I work for a small firm beginning to explore having a SOC 2 (Security, Availability, Confidentiality) audit performed. The auditor we're working with believes we will need to have penetration testing performed annually to satisfy some of the trust services criteria.

We're concerned about the cost of having these tests performed annually (in addition to the audit costs). Is a penetration test typically required annually to satisfy a SOC 2? Is it possible to do pen testing in house?

  • FWIW: Individual penetration testers and smaller penetration testing firms have to work with really hectic schedules. You may be able to negotiate a sizable discount with them if you can give them a really long time-frame to conduct the test. This helps them balance their workload a bit and it can save you a lot of money. Oct 6, 2016 at 17:53

1 Answer 1


Having gone through this myself, the answer is truly up to the audit agency performing the audit. It is an easy-to-understand third party assurance function that is quite typical in this kind of audit.

You might be able to negotiate with the auditor to not require it this time around, but you will need to be able to compensate for the loss of assurance in some other way.

In the Management Response, the Business can explain why the penetration test was not performed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .