Technical testing of your ISMS scope under ISO 27001:2022. Findings mapped to Annex A controls. Evidence your certification body accepts for A.8.8 technical vulnerability management and A.8.29 security testing in development.
ISO 27001:2022 restructured Annex A from 114 controls to 93. Several directly require or strongly imply periodic penetration testing of the ISMS scope.
The primary driver. Requires timely identification, evaluation, and treatment of technical vulnerabilities in information systems. Certification bodies expect evidence of active technical assessment — not just a policy that says vulnerabilities should be managed.
Security testing must be defined and implemented for new information systems and significant changes. For most ISMS scopes that include a product or platform, penetration testing before significant releases satisfies this control directly.
Networks must be segmented according to information classification. The pentest validates that segmentation controls actually work — not just that network diagrams show the right topology. Relevant for any ISMS scope that includes on-premise or hybrid infrastructure.
Access to information and systems must be restricted in accordance with the access control policy. Testing authentication, authorization, and privilege escalation paths produces direct evidence for this control. Auditors ask for it at surveillance audits.
ISO 27001 pentest scope follows your ISMS scope statement, not a generic asset inventory. This matters to the certification body.
Organizations certified under ISO 27001:2013 must transition to the 2022 standard. The October 2025 deadline has passed for many — here is what changed for technical testing.
A.12.6.1 (management of technical vulnerabilities) became A.8.8. A.14.2.8 (system security testing) became A.8.29. The substance is similar but the numbering in your SoA and pentest reports must now reference 2022 controls for transition audits.
ISO 27001:2022 added 11 new controls. A.8.25 (secure development lifecycle), A.8.28 (secure coding), and A.8.29 (security testing in development) are new and directly relevant to how a pentest fits your ISMS. If your SoA doesn't address these, your next audit will flag it.
New control A.5.7 (threat intelligence) requires information about threats to be collected and analyzed. Our engagement notes include threat context relevant to the vulnerabilities we find — which feeds your A.5.7 evidence directly.
New control A.5.23 (information security for cloud services) covers cloud-specific risks. If your ISMS scope includes cloud infrastructure, the pentest must include cloud configuration and IAM testing to address this control. We include it by default for cloud-hosted systems.
What certification candidates ask before the engagement. See compliance gap analysis if you need a full ISMS readiness review.
Not by that name. But Annex A.8.8 requires active technical vulnerability management and A.8.29 requires security testing for new and changed systems. Certification body auditors consistently expect penetration test evidence to verify these controls are operating. Organisations that present only scanner output typically receive an observation or minor nonconformity.
Annual is the industry norm and what most certification bodies look for at surveillance audits. More frequently after significant changes: new product features, new cloud infrastructure, new third-party integrations, or following a security incident.
The findings format doesn't need to change, but the control mapping in the report should reference 2022 Annex A numbers (A.8.8, A.8.29) not the 2013 numbers (A.12.6.1, A.14.2.8). If you have an existing report using 2013 references, we can produce a mapping addendum or reformat the control citations at low cost.
Yes, and for initial certifications it is efficient to do both. The compliance gap analysis maps all 93 Annex A controls against your current state and produces a prioritized remediation roadmap. The pentest covers the technical controls with active testing. Both deliverables go to the certification body.
The retest report provides the closure evidence. We format it to support a corrective action plan: finding description, root cause, remediation steps, verification test result. Certification bodies accept this format for major and minor nonconformity closure. We time the retest to your audit corrective action deadline.
Scoping call covers your ISMS scope, SoA, certification body, and audit timeline. 30 minutes. Free. No NDA required for the first call.