HackproofHacks
ISMS-aligned penetration testing

ISO 27001 Penetration Testing

ISO 27001 certifies your information security management system, not a single application, but your certification body will still expect evidence that you actively find and fix technical vulnerabilities. A penetration test is the cleanest way to produce that evidence and to satisfy the Annex A control on technical vulnerability management.

This engagement is scoped to slot directly into your ISMS: a rigorous test of your in-scope systems, delivered with a report your auditor can file against the relevant Annex A controls and your Statement of Applicability.

Why an ISO 27001 ISMS needs penetration testing

Annex A includes a control for technical vulnerability management, and your certification auditor will ask how you obtain information about vulnerabilities in your systems and how you act on it. An automated scan is part of the answer, but auditors increasingly expect a periodic independent penetration test as evidence that the control is operating, not just documented.

Certification is also a continuous commitment, not a one-time event. Surveillance audits happen annually, and a repeatable penetration test with a clear remediation trail demonstrates that your ISMS is genuinely improving over time rather than sitting static on paper.

Finally, ISO 27001 is often the certificate your international enterprise customers ask for. Pairing the certificate with a recent independent penetration test report answers the follow-up question that inevitably comes during vendor due diligence: yes, the system is certified, and here is proof it was actually tested.

What we test

In-scope applications and services

A full OWASP-aligned test of the web applications, APIs, and services inside your ISMS boundary, matched to the scope defined in your Statement of Applicability.

Access control and identity

Authentication, authorization, session management, and privilege separation, which map to the access-control family of Annex A controls.

Configuration and hardening

Insecure defaults, exposed management interfaces, missing security headers, and outdated components, feeding the secure-configuration and technical-vulnerability controls.

Data protection in transit and at rest

Weak TLS, unencrypted sensitive data, and information leakage through error messages or verbose responses.

The report you receive

The report is written to be filed as ISMS evidence and to guide remediation. It contains:

  • An executive summary suitable for management review and the certification auditor.
  • A methodology statement referencing OWASP testing standards.
  • Findings rated by severity with reproduction steps, impact, and remediation.
  • A mapping from findings to the relevant Annex A controls and your Statement of Applicability.
  • A retest and updated report so your remediation trail is complete for the audit.

Findings we commonly report in this category

Untracked assets outside the ISMS boundary

Forgotten subdomains, staging environments, or exposed services that were never brought into scope but are internet-reachable and vulnerable.

Broken access control

Users reaching data or functions their role should not permit, the single most common serious finding across every category.

Outdated components with known CVEs

Libraries, frameworks, or servers running versions with published exploits, which directly implicate the technical-vulnerability-management control.

Weak transport security

Deprecated TLS versions or cipher suites, and sensitive endpoints reachable over plaintext HTTP.

Frequently asked questions

Does ISO 27001 require a penetration test?

The standard does not name penetration testing as a mandatory control word-for-word, but Annex A requires technical vulnerability management, and certification auditors widely expect an independent penetration test as evidence that the control operates. In practice it is treated as necessary.

How often should we test for ISO 27001?

At least annually, and after any significant change to in-scope systems. Because certification involves annual surveillance audits, a yearly test with a documented remediation trail keeps your evidence current.

What scope should the test cover?

The systems inside your ISMS boundary as defined in your Statement of Applicability. We help you confirm the scope during a short call so the test matches exactly what the auditor will examine.

Will this report satisfy our certification body?

Yes. It maps findings to the relevant Annex A controls, states the methodology, and includes a retest, which is what auditors look for when assessing technical vulnerability management.

Related services

Ready to scope your iso 27001 penetration testing?

Book a free 30-minute scoping call. We agree the scope, timeline, and a fixed price up front — no obligation, and no surprises for your deadline.