What does SOC 2 actually require?

The AICPA Trust Services Criteria provide the basis for evaluating controls. They do not prescribe one identical testing program for every organization. Penetration testing can support control evaluation and vulnerability management, but a test report alone does not establish that the overall controls meet the criteria.

Ask your auditor which controls the test is intended to support, which systems should be covered, and when evidence must be available. Record the answers in the scope. Avoid buying an assessment solely because it carries a SOC 2 label.

Match the pentest to the system boundary

Start with the product and supporting systems described in the review. Identify web applications, APIs, tenant types, privileged roles, integrations, cloud components, and relevant environments. Record dependencies owned by third parties and confirm who can authorize testing.

A public website test may leave the signed-in product unexamined. A single user role may leave customer administration unexamined. Explain these gaps before agreeing the proposal. Our SOC 2 penetration testing service uses the agreed boundary to define coverage and exclusions.

Prepare findings and remediation evidence

  • Retain the written scope, authorization, test dates, methodology, and coverage limits.
  • Keep an executive summary alongside findings that explain impact, evidence, severity, and recommended fixes.
  • Assign remediation owners and record decisions about unresolved findings.
  • Arrange the agreed re-test and preserve the result for each finding, including items not re-tested.

A reviewer should be able to distinguish a proposed fix from a fix that was checked. The pentest report guide explains the information that makes that distinction useful.

Plan testing around Type 1 and Type 2 timing

Confirm your review date or observation period with the auditor. Leave room for access preparation, testing, report review, engineering work, and follow-up. The testing window and the report delivery date are separate milestones.

For a fast-changing product, scheduled ongoing penetration testing may help keep findings current. A limited change-focused cycle does not automatically cover a full audit boundary. Agree what evidence will be needed at each review.

A short SOC 2 pentest planning checklist

  • Which systems and controls are in scope?
  • What access and controlled test accounts will be ready?
  • What dates must the evidence cover?
  • Who receives urgent findings and owns remediation?
  • Which re-test checks, report format, and control mapping are included?

Put these answers in a private scope draft, then compare proposals using the cost and scope guide.

All penetration testing guides | See a sample report | Discuss your scope