Penva Security
Book a scoping call

ISO 27001 Penetration Testing

Penva Security delivers CREST-certified penetration testing engagements aligned to ISO/IEC 27001:2022, producing the evidence your certification body needs for Annex A controls A.8.8, A.8.29 and A.5.23.

Human-led exploitation combined with AI-accelerated coverage gives you broader scope, faster delivery, and a report your auditor will accept the first time, plus a free remediation retest within 60 days.

  • Certified Testers
  • Security Compliance
  • Manual Pentesting
CRESTOWASPSecured 100+ organisations4.9Clutch
●   PENTEST REPORT● COMPLETE

Security Assessment Report

target: app.client.com · CVSS 3.1

Critical3
High6
Medium9

✓  Report + letter of attestation generated

Every report, audit-ready for ISO 27001.

Get Instant Quote  

Instant estimate in about 30 seconds

Definition

What Is ISO 27001 Penetration Testing?

See how the testing scope and reporting support your organisation's security and assurance requirements.

ISO 27001 penetration testing is an authorised security assessment that produces the documented evidence ISO/IEC 27001:2022 expects under Annex A controls A.8.8 (Management of technical vulnerabilities) and A.8.29 (Security testing in development and acceptance). It demonstrates to your certification body and stage-2 auditor that you are identifying, exploiting and remediating real vulnerabilities - not just running a scanner.ISO 27001 does not prescribe a specific testing methodology, but accredited auditors expect a structured, repeatable engagement performed by qualified, independent testers, with findings rated, tracked and closed. Penva engagements follow OWASP WSTG, NIST SP 800-115 and PTES, and produce a CREST-signed report formatted to satisfy stage-2 certification and surveillance audits.

For Australian organisations pursuing or maintaining certification, this means a single engagement that satisfies your ISMS evidence requirements, the technical vulnerability clauses of Annex A, and - where applicable - the cloud-service security control A.5.23.

Requirements

What ISO/IEC 27001:2022 Expects

The three Annex A controls most directly satisfied by a penetration test, plus the operational expectations of an accredited certification audit.

A.8.8

Management of Technical Vulnerabilities

Information on technical vulnerabilities must be obtained, the organisation's exposure evaluated, and appropriate measures taken. Penetration testing is the standard evidence of evaluation and treatment.

A.8.29

Security Testing in Development and Acceptance

Security testing processes must be defined and implemented in the development lifecycle. Pre-release penetration tests of new features and applications are the most common evidence.

A.5.23

Information Security for Use of Cloud Services

Processes for acquisition, use, management and exit of cloud services must include security. Cloud configuration and exposed-service penetration tests are accepted evidence.

Clause 9.1

Monitoring, Measurement, Analysis and Evaluation

ISMS performance and the effectiveness of controls must be evaluated. Pentest findings, trend data and remediation status feed directly into management review.

Clause 10.2

Nonconformity and Corrective Action

Identified weaknesses must be corrected and verified. Penva's free retest provides the documented evidence of closure your auditor requires.

Annex A.5.7 / A.8.16

Threat Intelligence & Monitoring

Inputs from realistic threat simulation inform monitoring and detection coverage. Pentest attack paths are valuable supporting evidence.

How Penva Delivers

Mapped Directly to the Requirements Your Auditor Will Sample

Each Penva engagement produces specific deliverables mapped to the Annex A controls and ISMS clauses your auditor will sample.

A.8.8 Management of Technical Vulnerabilities

Penetration test report with CVSS 3.1 severity, exploitability evidence, business-impact narrative and prioritised remediation. Mapped to OWASP and CWE references.

A.8.29 Security Testing in Development & Acceptance

Pre-release and post-change testing with documented scope, methodology and findings. Suitable for inclusion in ISMS development-lifecycle records.

A.5.23 Cloud Service Security

Cloud configuration and exposed-service testing against AWS, Azure or Google Cloud - IAM, storage, metadata, public services - included where in scope.

