SOC 2 Compliance: Do I need a pentest or vulnerability scanning?
Short answer
SOC 2 does not name one required test. Control CC4.1 calls for ongoing evaluation that your security controls work, and a pentest is one of the clearest ways to show that. Vulnerability scans find known weaknesses across your environment on an ongoing basis; a pentest shows whether those weaknesses can actually be exploited. Most auditors and customers expect a pentest as evidence that controls work, and many teams use both.
Penetration test vs vulnerability scan for SOC 2
Both support the vulnerability management evidence auditors look for. They answer different questions.
Vulnerability scan | Penetration test | |
|---|---|---|
What it finds | Known vulnerabilities and misconfigurations across your systems, identified with automated tooling. | Weaknesses that can be exploited, including chained issues, with demonstrated impact. |
Who performs it | An automated scanner, run by your team or a vendor. | A security professional who attempts to exploit the weaknesses. |
Frequency | Continuous or on a regular schedule. | At least annually. |
What auditors accept as evidence [VERIFY: confirm with approved SOC 2 language] | Scan reports across the audit period, with remediation records for findings. | A penetration test report with findings, remediation, and retest results. |
Typical deliverable | A report listing findings by severity. | A written report with findings, evidence of exploitation, and remediation guidance. |
Learn how we run SOC 2 penetration testing, or review a sample SOC 2 pentest report.
If you’re a CTO, CISO, Director of IT, or any of these related titles, you may also have to be a developer, a security engineer, a project manager, a lawyer, a risk manager, and a compliance expert.
While compliance (SOC 2 compliance especially) is one of the most common reasons people first come to Red Sentry for cybersecurity, the framework can be confusing and we get a lot of questions around what is needed.
In my opinion, cyber security assessments will be like seatbelts before long. Seatbelts were invented in the 1800s, but very few people wore them until the government started requiring them (fun fact: New Hampshire is the only state in the US that does not require seat belts currently). While cyber security is growing rampantly, vulnerability assessments and security audits are still underused in many industries. Many people know they should do more, but because of budget, manpower, or other reasons, it gets put to the backburner… UNLESS their stakeholders require it.
Although many organizations understand the importance of protecting themselves against hackers, they may not have a deep understanding of cybersecurity challenges and may not be familiar with the concept of a penetration test (pentest) or the workings of a vulnerability scan. However, they do recognize the value in implementing an information security management system.
Because of this gap in cybersecurity knowledge and the interconnectedness of business today, I believe that the government will impose minimum requirements for the majority of companies that touch the internet at some point. Whether that minimum requirement is an annual pentest, quarterly vulnerability scans, or just more defensive measures like increased firewalls, who knows.
But for now, there are common frameworks that regulate specific spaces, and they have unique, sometimes confusing, requirements. As a disclaimer, I am not a compliance auditor by any means, but I have been involved with the topic on behalf of our clients for years.
So let’s take a look into SOC 2 specifically, as this is one of the most common frameworks companies abide by.
Who gets SOC 2 compliance?
The most common organizations that undergo SOC 2 audits are SaaS companies and those that store client info in the cloud. One of the main purposes of a SOC 2 report is to show stakeholders and clients that a company has appropriate internal controls over data security and privacy.
SOC 2 Type I deals with policies and procedures that were in place at a specific point in time, whereas SOC 2 Type II looks at a time period of at least 6 months. Most companies seeking SOC 2 compliance are striving for the SOC 2 Type II Report.
What does SOC 2 require for cybersecurity?
A common misconception is that SOC 2 requires penetration testing. SOC 2 requires appropriate policies and procedures based on your specific environment and how data is stored there. Technically, the words “penetration test” are not in the requirements. However, it has become a standard practice to satisfy the audit and that’s the reason why many people think it is a pen testing compliance.
Here are the specific SOC 2 controls that penetration testing and vulnerability management may have an influence on, with CC4.1 and CC7.1 being the main two:
CC4.1 - The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
CC4.2 - The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
CC7.1 - To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
CC7.2 - The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity’s ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
AICPA’s TSC
The American Institute of CPAs (AICPA) developed SOC with regards to its Trust Services Criteria (TSC). These criteria are what the SOC 2 audit will actually look for. When it comes to cybersecurity, the AICPA has designated penetration testing as one of the options for satisfying the criteria. They also reference vulnerability scans satisfying other criteria, even though they do not specifically mandate what is required.
Basically, there is flexibility in the verbiage of the framework to allow for the uniqueness of companies, but the auditor will be looking to make sure these criteria are met, and penetration tests and vulnerability scans will play an important role.
So do you need a pentest and vulnerability scans?
Long story short, yes. While not specifically defined, penetration tests (at least annually) and a continuous vulnerability management platform are the easiest and best ways to satisfy these cybersecurity areas. Auditors will be looking for these things as they analyze your company.
What types of tests do you need? That again depends on your environment. If you have a web application, you will most likely need a web application penetration test. If you have both internal and external assets, you will probably need pentests for both of those areas. If you store your data in AWS, you may need a cloud pentest.
Red Sentry’s SOC 2 Package
If you’ve been through a SOC 2 audit, it can be excruciating, long, and expensive. And the last thing you need is to deal with months of pentesting and 5 different cybersecurity vendors on top of everything else. Red Sentry has created a unique offering to get you closer to your SOC 2 Report.
Red Sentry’s SOC 2 Package includes a penetration test (for whatever appropriate environments you need tested) as well as 12 months of our continuous monitoring platform for vulnerability management. This package will satisfy the cybersecurity requirements you need, at a fraction of the cost of others.
Contact us today to get your SOC 2 Cyber Security Package!
Discover more cybersecurity gems: Penetration testing vs Vulnerability Scanning: What’s the Difference and Which is Better?
Frequently asked questions
Does SOC 2 require penetration testing?
SOC 2 does not name penetration testing as a required control. Auditors expect evidence that you identify and address vulnerabilities, mapped to criteria such as CC4.1 and CC7.1. A penetration test is a common way to provide that evidence.
How often should I pentest for SOC 2?
SOC 2 does not set a frequency. A common baseline is at least once a year. Run vulnerability scans continuously between penetration tests.
Is a vulnerability scan enough for SOC 2 Type 1?
A Type 1 report covers your controls at a point in time. Vulnerability scans can show that a vulnerability management process exists, but they do not show whether weaknesses can be exploited. Confirm with your auditor whether a penetration test is expected.
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan uses automated tools to find known weaknesses across your systems on an ongoing basis. A penetration test is performed by a security professional who attempts to exploit weaknesses to show real impact.