What SOC 2 Actually Requires

The AICPA's SOC 2 Trust Service Criteria do not explicitly mandate penetration testing. The Availability and Security criteria require that you have processes to identify and respond to vulnerabilities — but the specific mechanism (pen test, vulnerability scanning, bug bounty, internal red team) is not prescribed. An auditor will test whether you have a vulnerability management process, not whether that process includes an external pen test.

In practice, most SOC 2 Type II reports for mature SaaS companies include a reference to annual penetration testing as part of the vulnerability management control. It's an accepted and expected way to demonstrate the vulnerability identification requirement.

What Enterprise Buyers Expect

Enterprise buyers — especially in financial services, healthcare, and government — often require a pen test report as a separate deliverable alongside your SOC 2 report. Their VSQs include questions like "Do you conduct annual penetration testing by an independent third party?" and "Can you provide the most recent test report summary under NDA?"

For companies targeting enterprise deals above $50K ACV: budget for an annual external penetration test even if your SOC 2 auditor doesn't require one. It closes VSQ questions that the SOC 2 report doesn't.

What Should a SOC 2 Pen Test Cover?

A pen test scoped for SOC 2 purposes should cover your external attack surface — internet-facing APIs, web application, AWS-exposed endpoints — and typically includes: network/infrastructure testing of public-facing systems, web application testing (OWASP Top 10), API endpoint testing, and optionally an authenticated internal test. AWS prohibits certain types of network testing without advance approval, so work with your pen test firm on an AWS-approved scope.

What to Do with Findings

Critical and high findings must be remediated within a documented SLA — typically 15 to 30 days for critical, 60–90 days for high. Medium and low findings should be tracked and addressed in priority order. Document every finding and its remediation status. SOC 2 auditors want to see that you have a vulnerability management process that receives findings and closes them — not that you passed the pen test with zero findings (no one does).

AWS note: Under AWS's shared responsibility model, you own application-layer security. Pen testing your AWS infrastructure is permitted under the AWS Customer Support Policy for Penetration Testing — but certain services require advance notification. Review the policy before scheduling your test.