SOC 2 penetration testing: a practical checklist

SOC 2 doesn't contain a line that says "get a penetration test". What it contains is criteria around vulnerability management and monitoring (CC7.1, CC4.1), and in practice auditors satisfy those with evidence of a recent, independent pentest. If you're going through SOC 2 for the first time, here's how to get that evidence without a fire drill.

Timing

• Type I: you need a pentest dated within the last 12 months, before the

audit date.

• Type II: you need one covering the observation period. A test from the

start of the window is fine; a test after the window closes is not.

• Book the test 6–8 weeks before the audit so you have time to fix anything

it finds and retest.

What to scope

• The production application(s) in the SOC 2 boundary — the ones handling

customer data.

• Authentication and authorisation, including tenant isolation if you're

multi-tenant. Cross-tenant access is the finding most likely to matter.

• The public API if you have one.
• Cloud configuration if your controls narrative leans on it (IAM, storage

exposure, logging).

You do not need to scope internal corporate IT for SOC 2 unless it's in your system boundary.

What the report must contain

• A clear scope statement and methodology reference (OWASP Testing Guide,

PTES).

• Findings with severity, each with a reproduction and remediation guidance.
• A statement of what was and wasn't tested.
• Dates and the tester's independence (not an employee).
• Ideally a retest section confirming fixes, or a plan for it.

A findings list with no reproductions, or a raw scanner export, will get questioned by a good auditor.

Avoiding a blocking finding

Auditors don't expect zero findings. They expect that highs and criticals are remediated (or have a documented, time-bound plan) by the report date. So:

1. Test early enough to fix.
2. Choose a gig tier that includes a retest — Standard and Premium tiers do.
3. Keep the remediation evidence: the fix commit, the retest result.

A minimal path

For a single web app and API, a fixed-scope Standard tier ($900–$1,500 range) that covers the authenticated surface, tenant isolation, and one retest produces a report most auditors accept, in about a week. Add the pre-audit readiness gig if you want the evidence gaps found before the auditor finds them.

Browse web application and pre-audit readiness gigs, or read how the order flow works.