Does ISO 27001:2022 Actually Require a Penetration Test?

ISO/IEC 27001:2022 does not state that every organisation must conduct a penetration test to achieve certification. Instead, it takes a risk-based approach to information security. Organisations must identify their risks, determine appropriate controls, implement them where applicable, and continually assess whether their information security measures are effective.

However, this does not mean penetration testing is irrelevant to ISO 27001. In many environments, testing can provide valuable evidence that security controls are working as intended. It can also help organisations identify weaknesses that automated scans, configuration reviews, or documentation may not uncover.

So, what does ISO 27001:2022 actually require, and where does penetration testing fit?

What Does ISO 27001:2022 Require?

ISO/IEC 27001:2022 is a standard for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). It focuses on managing information security risks rather than prescribing one fixed technical security solution for every organisation. This distinction is important. ISO 27001 does not say that every business must use a specific security tool or perform a specific technical test at a fixed frequency. Instead, organisations assess their risks and determine appropriate controls.

Annex A contains 93 information security controls across organisational, people, physical and technological areas. Not every control automatically applies to every organisation. Applicability is determined through the organisation's risk assessment and treatment process.

This is why there is no universal rule stating that every ISO 27001-certified company must complete a penetration test every year.

Where Does Penetration Testing Fit Into ISO 27001?

Penetration testing can support several areas of an ISMS. One particularly relevant control is 8.29, Security testing in development and acceptance. This control focuses on testing security requirements during system development and acceptance to verify that security has been implemented as intended. This can be particularly relevant for organisations developing web applications, APIs, mobile applications, cloud platforms or other software.

Another relevant area is 8.8, Management of technical vulnerabilities. This control focuses on identifying and addressing technical vulnerabilities within an organisation's technology environment. A vulnerability scan may identify potential weaknesses, but a penetration test can go further by attempting to determine whether weaknesses can actually be exploited and what impact that exploitation could have. Therefore, ISO 27001 penetration testing should be viewed as a practical security activity that can support risk management and control effectiveness, rather than an automatic certification requirement for every organisation.

What Are the ISO 27001:2022 Pentest Requirements?

There is an important distinction between a standard requiring penetration testing and an organisation determining that penetration testing is necessary based on its risks.

The ISO 27001:2022 pentest requirements are therefore not a simple checklist saying, "Conduct a penetration test once per year."

Instead, organisations should consider factors such as:

• The risks identified during their information security risk assessment
• The systems and information included within the ISMS scope
• The sensitivity of the data being handled
• The complexity of the technology environment
• Changes to applications or infrastructure
• Customer or contractual security requirements
• Regulatory or industry obligations
• Internal security policies and procedures
• Previous security findings
• The organisation's approach to vulnerability management

For example, a SaaS company that processes sensitive customer information may determine that regular application and API testing is an appropriate risk treatment. Another organisation with a different risk profile may use other forms of security assessment.

The key is being able to demonstrate that security decisions are risk-based, documented and appropriate to the organisation.

Why Is Penetration Testing Still Valuable for ISO 27001?

Even when a penetration test is not universally mandatory, it can provide practical value to an organisation pursuing or maintaining ISO 27001 certification.

1. It Helps Validate Security Controls

Policies and procedures show how an organisation intends to manage security. Testing provides another perspective: whether those protections actually withstand realistic attack techniques.

2. It Identifies Exploitable Weaknesses

Automated vulnerability scanning can be useful for identifying known vulnerabilities. However, penetration testing can involve manual investigation, exploitation and business-logic testing. This can reveal attack paths that individual vulnerability findings may not fully demonstrate.

3. It Supports Risk Management

ISO 27001 is built around understanding and managing information security risks. A penetration test can help an organisation understand the practical likelihood and potential impact of certain weaknesses.

4. It Helps With Remediation

A useful penetration test does not stop at identifying vulnerabilities. A professional report should provide evidence, explain the security impact and help the organisation understand what needs to be addressed. After remediation, retesting can help confirm whether identified issues have been resolved.

5. It Can Support Customer and Compliance Requirements

Some customers, partners, regulators or industry frameworks may have security testing expectations that go beyond the baseline requirements of ISO 27001. In these situations, penetration testing may become necessary because of an external requirement rather than ISO 27001 itself.

What Should an Organisation Do Before an ISO Audit?

If your organisation is preparing for certification, start with the ISMS and risk assessment rather than assuming that a penetration test is automatically required.

Review:

• Your ISMS scope
• Information security risks
• Applicable Annex A controls
• Your Statement of Applicability
• Security testing processes
• Vulnerability management
• Application and infrastructure changes
• Customer and contractual requirements
• Regulatory obligations
• Previous security assessment findings

If your risk assessment identifies penetration testing as an appropriate control or risk treatment, make sure the testing is properly scoped, performed and documented. The resulting evidence should connect the technical findings to your broader security management process.

Strengthen Your Security with Penva Security

Preparing for ISO 27001 does not have to mean treating penetration testing as another compliance checkbox. Penva Security helps Australian businesses identify real-world security weaknesses through human-led, AI-accelerated penetration testing. Its testing approach combines experienced security professionals with technology designed to improve testing speed and coverage. 

Services include web application, API, network, cloud, mobile application and AI/LLM penetration testing. Penva Security also provides detailed reports and remediation guidance to help organisations understand and address identified vulnerabilities. Whether you are preparing for an audit, reviewing your existing security controls or looking for greater assurance over critical systems, a focused security assessment can provide valuable insight into your actual security posture.

FAQs

1. Is penetration testing mandatory for ISO 27001:2022?

No. ISO 27001:2022 does not universally mandate penetration testing. Whether testing is required depends on organisational risks, applicable controls, contracts, regulations and security requirements.

2. Which ISO 27001:2022 control relates to security testing?

Control 8.29 addresses security testing in development and acceptance. It focuses on verifying that security requirements are properly implemented during software development and system acceptance.

3. Does vulnerability scanning replace penetration testing for ISO 27001?

Not necessarily. Vulnerability scanning and penetration testing serve different purposes. Scanning identifies potential weaknesses, while penetration testing can investigate their practical exploitability.

4. How often should an ISO 27001 organisation conduct a penetration test?

ISO 27001 does not prescribe one universal testing frequency. Organisations should determine appropriate testing intervals according to risk, system changes, regulatory obligations and business requirements.

5. Can penetration testing help during an ISO 27001 audit?

Yes. Where penetration testing forms part of an organisation's risk treatment or security programme, testing reports, findings and remediation evidence can help demonstrate how security risks are being assessed and managed.