Compliance and Standards

ISO 27001 Penetration Testing: Evidence for Your Certification

An ISO 27001 penetration test provides evidence for Annex A control A.8.29; the report follows within 5 business days.

What is tested and why it matters

Validating the controls defined in the Statement of Applicability.

Organisations pursuing or maintaining ISO 27001 certification must demonstrate that their information security controls are effective, not merely documented. Annex A control A.8.29 (Security testing in development and acceptance) and the broader risk treatment framework require independent validation of technical controls. Without penetration testing, the gap between documented controls and actual security posture remains unknown. Certification bodies expect evidence that controls have been tested under realistic conditions. An assessment that is not scoped to the ISMS boundary or does not map findings to Annex A controls creates additional work during the certification audit rather than supporting it.

Standards ISO/IEC 27001:2022, Annex A controls, OWASP ASVS

Attack surface ISMS-scoped systems, access controls, cryptographic controls, network security

Approach Risk-based testing aligned with the organisation's risk treatment plan

Who needs this assessment

Organisations that benefit most.

This assessment is designed for organisations that must demonstrate the effectiveness of their ISMS security controls to certification bodies, clients, or partners.

Organisations preparing for initial ISO 27001 certification

Organisations undergoing surveillance or recertification audits

Organisations using ISO 27001 as their ISMS framework without formal certification

Companies required by clients or partners to demonstrate ISO 27001 compliance

Any organisation seeking to validate that its security controls work as intended

Government agencies and healthcare organisations required to demonstrate ISO 27001 compliance for public sector contracts

Where compliance-focused assessments apply

Financial services: PCI-DSS validation for cardholder data environments and payment processing systems.
Government and public administration: DigiD assessments and alignment with BIO and NIS2 requirements.
Healthcare: demonstrating security controls for patient data systems under NIS2 and ISO 27001.
Critical infrastructure: energy, transport, and water supply organisations subject to NIS2 Article 21.

What the assessment produces

The insight and evidence delivered at the conclusion of the assessment.

Every assessment concludes with a structured report covering technical findings, severity ratings, evidence, and remediation guidance mapped to Annex A controls. Reports are delivered through the Pentrox Portal and are available for download at any time.

Independent evidence that ISMS security controls are effective under realistic conditions
Findings mapped to ISO 27001 Annex A controls for direct use during certification audits
Identified control weaknesses before the certification body discovers them
Risk-based remediation guidance aligned with the organisation's risk treatment plan
Portal access with real-time findings, retest workflow, and report downloads for the lifetime of the client account

How an assessment runs

Scope and Intake
Planning
Assessment
Reporting
Findings & Retest

Retesting of remediated findings is included as standard with every assessment.

Assessment methodology

Five phases from ISMS alignment through verified remediation.

Each phase builds on the previous one. Scope alignment with the Statement of Applicability ensures testing covers the certification boundary, and risk-based prioritisation focuses effort on the highest-exposure controls.

ISMS scope alignment

The testing scope is aligned with the ISMS certification boundary and Statement of Applicability. In-scope systems, applications, and network zones are mapped.

ISO/IEC 27001:2022 Clause 6.1 (risk assessment), Annex A

Risk-based testing prioritisation

Testing priorities are informed by the risk register and treatment plan. High-risk assets receive deeper assessment, aligning with ISO 27001 proportionality.

ISO/IEC 27001:2022 Clause 6.1.2, Clause 8.2 (risk treatment)

Control effectiveness validation

Annex A controls are tested using Nessus and Burp Suite and manual hands-on testing. Access control, cryptographic, and network controls are validated.

ISO/IEC 27001:2022 Annex A, OWASP WSTG, PTES

Annex A finding mapping

Each vulnerability is mapped to the relevant Annex A control. The mapping documents which controls were tested and which failed under testing conditions.

ISO/IEC 27001:2022 Annex A, A.8.29 (security testing)

Certification-ready reporting

Findings are documented with a CVSS score and Annex A mapping. Critical findings are communicated immediately. Reports support certification body review.

ISO/IEC 27001:2022 Clause 9.2 (internal audit), A.8.29

Scope and deliverables

What is included, what is excluded, and what is delivered.

The statement of work defines the exact systems, applications, and ISMS boundary before the assessment begins. The lists below reflect the standard scope for an ISO 27001 penetration test.

In scope

Systems and applications within the ISMS certification boundary
Network infrastructure and segmentation controls within the ISMS scope
Access control and authentication mechanisms (Annex A.5.15 to A.5.18)
Cryptographic controls and key management (Annex A.8.24)
Web applications and APIs within the ISMS boundary
Logging, monitoring, and incident detection controls (Annex A.8.15 to A.8.16)
Secure development and configuration controls (Annex A.8.25 to A.8.29)

Out of scope

Systems outside the ISMS certification boundary
ISMS documentation and policy review (non-technical controls)
Third-party hosted systems unless explicitly included in the ISMS scope
Certification decisions (Pentrox provides testing evidence, not the certification verdict)

What you receive

Executive summary Security posture overview, severity distribution, and remediation priorities written for leadership and certification body review.
Detailed findings Each vulnerability documented with evidence, reproduction steps, CVSS severity rating, and Annex A control mapping.
Control effectiveness matrix Documenting which Annex A controls were tested, which operated as expected, and which failed under testing conditions.
Remediation plan Aligned with the organisation's risk treatment priorities for efficient resolution.
Portal access Real-time findings, report downloads, retest workflow, and team management through a dedicated platform.
Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
Retest report Verification results after remediation, documenting each finding with its updated status.

