Our report is explicitly designed for ISO 27001 audits, with mapping to the relevant Annex A controls your auditor will examine.
Every finding is mapped to the relevant ISO 27001 controls, such as A.8.8, A.8.9, and A.5.15. No interpretation work for your auditor.
Whether initial certification, recertification, or an event-driven test after changes, we adapt the scope to your certification status.
We know certification deadlines do not wait. On request we prioritise your project and deliver the report on time.
Our ISO 27001 pentest report is structured so that it provides your auditor with all necessary evidence, without follow-up questions.
Annex A of ISO 27001:2022 contains 93 controls across four categories. A penetration test is the most direct evidence instrument for these six:
| Control | Name | How our pentest helps | Module |
|---|---|---|---|
| A.8.8 | Vulnerability management | We systematically identify exploitable vulnerabilities. This is the most direct evidence for A.8.8. | All modules |
| A.8.9 | Configuration management | We test whether systems, services and network components are configured in a hardened state and whether default configurations were left behind. | Infra, AD |
| A.5.15 | Access control | We test whether access controls actually work in practice, instead of just existing on paper. | AD, Physical |
| A.8.20 | Network security | Segmentation, firewall rules, exposed services: we test the network against real attack patterns. | Infrastructure |
| A.7.2 | Physical access controls | For organisations with physical ISMS assets, we test whether access to critical areas is genuinely controlled. | Physical |
| A.8.29 | Security testing in development and acceptance | This is the control your auditor most directly ticks off with a penetration test report. | All modules |
The current edition of the standard restructured Annex A fundamentally. This matters for your pentest scope and its control mapping: the old 2013 control numbers no longer exist.
The 2013 edition organised Annex A into 14 classic domains such as cryptography, physical security, or supplier relationships. Many controls overlapped in substance, which made mapping and audit preparation unnecessarily complex.
114 controls · 14 domains
Organizational (37 controls), People (8), Physical (14), and Technological (34), achieved by merging overlapping controls, not by dropping requirements. On top of that, 11 new controls were added, including threat intelligence (A.5.7) and cloud security (A.5.23), which earlier editions did not cover.
93 controls · 4 themes · drawn to the same scale as the row above
ISO 27001 does not explicitly require a penetration test, but every experienced auditor will expect one as evidence for several Annex A controls, whether it's an initial certification, a recertification after three years, or an annual surveillance audit. Going into an audit without a current pentest report is a problem.
Show me how you systematically identify and remediate vulnerabilities in your environment. A penetration test is the appropriate instrument for this.
Annex A of ISO 27001:2022 contains 93 controls across four themes (Organizational, People, Physical, Technological), down from 114 controls across 14 domains in the 2013 predecessor. Several of these controls are difficult to evidence without a penetration test, particularly around vulnerability management, access controls, and network security. A missing or outdated pentest report is one of the most common reasons for findings and non-conformities in the audit, both at certification and during annual surveillance audits.
ISO 27001 does not require a pentest, but controls A.8.8 and A.8.29 are nearly impossible to evidence without one.
A three-year-old pentest report will not convince any auditor. Most accept a maximum of 12 months.
The pentest must cover the ISMS scope, instead of testing any system and hoping it is sufficient.
Unlike NIS2 or KRITIS, ISO 27001 applies across all industries: the standard carries no statutory applicability threshold. Certification is pursued by those who choose it to build trust with customers and partners, or by those who must, because customers, clients, or tenders require it as a precondition. More than 50,000 organisations worldwide currently hold ISO 27001 certification, and the number keeps growing.
Most common trigger: a major client sets ISO 27001 certification as a supplier requirement. After that, the clock is ticking.
Aligned with your certification status, your audit date, and the relevant Annex A controls.
We analyse your ISMS scope and clarify which systems, processes, and locations fall within the certification boundary, so the pentest covers exactly what your auditor examines.
Based on your ISMS, we define the pentest scope and map it to the relevant Annex A controls. No extra work for you at the audit.
Manual penetration tests on agreed systems and areas. We document every step completely, which auditors value for traceability.
Every finding is assessed by severity and ISMS relevance. Critical findings are communicated immediately, so you can act before the audit.
Complete report with Annex A mapping, management summary, and technical appendix. Structured so your auditor finds all answers without follow-up questions.
The right scope depends on your ISMS. These three modules cover the most common Annex A requirements.