ISO/IEC 27001:2022
ISO 27001 is a certification issued by an accredited certification body after a certification audit.
VulnVerify provides the security testing and evidence your auditor asks for; the SOC 2 report, ISO 27001 certificate or PCI DSS assessment itself is issued by your CPA firm, certification body or assessor.
Who issues it and what you end up with
- Issued by
- Certificate issued by an accredited certification body after a certification audit. ISO itself does not perform certification or issue certificates. VulnVerify cannot issue it.
- Summary
- Requirements for an information security management system (clauses 4–10) plus Annex A reference controls. No clause or Annex A control names penetration testing, and no testing frequency is set: the organization must decide method and cadence from its risk assessment and be able to justify them to the certification auditor.
- Version
- ISO/IEC 27001:2022 (third edition) with Annex A (93 controls); implementation guidance in ISO/IEC 27002:2022
Where scanning and penetration testing appear
Each control the page maps, with what it asks and whether a scan or a penetration test is required by it, supports it or is not named in it.
| Control | What it asks | Scan | Pentest | Note |
|---|---|---|---|---|
| A.8.8Management of technical vulnerabilities | Information about technical vulnerabilities of information systems in use shall be obtained, the organization's exposure to such vulnerabilities evaluated, and appropriate measures taken. (2013 edition: A.12.6.1.) | Supports | Supports | Primary control for scanning |
| A.8.29Security testing in development and acceptance | Security testing processes shall be defined and implemented in the development life cycle, including acceptance testing before release. (Replaces 2013 A.14.2.8 and A.14.2.9.) | Supports | Supports | Primary control for penetration testing |
| A.8.25Secure development life cycle | Rules for the secure development of software and systems shall be established and applied. | Not named | Supports | Secondary |
| A.8.9Configuration management | Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed. | Supports | Not named | Secondary |
| A.8.32Change management | Changes to information processing facilities and information systems shall be subject to change management procedures. | Supports | Supports | SecondaryAfter changes |
| A.5.35Independent review of information security | The organization's approach to managing information security and its implementation shall be reviewed independently at planned intervals or when significant changes occur. | Not named | Supports | Secondary |
| A.5.36Compliance with policies, rules and standards for information security | Compliance with the organization's information security policy, topic-specific policies, rules and standards shall be regularly reviewed. | Supports | Supports | Secondary |
| Clause 9.1 / 9.2Monitoring, measurement, analysis and evaluation; internal audit | The organization shall evaluate the information security performance and the effectiveness of the ISMS, and conduct internal audits at planned intervals. | Supports | Supports | Secondary |
Minimum frequencies
The minimums the text sets, or that it sets none, and how weekly scanning compares.
- Scans
- ISO 27001 sets no scan frequency. VulnVerify scans weekly (every 7 days).
- Penetration tests
- ISO 27001 sets no penetration-test frequency (A.8.29 and A.5.35); the common auditor expectation is a test every 12 months and after significant changes.
What VulnVerify provides and what you still need
Control by control: the evidence VulnVerify produces, and what still comes from you, your auditor or another provider.
What VulnVerify provides
- A.8.8 Weekly scanning and the findings it raises (identification), severity/exploitability context (exposure evaluation), remediation tracking and retest (measures taken); penetration test to validate exploitability.
- A.8.29 Pre-release or release penetration test, retest report, scan of new assets after deployment.
- A.8.25 Pentest findings feeding secure-development rules.
- A.8.9 Misconfiguration findings from scans.
- A.8.32 Scan-after-change events; retest after changes.
- A.5.35 Independent third-party penetration test as part of the review.
- A.5.36 Dated scan and pentest records as technical compliance checks.
- Clause 9.1 / 9.2 Trend reports, cadence-achieved metrics, exportable evidence for internal audit.
What you still need
- A.8.8 Vulnerability-management policy and roles, patching process, risk-acceptance records.
- A.8.29 Defined SDLC security gates and acceptance criteria.
Questions about ISO 27001
Does ISO 27001 require a penetration test?
No clause names it and no frequency is set. Control A.8.8 requires you to obtain information about technical vulnerabilities, evaluate exposure and act; A.8.29 requires security testing in development and acceptance. Independent testing is how most certified organizations evidence both.
Does SOC 2 require a penetration test?
No criterion mandates it. The CC4.1 point of focus names penetration testing as one of the evaluation types, and CC7.1 names vulnerability scans run periodically and after significant changes. Most auditors expect at least an annual test plus testing after major changes.
Can VulnVerify issue my SOC 2 report or ISO certificate?
No. Those come from a licensed CPA firm and an accredited certification body respectively. VulnVerify supplies the technical testing and evidence they review.
Sources
The texts this page reads from.
- ISO/IEC 27001:2022, Annex A (controls 5.35, 5.36, 8.8, 8.9, 8.25, 8.29, 8.32) and clauses 9.1–9.2
- ISO/IEC 27002:2022 (guidance for each control)
- ISO — “Certification” page: ISO does not perform certification; use an accredited certification body
Your first report is free
Verify your domain and the first scan report is free. For a penetration test, contact sales.