SOC 2 Penetration Testing Requirements Explained

Does SOC 2 require a penetration test? A clear explanation of how pentesting maps to the SOC 2 Trust Services Criteria, what auditors expect, and how to prepare.

2026-06-11

One of the most common questions from companies pursuing SOC 2 is simple: do I actually need a penetration test? The honest answer is nuanced — and understanding it will save you both money and audit headaches.

Does SOC 2 technically require a penetration test?

Not explicitly. The AICPA's SOC 2 framework is built on the Trust Services Criteria (TSC), and no single criterion says the words "you must perform a penetration test." SOC 2 is intentionally risk-based rather than prescriptive.

But in practice, it's expected. Penetration testing is one of the clearest ways to satisfy several criteria, and most auditors look for one — especially for a Type II report. The relevant criteria include:

CC4.1 — Monitoring activities: the organization evaluates the effectiveness of its controls. A pentest is direct evidence of that evaluation.
CC7.1 — Detecting vulnerabilities: the organization uses detection measures to identify vulnerabilities. Pentesting (alongside vulnerability scanning) demonstrates this.
CC7.2 / CC7.4 — Responding to issues: identifying and remediating findings shows a working response process.

In short: SOC 2 doesn't mandate a pentest by name, but a penetration test is the most efficient way to produce evidence that your vulnerability-management and monitoring controls actually work. Going without one invites auditor questions and customer skepticism.

What auditors actually want to see

When a SOC 2 auditor reviews your penetration testing evidence, they're typically looking for:

An independent test performed by a qualified third party (not just your own team running a scan).
Defined scope that covers your production environment and the systems relevant to the services you provide.
A clear methodology mapped to a recognized standard (OWASP, NIST SP 800-115, PTES).
Findings rated by severity, with business impact described.
Evidence of remediation — that you fixed the issues and, ideally, retested to confirm.

A raw vulnerability scan rarely satisfies all five. Auditors increasingly distinguish between automated scanning and genuine penetration testing.

How often do you need it for SOC 2?

The widely accepted cadence is at least annually, and after any significant change to your systems. Many companies pair an annual penetration test with continuous or quarterly vulnerability scanning to show ongoing diligence across the audit period (which, for a Type II, can span 3–12 months).

How to prepare for your SOC 2 pentest

Scope to your production environment — the systems that deliver your service and store customer data.
Choose a provider that delivers an attestation letter and a report structured for auditors.
Leave time to remediate. Schedule the test early enough to fix findings and retest before your audit window closes.
Keep the evidence. Retain the report, remediation notes, and retest results for your auditor.

Get a SOC 2-ready pentest without the wait

Traditional pentests can take weeks to schedule and deliver — risky when your audit clock is ticking. Affordable Pentesting delivers AI-driven, human-validated testing with compliance-ready reports mapped to OWASP, NIST SP 800-115, and PTES, plus attestation — typically within 48 hours.

See pricing or start your SOC 2 pentest.

This article is general guidance, not legal or audit advice. Confirm specific requirements with your auditor.