Checklist
SOC 2 Penetration Test Preparation Checklist
SOC 2 does not mandate a penetration test, but most auditors expect one as evidence for monitoring and risk assessment controls. These are the items that decide whether your report is accepted without follow-up questions.
Timing
- Run the test inside the audit observation period, not before it starts.
- Leave time to fix and retest high and critical findings before the period ends.
- Plan for an annual cadence, plus a test after any significant change to the system.
Scope that matches the system description
- Test every component in your SOC 2 system description: production apps, APIs, cloud accounts and the infrastructure that hosts customer data.
- Include the authentication layer and administrative interfaces.
- Document anything excluded and why, so the auditor sees it was a decision.
What the report must show
- Tester independence: an outside firm, or a team separate from the engineers who built the system.
- Dates of testing, methodology and the standard followed (for example OWASP, PTES, NIST SP 800-115).
- Each finding rated by severity, with evidence and a recommended fix.
- An executive summary a non-technical reader can follow.
Remediation evidence
- Tickets linking each finding to its fix.
- A retest showing high and critical findings are resolved.
- A signed attestation or remediation letter from the testing firm.
- A risk-acceptance record for any finding you chose not to fix.
Customer trust
- Prepare a short summary letter you can share with customers under NDA instead of the full report.
- Map findings and fixes to the relevant Trust Services Criteria (CC4.1, CC7.1) for the auditor.
Want us to check it with you?
Bring this list to a 20-minute scoping call and we will tell you what's missing.
Book a Scoping Call
Ready to Schedule the Test?
We will scope it, quote it at a fixed price, and work around your audit deadline.
Book a Scoping Call See a Sample Report