ISO 27001 pentest: the evidence your auditor wants to see

The standard does not prescribe a penetration test. Without one, however, several Annex A controls are hard to evidence. We deliver the test and the report with the matching mapping.

  • ISO/IEC 27001:2022
  • Mapping to Annex A controls
  • Report for certification and surveillance audits

93 controls in four themes, a test directly evidences six of them

Annex A of the 2022 edition sorts the controls into four themes. The height of each bar shows how many controls fall into that theme. Highlighted are the six for which a penetration test is the direct evidence.

37
Organizational
A.5.15
8
People
no direct evidence from a test
14
Physical
A.7.2
34
Technological
A.8.8A.8.9A.8.20A.8.29

A.x.y can be evidenced by a penetration test

A.5.15

Access control

We test whether permissions, role concepts and privileged accounts actually work in practice.

Active Directory, Physical
A.8.29

Security testing in development and acceptance

The control that a pentest report answers most directly.

All modules
A.7.2

Physical entry controls

For physical assets in the ISMS: access to server rooms and sensitive areas.

Physical
A.8.8

Vulnerability management

Exploitable vulnerabilities identified systematically. The most direct evidence of all.

All modules
A.8.9

Configuration management

Are systems and services configured in a hardened state, or were default settings left in place?

Infrastructure, AD
A.8.20

Network security

Segmentation, firewall rules and exposed services against real attack patterns.

Infrastructure

What we deliver and what we do not

We carry out the penetration test and deliver the report with the mapping to the Annex A controls. Certificates are issued by accredited certification bodies. We are not a certification body, we carry out neither the certification audit nor your internal audit, and we do not advise on building the ISMS. The report is evidence that you present there.

What is expected in the audit

Show me how you systematically identify and remediate vulnerabilities in your environment. A penetration test is the right instrument for this.

Typical statement from an ISO 27001 auditor in a Stage 2 audit

  • Not a mandatory document

    The standard does not require a test. Without one, however, controls A.8.8 and A.8.29 are nearly impossible to evidence.

  • Currency counts

    Most auditors accept reports that are up to 12 months old. After major changes to the infrastructure, a new report is expected regardless of that 12-month limit.

  • Scope follows the ISMS

    What gets tested is what lies within the certification scope. Testing an arbitrary system does not help in the audit.

The three-year cycle and what it means for the report

  1. Year 0Certification audit, Stage 1 and Stage 2
  2. Year 1Surveillance audit, samples from the control catalogue
  3. Year 2Second surveillance audit
  4. Year 3Recertification, in substance a new Stage 2 audit

A certificate is valid for three years. Because most auditors only accept reports up to 12 months old, practically every one of these dates needs its own current test. Schedule it at least six weeks in advance, so there is time left for remediation and a re-test.

What changed with the 2022 edition

ISO 27001:2013

114 controls in 14 domains, A.5 to A.18. Many overlapped in substance, which made mapping and audit preparation unnecessarily complex.

ISO 27001:2022, currently in force

93 controls in four themes, the result of merging overlapping controls, not of dropping requirements. On top of that, 11 new controls, such as threat intelligence (A.5.7) and cloud security (A.5.23).

The transition period set by the IAF ended on 31 October 2025. Certificates under the 2013 edition have not been valid since then. If the mapping in your last report still points to the old control numbers, it should be updated at the next test.

Who gets certified

ISO 27001 applies across all industries and has no statutory applicability threshold. Organisations get certified because they choose to or because their customers require it. More than 50,000 organisations worldwide are certified.

Most common trigger: a major client makes certification a supplier requirement. From then on, the clock is ticking.

Frequently asked questions

How old may the report be at the audit?

There is no universal rule, the auditor and the certification body decide. In practice, most accept reports up to 12 months old. After significant changes to the infrastructure, a new one is expected regardless of age.

What happens if the test reveals serious findings?

That is exactly what it is for. We report critical findings immediately after discovery, so you can act before the audit. Once they are remediated, we re-test on request and document this in the report. A remediated finding with re-test evidence shows the auditor a working improvement cycle.

How does this differ from a standard pentest?

Technically, not at all. The difference lies in preparation and report: we first analyse your ISMS scope, derive the test scope from it and map the findings to the Annex A controls. Without this mapping, the assignment work ends up in the audit.

Audit date set?

A 30-minute initial call, free of charge. We clarify your ISMS scope and which controls need to be covered, followed by a quote without obligation.

Book an initial call Send a request
hello@access-granted.de
+49 9281 5918506
Service: access-granted.de/en/pentest/iso27001

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

Networks & trust seals
Trust Seal of the IT Security Association Germany (TeleTrusT)
Participant in the Alliance for Cyber Security
© AccessGranted X GmbH Last updated: September 18, 2026