SOC 2 penetration testing

SOC 2 is part of the AICPA’s SOC suite of services: an independent examination of the controls at a service organisation, reported against the AICPA’s Trust Services Criteria. The criteria cover five areas: security, availability, processing integrity, confidentiality and privacy. Which areas a report covers depends on the service and what its customers rely on.

The AICPA describes the criteria as outcome-based. They set out what controls should achieve, not how, so there is no fixed test list. That is where a penetration test comes in.

• Evidence for security controls: a test shows whether access control, configuration and change processes hold up against a skilled attacker.
• Risk assessment: the findings feed your own assessment of risk to the service.
• Remediation trail: a report, the fixes and a retest give the auditor a clear record.
• Customer questions: customers reading your report may also ask for a recent independent test.

The auditor decides what evidence it needs. Talk to them before you commission the test, so the scope, timing and report format work for the examination.

• Start from the system described in your SOC 2 report: the service, and the infrastructure, software and data behind it.
• Cover the parts customers rely on: usually the application, its API, and the cloud environment it runs in.
• Agree with your auditor when in the examination period the test should take place.
• Ask for a report that states scope, dates, method and findings clearly, with a retest of fixed issues.
• If you also hold ISO 27001, scope one test to cover both where you can.

Keep the testing firm independent of the auditor and of the team that runs the systems. Ask for a sample report, check the firm has tested similar services, and confirm who will do the work and what they are accredited to. The questions to ask and the report checklist help you compare firms on the same terms.