Penetration testing and report submission should be done by a certified CEH or CISSP

Question

Is it essential that a Penetration testing and report submission should be done by a certified CEH or CISSP? Or any knowledgeable person who has expertise on security & tools can perform? If any person can do, the same can be accepted as per the compliance requirement of any standard such as ISO 27001, PCI-DSS etc.

Answer 1

There are so many different certifications, that global regulations cannot require one specific one.

Also, certifications vary widely in what they cover. CISSP does not prepare someone for penetration testing. CEH can be seen as too 'light'. The organisation that offers the CEH has a separate certification for penetration testers (LPT).

In the UK, there is CREST for pentesters, which is required for UK companies in some regulatory situations.

At the moment, for standards such as ISO 27001 and PCI-DSS, one just has to prove that the tester was 'qualified' to perform the test.

But never just do something because a regulation said so. They are not supposed to be "check the box" exercises where you do the bare minimum. They are a guide to help you do what's best for the business. The goal is to implement the best form of the regulatory requirement in a way that meets the business goals.

Answer 2

If any person can do, the same can be accepted as per the compliance requirement of any standard such as ISO 27001, PCI-DSS etc.

Speaking specifically to PCI, the DSS states (for example):

11.3.1.b Verify that the test was performed by a qualified internal
resource or qualified external third party and, if applicable,
organizational independence of the tester exists (not required to 
be a QSA or ASV).

"qualified" in this case means "as determined by the QSA performing the audit." I have performed penetration tests as a member of a company under PCI-DSS, and the auditors asked to see my resume, which included years of security experience, the CISSP, and a number of (non-Pentest) GIAC certs. It was easily sufficient for them.

As with anything else under PCI-DSS, your mileage may vary based on your QSA. And, going back to the wider question of other standards such as ISO 27001, the same is true... requirements for pen tester credentials are not generally codified in the standards, but rather left to the judgement of the auditor.