Menu
Do I need a pen test for SOC 2?
Short answer
SOC 2 does not explicitly mandate penetration testing in its written criteria, but in practice auditors expect it. Under CC4.1 of the AICPA Trust Services Criteria, organizations must demonstrate that controls are present and functioning through a combination of ongoing monitoring and 'separate evaluations,' and penetration testing is the most widely accepted form of evidence for that requirement. Without a credible, scoped, third-party pen test with documented remediation, auditors will ask for it or note the gap. The test must cover all systems in your audit scope, fall within or close to your audit period, and include remediation evidence for any findings, not just the findings themselves.
One of 8 SOC 2 buyer guides we maintain.
What people get wrong
Many teams assume a vulnerability scan satisfies the pen test expectation; automated scans and manual penetration tests are treated as distinct evidence types by auditors, and a scan alone is typically insufficient for CC4.1.
Pen test vs vulnerability scan
A vulnerability scan is automated, runs against a defined IP range, and produces a list of known CVEs. A penetration test is human-led, scoped to your application or infrastructure, and attempts to chain findings into actual exploitation. Auditors treat them as different evidence types. The scan demonstrates ongoing monitoring; the pen test demonstrates separate evaluation. Most auditors want to see both.
What “scoped” means
The pen test must cover the systems that handle data in your audit scope. If you are getting a SOC 2 for a SaaS product, the test should hit the production application, the supporting cloud infrastructure, and any admin interfaces. A pen test that covered only your marketing site does not satisfy CC4.1 for a product audit.
Remediation matters more than findings
What auditors actually check is whether you remediated the findings. A test with five findings and documented fixes within 30 days reads better than a clean test with no remediation history. Build remediation evidence into your CC4.1 file from day one.
Cost and timing
A scoped third-party pen test typically runs $8,000 to $25,000 for a SaaS product, takes 2 to 4 weeks, and should be timed to land inside or close to your audit period. Annual cadence satisfies most auditors; some industries (financial services, healthcare) push for semi-annual.
Sources
Last verified 2026-05-13. Stale or wrong source? Email hello@soc2auditors.org.