Certification prep
Generate the technical-testing evidence before your Stage 2 audit.
Compliance
ISO 27001 penetration testing
Penetration testing that produces the evidence an ISO/IEC 27001:2022 audit expects — every finding mapped to the relevant Annex A control, with remediation tracked to sign-off.
Why it matters
ISO 27001 expects you to test
Annex A asks you to find and act on technical weaknesses. A penetration test is how you generate that evidence.
- A.8.8 Management of technical vulnerabilities — identify vulnerabilities and act on them
- A.8.29 Security testing in development and acceptance — test systems before and after release
- A.8.25 Secure development life cycle — verify security is built in, not assumed
- A.5.37 Documented operating procedures — record what was tested, found and fixed
Audit-ready output
Evidence your auditor can use
- Every finding mapped to the relevant ISO/IEC 27001:2022 Annex A control
- A remediation tracking & sign-off matrix: owner, target date and verification status per finding
- Short-term mitigation and long-term fix for each issue, so closure is unambiguous
- A retest that updates each finding’s verification status — the closing evidence for the audit
- CVSS 3.1 severity so risk treatment decisions are defensible
Where it fits
Certification, surveillance and customer assurance
Surveillance & recertification
Demonstrate ongoing vulnerability management at each audit cycle.
Customer assurance
Meet the penetration-testing clause in a client contract or security questionnaire.
One clarification
Aligned, not a certificate
We provide the testing and the audit evidence. ISO/IEC 27001 certification itself is issued by an accredited certification body — our report supports that process, it doesn’t replace it.
Testing for an ISO 27001 audit?
Tell us your timeline and scope, and we’ll propose testing that fits your audit schedule.