Penetration Testing for Compliance

Penetration testing for compliance, audits and customer reviews

Manual penetration testing for organisations preparing for ISO 27001, PCI DSS or a customer's security review. We tailor the scope and reporting to your assessment requirements, with fixed-price proposals from a CREST member company.
Get a Pentest Quote Book a Scoping Call

Accreditations and memberships

CREST member company, accredited for penetration testing CREST-accredited penetration testing Cyber Essentials certified UK Cyber Security Council member

Choose Your Requirement

Which framework is asking for a penetration test?

Each page covers what the framework expects, how we scope the testing, and what you can hand to your auditor or buyer.

ISO 27001

ISO 27001 doesn't explicitly require penetration testing. Testing can support your technical vulnerability management process under Annex A control 8.8. We scope the test around your ISMS boundary and the assets you need to assess.

Learn more

PCI DSS

Requirement 11.4 asks for internal and external penetration testing of the cardholder data environment at least annually and after significant change, with segmentation testing where segmentation reduces scope.

Learn more

Customer security reviews

Enterprise buyers often request evidence of recent, independent penetration testing during procurement. We scope testing around the product being reviewed and provide a report and supporting documentation you can share with the buyer.

Learn more

Which Test Do You Need

What each requirement means for your penetration test

Your auditor or assessor has the final say on scope, so share their requirements with us during scoping.
    Framework or requestWhat it asks forTesting we usually scope
    ISO 27001Doesn't name penetration testing. Auditors commonly accept it as evidence for technical vulnerability management (Annex A control 8.8).Scope follows your ISMS boundary: external, internal and web application testing of the assets in scope.
    PCI DSSInternal and external penetration testing of the cardholder data environment at least annually and after significant change (Requirement 11.4), with segmentation testing where segmentation reduces scope.Internal, including segmentation checks, and external testing of the cardholder data environment and connected systems.
    Customer security reviewsNo fixed standard. Questionnaires commonly ask for recent, independent testing of the product being bought.Web application and API testing of the product, with an attestation letter you can send to the buyer.
    SOC 2Doesn't mandate penetration testing by name. Auditors commonly ask for it as evidence against the security criteria.Web application and API testing of the in-scope product, plus external testing where the infrastructure is in scope.

    Tell us which framework you're working towards

    Share the framework, your assessor's requirements, and your deadline. We'll reply within one business day to confirm the scope, then send a fixed-price proposal. No obligation at any stage.
    Request a Quote