I work for a small firm beginning to explore having a SOC 2 (Security, Availability, Confidentiality) audit performed. The auditor we're working with believes we will need to have penetration testing performed annually to satisfy some of the trust services criteria.
We're concerned about the cost of having these tests performed annually (in addition to the audit costs). Is a penetration test typically required annually to satisfy a SOC 2? Is it possible to do pen testing in house?