ISO 27001 Penetration Testing (Annex A 8.8 and 8.29)

ISO 27001 does not name penetration testing as a requirement, but it expects what a test proves. Annex A control 8.8 requires you to find, evaluate and fix technical vulnerabilities, and 8.29 requires security testing before systems and changes go live. ISO 27001 penetration testing is the most direct way to evidence both, and a recent report with a retest is what certification auditors commonly ask to see.

Sovereign Secure is ISO 27001 certified and provides both ISO 27001 consultancy and penetration testing services. We scope each test from your ISMS scope and risk assessment, and report against the controls your auditor will sample.

Does ISO 27001 require penetration testing?

Not in so many words. Neither the ISO 27001 requirements in clauses 4 to 10 nor the Annex A controls of ISO/IEC 27001:2022 use the phrase, because the standard sets outcomes and leaves methods to you. Three things still make a test the expected answer:

• The guidance points to it. ISO/IEC 27002:2022, the guidance behind Annex A, lists planned, documented and repeatable penetration tests or vulnerability assessments by competent, authorised people as a way to identify vulnerabilities under 8.8.
• Your own policy binds you. Clause 9.2 requires internal audits to check you meet your own ISMS requirements. If your policy says “annual penetration test”, the auditor will check you had one.
• Customers ask. Security questionnaires, tenders and insurers regularly ask for the date of your last independent test.

A missing report is not a nonconformity in itself, unless your own policy or risk treatment plan commits you to a test. Auditors will ask how you identify vulnerabilities and test security before release, and if you run internet-facing systems or build software, a manual test is the most credible answer. The NCSC’s penetration testing guidance frames it the same way: a test gives assurance that your vulnerability management works, rather than replacing it.

ISO 27001 penetration testing requirements by control

One test evidences several Annex A controls. The 2013 numbers are shown because many policies still quote them, although every certificate has had to use the 2022 version since 31 October 2025.

If your Statement of Applicability (SoA) excludes 8.29 because you develop no software, record why; an unexplained exclusion invites a finding.

What do ISO 27001 auditors ask for?

They want evidence that vulnerabilities are found, judged against your risk criteria and dealt with. Expect these questions at Stage 2 and each surveillance audit:

• How do you identify technical vulnerabilities, and how often? Show me the last scan and the last test.
• Does the test scope match the ISMS scope and your asset inventory?
• What happened to the high and critical findings? Where is the retest?
• Who accepted the risks you chose not to fix?
• How is security tested before a release goes live?
• Who authorised testing of live systems?

Evidence usually falls short on the same points: a report older than your policy allows, a scope that misses a certified system, findings with no retest, or unsigned residual risks.

How do we scope a penetration test for ISO 27001?

Start from your ISMS scope statement (clause 4.3) and asset inventory (control 5.9), not a list of IP addresses. Then prioritise the systems behind your highest risks and anything your certificate names.

Before touching live systems we agree rules of engagement with you: dates, contacts, out-of-bounds actions and data handling. That signed agreement is your 8.34 evidence.

Building a SaaS product? Our guide to ISO 27001 for startups shows where an application and API test fits in a lean ISMS alongside the secure development controls 8.25 to 8.29.

How often should you pen test for ISO 27001?

ISO 27001 sets no interval: your risk assessment decides, and your policy then binds you. A defensible baseline:

Define “significant change” in your policy, such as a new platform or cloud migration, so the auditor can check you applied it.

Is penetration testing required for PCI DSS and Cyber Essentials Plus?

PCI DSS requires it outright; Cyber Essentials Plus does not. One well-scoped test can serve several frameworks.

Taking card payments? PCI DSS penetration testing scoped to Requirement 11.4 can evidence 8.8 as well.

What goes in your ISO 27001 evidence pack?

We map findings to the Annex A controls above and help you complete the records an auditor samples:

Penetration testing alongside ISO 27001 consultancy

Test after your risk assessment, early enough to fix and retest before Stage 2. With our consultancy, the sequence is:

1. ISO 27001 gap analysis.
2. Risk assessment and Statement of Applicability.
3. Penetration test of the in-scope systems.
4. Remediation, retest and residual-risk sign-off.
5. Internal audit and management review.
6. Stage 1 and Stage 2 certification audits by MQA International.
7. A repeat test each year, ahead of each surveillance audit and recertification in year three.

How much does a pen test for ISO 27001 cost?

It depends on scope, so we quote a fixed price after scoping. The drivers are external IPs, internal hosts, applications, APIs, user roles and cloud accounts. Published UK pricing guidance we reviewed in September 2026 put typical tester day rates at about £1,000 to £1,500. Our guide to penetration testing cost shows how scope turns into days.

Why Sovereign Secure

• ISO 27001 certified ourselves. We work to the same standard we help you meet.
• Consultancy and testing in one team. Findings go straight into your risk register and SoA, while certification audits stay independent with our partner certification body, MQA International.
• Every test type. Network, web, API, cloud, mobile, wireless, IoT, social engineering and red team testing.
• Assessor credentials. A PCI SSC-approved QSA, Qualified PIN Assessor and Card Production Security Assessor company, PCI SSC GEAR member for 2026 to 2028, and IASME-licensed Cyber Essentials certification body.
• UK based, international reach. Head office in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. Clients include Accor, Fiserv, Ticketmaster and Cashplus.

Get a quote for your ISO 27001 test

Send your ISMS scope statement, a list of in-scope systems and your next audit date. We will reply with a fixed scope, price and test dates that leave time to fix and retest. Use our penetration testing quote form, call +44 161 523 5276 or email [email protected].