ISO 27001 penetration testing

ISO/IEC 27001 is the international standard for an information security management system (ISMS). ISO describes it as a risk-based approach that organisations adapt to their size and needs: you identify the risks to the information you hold, choose controls to treat them, and keep improving.

Because it is risk-based, the standard does not set a fixed schedule of tests. It does expect you to manage those risks and keep improving, and an audit will ask how you know your controls work. For technical controls such as patching, access control and secure configuration, a penetration test is a common way to produce that evidence.

• Risk assessment: a test shows which technical risks are real, and how serious they are, so your risk register reflects reality.
• Vulnerability management: it checks whether your everyday process for finding and fixing weaknesses is working, which is how the NCSC suggests using a test.
• Evidence for audit: the report, your remediation and the retest form a record an auditor can follow.
• Supplier and customer assurance: a certificate covers your management system, so customers may still ask for a recent independent test of the systems they rely on.

Start from your ISMS scope and risk register, not from a generic list. Test the systems inside the scope that hold or protect the information you care about most: often your external perimeter, key applications and the internal network. Then:

• Record the test, its scope and its findings against the relevant risks.
• Agree fixes and owners in your risk treatment plan, and track them to closure.
• Retest fixed issues, and keep the retest result with the original report.
• Set the testing frequency in your ISMS, with a re-test after significant change.

The NCSC’s penetration testing guidance and its vulnerability management guidance both treat a test as a check on an ongoing process, which is how ISO 27001 expects you to work.

ISO does not certify organisations; independent certification bodies do. In the UK, the UKAS accreditation of a certification body tells you it has been assessed to carry out certification, for the scope UKAS lists. Ask your certification body early what testing evidence it expects to see, so the penetration test report is written in a form it can use.

Keep the testing firm and the certification body separate. The testing firm finds and reports; the auditor judges your ISMS. Our directory can show testing firms that list ISO 27001, which is a useful check on how they protect your findings.