Clause 10.2 Corrective Action Evidence

Free remediation retest within 60 days with an updated report confirming closure. The single piece of evidence stage-2 auditors most often request.

CREST Attestation Tester Independence & Qualification

Letter of attestation naming the tester, CREST/OSCP credentials, scope, dates and methodology - accepted by JAS-ANZ-accredited certification bodies.

Instant Estimate Quote

Get an Instant Penetration Testing Estimate

Answer a few scoping questions to get a practical estimate for web, API, mobile, infrastructure, and cloud penetration testing.

    01

    What type of penetration testing do you need?

    Choose the main service you want quoted.

    FAQ

    ISO 27001 Penetration Testing - Common Questions

    Direct answers to the questions Australian organisations ask most often. Updated May 2026.

    Does ISO 27001 require penetration testing?

    ISO/IEC 27001:2022 does not name 'penetration testing' as a mandatory control, but Annex A controls A.8.8 (technical vulnerabilities) and A.8.29 (security testing in development) cannot be evidenced credibly without it. Accredited certification bodies routinely expect, and audit for, periodic penetration testing - particularly for organisations whose risk assessment identifies internet-facing applications or sensitive data processing. In practice, a CREST-certified pentest is the standard evidence.

    How often do we need an ISO 27001 penetration test?

    At least annually, and after any significant change to your application, infrastructure or cloud environment. Surveillance audits in years 2 and 3 of your certification cycle will sample recent penetration test evidence. Organisations with frequent releases should test after major changes or run continuous testing through a Pay-As-You-Go arrangement.

    Which ISO 27001:2022 controls does a penetration test satisfy?

    Primarily A.8.8 (Management of technical vulnerabilities) and A.8.29 (Security testing in development and acceptance). A.5.23 (Information security for use of cloud services) is also commonly evidenced through cloud-configuration testing. ISMS clauses 9.1 (monitoring and measurement) and 10.2 (corrective action) are satisfied through pentest findings and the documented remediation retest.

    What's the difference between ISO 27001:2013 and ISO 27001:2022 for penetration testing?

    ISO/IEC 27001:2022 restructured Annex A from 114 to 93 controls and introduced eleven new ones, including A.5.23 (Cloud services), A.5.30 (ICT readiness for business continuity) and A.8.28 (Secure coding). For penetration testing, the change is mostly clarifying: the new control numbering (A.8.8, A.8.29) maps to the older A.12.6.1 and A.14.2.8 from 2013. The transition deadline was 31 October 2025, so all current certifications are now against the 2022 version.

    Will Penva's report be accepted by our certification body?

    Yes. Penva reports follow CREST methodology and are formatted to satisfy JAS-ANZ-accredited certification bodies operating in Australia. Every report includes executive summary, scope, methodology statement, CVSS 3.1 severity ratings, evidence, remediation guidance and a signed letter of attestation. We have not had a report rejected by a certification auditor.

    How long does an ISO 27001 penetration test take?

    Most ISO 27001 engagements run 5 to 10 business days of active testing, plus 1 to 2 days for reporting. Smaller scopes can complete in under a week. Penva delivers findings progressively in a shared tracker so your remediation can start during the engagement - useful when your stage-2 audit is on a fixed date.

    Do you provide a free retest for ISO 27001 closure evidence?

    Yes. Every fixed-price engagement includes one free remediation retest within 60 days. After your developers ship fixes, we re-validate each finding and issue an updated report confirming closure - the documented evidence ISO auditors look for under clause 10.2 (corrective action).

    Let's talk security

    Get In Touch

    Book a scoping call or share your systems, testing requirements and preferred timeline with our team.

    Book a scoping call

    Choose a time that works for you.

    30 min

    Tell us what you need

    Share your scope, priorities and deadline.

    Share your scope and we'll help you plan the next step.

    A clear next step

    We'll review your requirements with you and confirm the scope before testing begins.

    Prefer to get in touch directly? [email protected]