ISO 27001 Penetration Testing for MSPs

ISO 27001 penetration testing is the manual security test that produces the technical evidence behind your client's information security management system. Here is the part most vendors will not say plainly: ISO/IEC 27001:2022 never uses the words penetration test. Not in the clauses, not in an Annex A control title. The phrase appears in ISO/IEC 27002:2022, the companion guidance standard, which lists penetration tests among the ways an organization can identify technical vulnerabilities under control 8.8.

That distinction matters commercially. A client who has been told ISO 27001 mandates an annual pentest has been sold a half-truth. A client who has been told the standard does not require one is walking into a Stage 2 audit with nothing to show. The accurate position sits between the two. The standard requires the organization to identify, evaluate and treat technical risk, and to test security before systems go live. A penetration test is the most defensible way to evidence both.

What the standard actually requires

Clause 6.1.2 of ISO/IEC 27001:2022 requires a defined information security risk assessment process. Annex A lists 93 controls across four themes: organizational, people, physical and technological. Two technological controls carry most of the weight here.

• A.8.8 Management of technical vulnerabilities. The organization has to obtain information about technical vulnerabilities in the systems it uses, evaluate its exposure and take appropriate action. ISO/IEC 27002 guidance names penetration tests as one recognized method of identifying those vulnerabilities.
• A.8.29 Security testing in development and acceptance. Security testing processes have to be defined and implemented in the development life cycle, so a new or changed in-scope application is tested before acceptance.

Related controls are easier to evidence once a tester has actually exercised them, including A.5.7 threat intelligence, A.8.25 secure development life cycle and A.8.28 secure coding.

What the auditor actually asks for

Certification body auditors rarely open with do you have a pentest. They ask narrower questions, and vague answers are what turn into findings.

• Show me the scope. Does the tested estate match the ISMS certification boundary, including cloud services, remote access and any in-scope applications.
• Show me the method. A documented testing methodology, not a scanner export with a cover page on it.
• Show me who tested. Independence and competence, which is where OSCP, CEH and CREST credentials do real work.
• Show me what you did about it. Findings carried into the risk treatment plan under Clause 6.1.3, with owners and dates.
• Show me it closed. Retest evidence proving the corrective action actually worked.

That last question is the difference between a nonconformity and a clean pass, which is why every engagement we run includes remediation retesting.

Stage 1 vs Stage 2 audits

Stage 1 is largely a documentation review. Stage 2 is where the certification body evaluates whether the controls genuinely operate. Most of our MSP partners schedule the penetration test four to eight weeks before Stage 2, which leaves room to fix what we find and retest it, so the client arrives at the audit with closed findings rather than open ones.

What our ISO 27001 penetration testing delivers

• Manual external and internal testing performed by OSCP, CEH and CREST certified pentesters
• Findings mapped to the specific Annex A controls they evidence
• A risk-rated report that drops straight into the client's existing ISMS risk register
• Documented methodology a certification body auditor will recognize
• Free remediation retesting, because closed-loop evidence is what auditors want to see
• Application and infrastructure testing scoped to the certification boundary, not to a price list

How MSPs and vCISOs deliver it channel-only

ISO clients tend to be more sophisticated and more demanding. They want a partner who understands the standard, can speak the language of an ISMS and can produce evidence that survives a certification body's scrutiny. We do that work behind your brand. We are channel-only, we never sell to your client, and our pricing is built so you keep margin even on smaller engagements.