your engagement covers the systems referenced in your Statement of Applicability.
Testing by qualified security engineers
Our testers hold recognized offensive security certifications (OSCP, OSWE) and follow OWASP, PTES, and NIST SP 800-115 methodologies aligned with ISO 27001 expectations.
Audit-grade reporting
Every report maps findings to relevant Annex A controls, includes CVSS v3.1 scores, exploitation evidence, and clear remediation steps. Auditors can directly trace findings to your risk treatment plan.
Remediation tracking and retesting
Monitor fix progress through our vulnerability dashboard. After remediation, we retest to confirm issues are resolved, giving your auditor documented proof of control effectiveness.
Get Your ISO 27001 Pentest Quote
See exactly what your ISO 27001 penetration test would cost. Reports include direct mappings to Annex A controls so your auditor can trace findings to your risk treatment plan.
Looking for the bigger picture? Explore all our penetration testing services covering web, network, API, mobile, and cloud.
FAQ