SOC 2
SOC 2 is an attestation report issued by a licensed CPA firm under AICPA attestation standards (SSAE 18).
VulnVerify provides the security testing and evidence your auditor asks for; the SOC 2 report, ISO 27001 certificate or PCI DSS assessment itself is issued by your CPA firm, certification body or assessor.
Who issues it and what you end up with
- Issued by
- Attestation report issued by a licensed CPA firm under AICPA attestation standards (SSAE 18). VulnVerify cannot issue it.
- Summary
- Report on a service organization's controls against the Trust Services Criteria: Security (mandatory) plus optionally Availability, Processing Integrity, Confidentiality and Privacy. Type 1 covers control design at a point in time; Type 2 covers operating effectiveness over a review period (commonly 3–12 months). SOC 2 sets no scan or pentest frequency; the Points of Focus name both activities as ways to meet the criteria.
- Version
- AICPA Trust Services Criteria (TSP Section 100, 2017) with revised points of focus (2022)
Where scanning and penetration testing appear
Each control the page maps, with what it asks and whether a scan or a penetration test is required by it, supports it or is not named in it.
| Control | What it asks | Scan | Pentest | Note |
|---|---|---|---|---|
| CC7.1System operations — detection and monitoring of vulnerabilities | The entity uses detection and monitoring procedures to identify (1) changes to configurations that introduce new vulnerabilities and (2) susceptibilities to newly discovered vulnerabilities. Point of focus “Conducts Vulnerability Scans”: scans designed to identify vulnerabilities or misconfigurations are run on a periodic basis and after any significant change in the environment, and identified deficiencies are remediated on a timely basis. | Supports | Supports | After changes |
| CC4.1Monitoring activities — ongoing and separate evaluations | The entity selects, develops and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. Point of focus “Considers Different Types of Ongoing and Separate Evaluations” lists penetration testing among the evaluation types management may use (alongside vulnerability scans, independent certifications such as ISO, internal audit and third-party assessments). | Supports | Supports | No frequency in the criteria; common auditor expectation is at least annual testing plus testing after significant changes. |
| CC7.2Monitoring of system components for anomalies | The entity monitors system components and their operation for anomalies indicative of malicious acts, natural disasters and errors, and evaluates whether they represent security events. | Supports | Not named | Secondary |
| CC7.4Response to identified security incidents | The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate and communicate security incidents, as appropriate. | Supports | Not named | Secondary |
| CC8.1Change management | The entity authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to infrastructure, data, software and procedures to meet its objectives. | Supports | Supports | SecondaryAfter changes |
Minimum frequencies
The minimums the text sets, or that it sets none, and how weekly scanning compares.
- Scans
- SOC 2 sets no scan frequency. VulnVerify scans weekly (every 7 days).
- Penetration tests
- SOC 2 sets no penetration-test frequency (CC4.1); the common auditor expectation is a test every 12 months and after significant changes.
What VulnVerify provides and what you still need
Control by control: the evidence VulnVerify produces, and what still comes from you, your auditor or another provider.
What VulnVerify provides
- CC7.1 Weekly scans (more often than any framework here requires), on-demand scans after a significant change with the change note recorded, findings with status and time-to-fix, fix verification on the next scan, the ledger over time.
- CC4.1 Penetration-test report (scope, methodology, findings with proof of concept), retest report, attestation letter from an independent tester.
- CC7.2 New-exposure alerts (email/Slack) and change history as monitoring inputs.
- CC7.4 The fix-verification record: the later complete scan that could no longer reproduce the finding on the same live host, with its date and the report that carries it.
- CC8.1 Scan-after-change events; pentest or retest after major releases.
What you still need
- CC7.1 Configuration standards, change-detection mechanisms, asset/component inventory (other CC7.1 points of focus); the CPA auditor.
- CC4.1 Management review of results (CC4.2), remediation ownership; the CPA auditor.
Questions about SOC 2
Does SOC 2 require a penetration test?
No criterion mandates it. The CC4.1 point of focus names penetration testing as one of the evaluation types, and CC7.1 names vulnerability scans run periodically and after significant changes. Most auditors expect at least an annual test plus testing after major changes.
Does ISO 27001 require a penetration test?
No clause names it and no frequency is set. Control A.8.8 requires you to obtain information about technical vulnerabilities, evaluate exposure and act; A.8.29 requires security testing in development and acceptance. Independent testing is how most certified organizations evidence both.
Can VulnVerify issue my SOC 2 report or ISO certificate?
No. Those come from a licensed CPA firm and an accredited certification body respectively. VulnVerify supplies the technical testing and evidence they review.
Sources
The texts this page reads from.
- AICPA, TSP Section 100 — 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022)
- AICPA SOC 2 Guide (reporting on an examination of controls at a service organization)
Your first report is free
Verify your domain and the first scan report is free. For a penetration test, contact sales.