Pentrox Portal report library showing the four report types available for download

See what a Pentrox report looks like before you decide

NIS2 and penetration testing

What the zorgplicht requires and which Article 21 measures a penetration test evidences.

Does a penetration test guarantee security?

What a test proves, where it stops, and how to use the result with an auditor.

NIS2 penetration testing

Evidence for the duty of care under the Cyberbeveiligingswet; an ISO 27001 certificate does not exempt an organisation from that obligation.

When independent assessment is the right step

An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.

Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.

Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.

Request a scoping call

Timeline

Illustrative durations to support planning. Confirmed in the statement of work.

The duration of an ISO 27001 penetration test depends on the size of the ISMS scope, the number of systems within the certification boundary, and the complexity of the network architecture. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.

Small scope 4 to 6 testing days Single application within the ISMS boundary with limited network infrastructure

Core scope 6 to 10 testing days Two or more applications with network infrastructure and access control validation across the ISMS boundary

Complex scope 10+ testing days Large ISMS with distributed systems, cryptographic controls, and extensive Annex A coverage

Report delivery 5 business days Initial report and management report are delivered shortly after testing is completed.

Retest Included as standard Retesting within 90 days after report delivery is included at no additional cost.

What determines duration

Number of systems and applications within the ISMS certification boundary
Complexity of the network architecture and segmentation controls
Number of Annex A controls selected for validation
Whether source code or architecture documentation is available
Whether testing is performed in a production or non-production environment

Actual duration is confirmed during scoping and depends on ISMS boundary size and control complexity. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.

Why Pentrox

The operational standards behind every ISO 27001 assessment.

These operational standards apply to every ISO 27001 assessment Pentrox delivers, regardless of ISMS scope or certification stage.

ISMS scope-aligned testing

Testing matches the certification boundary.

The testing scope is mapped to the Statement of Applicability. Testing covers the same systems and controls the certification body evaluates.

Annex A control mapping

Findings linked to specific controls.

Every finding references the Annex A control it relates to. Structured mapping provides direct input for the internal audit programme.

Risk-based prioritisation

Testing depth follows the risk register.

Testing priorities are informed by the risk treatment plan. High-risk assets receive deeper assessment, aligning with ISO 27001 proportionality principles.

Portal-delivered results

Findings visible in real time, not buried in a PDF delivered weeks later.

The Pentrox Portal provides remediation tracking, retest requests, report downloads, and team access management. Role-based access control is enforced on every account.

Retest included

Verified remediation before the audit.

Remediated findings are flagged through the Portal and scheduled for verification. Each finding is re-evaluated individually. Retest cycles repeat until all findings are resolved.

Frequently asked questions

Practical answers for security teams and procurement officers.

Is this assessment aligned with ISO/IEC 27001:2022?

The assessment is scoped to the ISMS certification boundary and follows a risk-based approach as required by the standard. Testing validates the effectiveness of Annex A controls, and findings are mapped to the relevant control references. The methodology satisfies Annex A control A.8.29 (security testing).

Can the report be submitted to the certification body?

The report is structured for certification body review. Findings include Annex A control mapping, a CVSS score, and documented evidence. It is worth noting that Pentrox provides penetration testing evidence, not the certification decision itself.

Is the testing scope based on the Statement of Applicability?

The penetration testing scope is aligned with the organisation's Statement of Applicability and the ISMS certification boundary. Scope alignment is confirmed during the intake phase to ensure testing covers the systems and controls that the certification body evaluates.

Is retesting included, and at what cost?

Retesting of remediated findings is included as standard with every assessment. There are no additional charges for verifying that fixes have been implemented correctly. The retest process is managed through the Pentrox Portal, where the client can flag remediated findings and request a retest.

What clearances do the testers hold?

All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP. Every assessment is performed or supervised by senior penetration testers with extensive hands-on experience.

How is production impact managed during testing?

All testing is performed in a controlled, non-destructive manner and preferably in a non-production environment. Test windows are agreed during the scoping phase. Critical findings are communicated immediately so that any unexpected impact can be assessed and addressed.

How is assessment data handled and who has access to findings?

Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.

What happens when a critical vulnerability is found during testing?

Critical or blocking vulnerabilities are communicated immediately through the channel agreed at kickoff. Findings are published in the Pentrox Portal as they are confirmed, so remediation can begin before the final report is delivered. The escalation path is documented in the statement of work.

Does ISO 27001 require a penetration test?

The standard does not use the words penetration test. It requires that technical vulnerabilities are managed (A.8.8), that security is tested during development and acceptance (A.8.29) and that the effectiveness of controls is evaluated (clause 9.1). Auditors accept a penetration test as the most direct evidence for those requirements, which is why most certified organisations test at least once a year and after major changes.

Which systems should be in scope for an ISO 27001 pentest?

The systems inside the ISMS boundary that carry the highest risk in your risk assessment: the customer-facing applications, the identity platform, remote access and the network segments that hold the information assets listed in the Statement of Applicability. Scoping starts from that list, not from the full IP range.