Does SOC 2 require a penetration test?
SOC 2 evaluates controls against applicable Trust Services Criteria. The AICPA Trust Services Criteria provide the framework; they do not define a universal pentest package for every SaaS product. Testing and evidence depend on your risks, system, controls, and examination.
Confirm with your auditor how independent testing fits your controls and evidence expectations. A customer contract may separately require a recent pentest. Keep the audit expectation and procurement requirement visible as two requirements, even if one engagement supports both.
DevBrows provides testing and supporting evidence. Your auditor performs the SOC 2 examination and makes the audit determination. Testing does not guarantee an audit outcome or customer acceptance.
Agree expectations before buying testing
- System boundary: product, environment, services, and customer workflows.
- Timing: dates that matter for the examination and buyer review.
- Coverage: applications, APIs, roles, tenants, and integrations.
- Finding treatment: remediation, exceptions, ownership, and retest records.
- Report access: who needs detailed evidence versus a summary.
Document the agreement in the scoping record. Tell the tester about particular formats or supporting details before the engagement. A report completed without that context may need clarification at the moment your team has the least time to provide it.
Scope the product behind the control
For multi-tenant SaaS, include representative organizations and role boundaries. Ask how testing covers authentication, object-level authorization, tenant isolation, administrative functions, APIs, and important business workflows.
State whether SSO, file handling, webhooks, payment paths, and support access are included. Infrastructure and source review are separate decisions. AI features that retrieve data or invoke tools may need a defined AI testing scope .
Use the SaaS pentest guide to compare proposals. Avoid selecting solely by report length or a claim that a test is SOC 2 certified. Evidence must match your actual system.
Schedule remediation and retesting with the test
Plan backward from the evidence deadline. Allow time for scope agreement, account setup, active testing, engineering fixes, retesting, and final review. Testing that ends on the last day of an evidence window leaves little room to show what happened to the findings.
Ask for the retest window and what happens if remediation takes longer. Define urgent-finding communication, engineering ownership, and how changes to scope affect dates. Testing frequency should follow risk and control commitments, auditor expectations, and material product changes.
Keep a complete evidence trail
Store written scope and authorization, the final report, finding tracker, remediation records, and retest result together. Check consistent product names, assets, and dates. Record accepted risks and unresolved issues with an owner instead of silently dropping them.
| Evidence | Purpose |
|---|---|
| Scope and methodology | What was tested, when, how, and with what limitations. |
| Findings | Affected assets, impact, rationale, evidence, and recommended fixes. |
| Remediation records | Who acted, what changed, and when. |
| Retest and exceptions | What was rechecked, what remains open, and how residual risk is handled. |
For procurement, agree which summary and detailed evidence the customer needs. Keep that sharing decision distinct from your auditor’s evidence collection process.
Budget for a defined engagement
DevBrows SaaS Pentest starts at $9,500 USD , including reporting, a remediation walkthrough, and one scoped retest. Complex engagements start at $20,000+. Scope and scheduling are agreed in a written proposal.
If the requirement is unclear, a $2,500 Security Gate Sprint reviews the request and current evidence, identifies gaps, and defines next steps. It does not provide an audit opinion or substitute for testing.
Compliance consultants and vCISO teams can use Security Partner to coordinate independent testing within a client program. Agree communication, deliverables, and retest expectations with all parties before work starts.