Request sample reportGet a quote
Get a quote Request sample report

Free tool

SOC 2 Pentest Readiness Checklist

Twenty quick yes/no questions. You'll get a readiness score and a prioritised list of what to sort out before your SOC 2 penetration test.

Runs entirely in your browser. Nothing you enter is sent to us.

Scope and timing

  1. Do you know which systems sit inside your SOC 2 system boundary?

  2. Have you decided which of those systems the pentest will cover?

  3. Do you know your audit type (Type I or Type II) and the dates of your audit or observation period?

  4. Is there time to test, fix findings and retest before the evidence is due?

  5. Have you checked whether customer contracts require specific testing?

Environment and access

  1. Is there a production-like environment the testers can use?

  2. Can you create test accounts for every user role?

  3. If your product is multi-tenant, can you provide accounts in at least two tenants?

  4. Do you have API documentation or a Postman/OpenAPI collection for in-scope APIs?

  5. If internal or cloud systems are in scope, can you provide VPN, jump-host or read-only cloud access?

Process and people

  1. Is a named technical contact available during the testing window?

  2. Have you agreed who is told immediately if a critical issue is found?

  3. Have you told the teams who need to know (IT, security monitoring, hosting providers) about the test window?

  4. Do you have a process to track findings through to fixes, with owners and dates?

  5. Has engineering time been set aside to fix findings after the report?

Evidence and history

  1. If you’ve had a pentest before, were its findings resolved or formally accepted?

  2. Do you run regular vulnerability scanning between pentests?

  3. Does your vulnerability management policy set fix timelines by severity?

  4. Do you know what your auditor expects to see (full report, summary, attestation letter, retest results)?

  5. Have you identified who will sign the written authorisation to test?

Your readiness

0/100

Answer the questions to see your score

0 of 20 answered

How to use the result

Reading your score

85 and above: you're ready to book a test. Share the gaps list with your provider so they can plan around anything outstanding.

60 to 84: nearly there. Close the high-priority gaps before kickoff, especially test accounts, scope and timing. Missing access is the most common reason test days are lost.

Below 60: start with scope and timing. Agree your system boundary and audit dates first, then work through the list.

The score weights each question by how much it affects a smooth, audit-ready test. It's a planning aid, not an audit opinion. Your auditor decides what evidence they need.

Background

Does SOC 2 require a penetration test?

Not by name. A SOC 2 report covers your controls against the AICPA's Trust Services Criteria, and the criteria don't mandate a specific test. But the points of focus for criterion CC4.1 list penetration testing as one way to evaluate whether controls work, and criterion CC7.1 covers identifying vulnerabilities. In practice, many auditors, and the customers who read your report, expect to see a recent independent pentest. Our SOC 2 penetration testing page explains how the report maps to the criteria.

What the checklist covers

The 20 questions fall into four groups, each covering things that often delay a SOC 2 pentest or weaken it as evidence:

  • Scope and timing: your system boundary, the test scope and your audit dates.
  • Environment and access: a production-like environment and test accounts for every role.
  • Process and people: contacts during testing, who hears about critical issues, and engineering time to fix findings.
  • Evidence and history: past findings, scanning and fix timelines, what your auditor expects to see, and who signs the authorisation to test.

Timing the test

For a Type I report, test before the report date so the results, and any fixes, are ready. For a Type II report, test within the observation period and leave time to fix findings and retest before it ends. Auditors look for evidence that issues were found and handled through your normal process.

FAQ

SOC 2 Readiness Checklist questions

Does the score tell us whether we'll pass the audit?

No. It measures how ready you are for the penetration test, not the audit. Your auditor decides what evidence they need.

Will findings in the pentest hurt our SOC 2 report?

Findings are normal. What auditors look for is that you identified them, fixed them or formally accepted the risk through your usual process, and can show a retest.

How recent does the pentest need to be?

It depends on your auditor and your report type. A common expectation is a test within the observation period for Type II, or within the past 12 months. Confirm with your auditor before booking.

Are our answers sent anywhere?

No. The checklist runs in your browser. Nothing you select is stored or sent.

Related

Compliance3 min read

What "retest included" should actually mean

Many pentest proposals promise a free retest. Here is what a useful retest covers, when to ask for it, and what evidence you should get back afterwards.

SOC 2 Penetration Testing

Penetration testing that gives your SOC 2 auditor clear, dated evidence that your security controls work in practice.