ISO 27001 Penetration Testing

ISO/IEC 27001 is the international standard defining requirements for an information security management system (ISMS). The current edition is ISO/IEC 27001:2022, published in October 2022; a climate-related amendment (Amd 1:2024) was added in 2024.

It applies to any organization establishing an ISMS, regardless of sector or size. Certification is granted through audits by accredited certification bodies.

The standard requires controls to be selected based on risk assessment and justified in the Statement of Applicability (SoA). Penetration testing is therefore not a mandate but risk-based evidence that the selected controls work.

• Annex A 8.8 Management of technical vulnerabilities: timely information about vulnerabilities, evaluation of exposure and appropriate measures.
• Annex A 8.29 Security testing in development and acceptance: security testing of new systems and changes before go-live.
• Annex A 5.35 Independent review of information security: independent assessment of controls.
• Clause 9 Performance evaluation: monitoring, measurement and internal audit of control effectiveness.

We set test scope from your risk assessment and SoA and map findings to the relevant Annex A controls. Certification audits are performed by accredited certification bodies; we focus on technical evidence.

• External, internal, web and mobile application penetration testing.
• Source code analysis for organizations that develop software (Annex A 8.29 and 8.28).
• Our Vulnerability Management service for continuous tracking.
• A control-mapped report, retesting after remediation and a closure record.