Security testing (8.29)
Evidence that applications and systems undergo security assessment before or during the development and acceptance cycle.
Penetration testing and ISO 27001 certification
An ISO 27001 audit reviews documents. A penetration test proves the technical controls actually work.
How penetration testing supports the ISO 27001 certification cycle and surveillance audits, serving as technical evidence for the Annex A security testing controls.
Annex A — technical controls Evidence for the auditor Certification and surveillance cycle
When this matters
A well-documented ISMS does not, on its own, prove the controls survive a real attack.
An ISO 27001 certification audit mainly assesses policy, governance, risk management and the operation of the Information Security Management System (ISMS) — it is not itself a technical test. When the Statement of Applicability (SoA) includes controls such as security testing in development (8.29) or technical vulnerability management (8.8) in the 2022 version of Annex A, the auditor expects evidence that those controls operate in practice. A penetration test provides exactly that kind of technical proof, complementing — not replacing — the documentary audit.
01
Preparing for initial certification
02
Surveillance audits and recertification
03
Annex A controls related to technical testing
04
Requirements from customers who audit the ISMS
Controls supported
Where penetration testing connects to ISO 27001 Annex A.
The exact mapping depends on the version adopted (2013 or 2022) and how each control was described in the Statement of Applicability.
Technical vulnerability management (8.8)
A record of identifying, prioritizing and handling technical vulnerabilities found in the assessed environment.
Documentary audit vs technical assessment
The certification auditor checks that the control is described and operating; the penetration test produces the technical data behind that check.
Traceability for the certification cycle
Scope, methodology, execution date and finding treatment recorded so they can be consulted in future audits.
Inside the delivery
See how this work takes shape.
From technical alignment to delivery, the work has to leave context, evidence and next steps visible to everyone involved.
01 / 04
Process
A penetration testing project with records that fit the audit cycle.
We align the calendar and documentation to the certification and surveillance rhythm of your ISMS.
Identify the SoA controls
We work out which Statement of Applicability controls depend on evidence of technical testing.
Run the assessment
We apply the penetration testing methodology to the scope that underpins the identified controls.
Record for audit
We document scope, methodology and outcome in a format the certification auditor can review directly.
Update between cycles
We indicate when the test should be repeated to keep pace with surveillance audits or significant environment changes.
Deliverables
Evidence that serves both the ISMS and the security operation.
The report supports whoever answers the auditor and whoever fixes the identified risk.
Evidence for Annex A
Technical documentation ready to present during certification and surveillance audits.
Technical vulnerabilities handled
Findings feed the vulnerability management process required by control 8.8.
Confidence in the declared ISMS
Assurance that the controls described in the Statement of Applicability match the technical reality of the environment.
Frequently asked questions
Straight answers to help you plan the assessment.
If your question isn't here, talk to the team directly.
Ask on WhatsAppIs penetration testing mandatory for ISO 27001 certification?+
The standard does not literally require a 'penetration test' by name, but when a company declares security testing or technical vulnerability management controls in the Statement of Applicability, the auditor expects evidence that those controls are executed in practice.
Which Annex A control does penetration testing satisfy?+
In the 2022 version the most directly related controls are 8.29 (security testing in development and acceptance) and 8.8 (technical vulnerability management). In the 2013 version, the equivalents appear as A.14.2.8 and A.12.6.1.
Does the certification auditor run the penetration test?+
No. The auditor reviews documentation, processes and evidence presented by the company. The technical test is a separate service, contracted before or during the audit cycle.
How often do I need to repeat the test to keep certification?+
The standard sets no single frequency; the cadence usually follows the annual surveillance audits and any significant change to the environment that underpins the declared controls.
Next step
Need technical evidence for your ISO 27001 cycle?
Tell us which Annex A version you adopted, the controls tied to technical testing and the date of your next audit.