Pentesting and compliance: NIS2, ISO 27001, SOC 2
Many audits start with an outside request: a customer asking for a report, a certification auditor, a new regulation. A pentest then serves two goals: reduce real risk, and produce evidence accepted by whoever asked for it.
NIS2
The EU NIS2 directive greatly expands the number of companies subject to cybersecurity obligations, including mid-size and small companies in sectors that were barely covered before. It requires risk management and assessing the effectiveness of security measures. Regular pentesting is one of the most direct ways to demonstrate that assessment.
ISO 27001
The 2022 version of the standard requires managing technical vulnerabilities (control 8.8) and security testing in development and acceptance (control 8.29). Certification auditors want evidence: a dated pentest report with a tracked remediation plan is one.
SOC 2
SOC 2 criteria do not name pentesting explicitly, but most auditors expect to see one, at least yearly, to support control monitoring. It is often the first question from US customers.
Security questionnaires and tenders
An enterprise customer sends you a 200-question questionnaire, including “Date of your last penetration test?”. A recent report, with a shareable summary and proof of remediation (retest), answers that one and supports the rest.
What makes the report useful to an auditor
- Clearly stated scope and dates.
- A recognised methodology (OWASP, PTES) and CVSS scoring.
- A separate summary you can share with a customer without disclosing technical details.
- A retest proving the issues were fixed.
PASSI and insurance
Dungeon Data is not PASSI qualified. This ANSSI qualification is required for the sensitive systems of French critical infrastructure operators and in some public tenders; it is rarely required from SMEs, SaaS vendors or mid-size companies. If your context requires it, I will tell you on our first call.
Frequently asked questions
How often should I run a pentest to stay compliant?
Once a year is the most common practice for ISO 27001 and SOC 2, plus after every major change (new application, migration, redesign). NIS2 requires regular assessment without setting a single frequency.
Do you provide full ISO 27001 consulting?
No, I handle the technical testing. For setting up the management system (policies, risk analysis), a specialised consultant is a better fit, and I can coordinate with them.
Can I share the report with my customer?
Yes, the summary is designed for that. Technical details of vulnerabilities normally stay internal, and you decide what to share.
Planning a security audit?
Estimate your audit online in 2 minutes, or book a call. You leave with a duration and price range, no strings attached.
Get a quote