Penetration Testing Service Provider: What Security Compliance Frameworks Require Pen Testing?
Are you ever in situations where an auditor asks to see your latest penetration test results, but you have no idea what they are looking for? Choosing the right penetration testing service provider can be a challenge that is not easy to find a solution for. It can also be one of those “gotchas” in your audit that can cost your company dearly if not handled correctly.
It doesn’t matter if you are a small organization looking to achieve SOC 2 compliance or a healthcare organization that must remain HIPAA compliant; the question “which industry standards or compliance frameworks require organizations to perform penetration tests and how should a company select a penetration testing service provider?” arises. Let’s discuss the issue in detail.
Table of Contents
Why Compliance Frameworks Care So Much About Penetration Testing Service Provider
The Limitations of Firewalls and Antivirus Software for Compliance
Firewalls, antivirus programs, and encryption are all excellent examples of security measures – but they fall under the category of defensive assumptions. Compliance frameworks do not consider assumptions as proof. They require demonstrable, repeatable evidence that your system can withstand attacks from would-be hackers. This is precisely what a penetration test achieves by simulating an attack, with the help of an expert hacker.
The Difference Between a Vulnerability Scan and a Penetration Test
One of the most common concerns about penetration testing stems from its primary difference: while a vulnerability scan is automated, penetration testing always involves a human factor. Whereas a vulnerability scan uncovers potential problem areas using a database of known threats, penetration testing actively exploits the discovered vulnerabilities. In doing so, it identifies exactly what an attacker could do to breach your system – something that becomes incredibly valuable to auditors, who increasingly recognize penetration testing as the true security assessment.
The Importance of “Proof” of Cybersecurity in Audits
One basic theory underlies all standards and regulations regarding cybersecurity: trust, but verify. A written statement from your compliance officer regarding the security of your data might be enough to convince a potential client. However, the proof – the actual, demonstrable fact of your system’s safety – is what you present to an auditor, who will then rely on your word on other matters.
The Major Compliance Frameworks That Mandate Penetration Testing
Some compliance frameworks explicitly require penetration tests as a condition of certification. Others include them implicitly, as a best practice. Either way, if you are preparing to undergo an audit, there are several important regulations to consider.
The Significance of Penetration Testing for PCI DSS Compliance
Perhaps the most well-known compliance standard, PCI DSS applies to all companies that process credit card payments. Under PCI DSS Requirement 11.4, organizations must perform penetration testing of their networks at least once a year and after any significant infrastructure or application changes. Depending on a company’s level, these assessments can take two forms: network and application-layer penetration testing, and segmentation testing, which determines whether a company has implemented network segmentation to reduce the scope of its cardholder data environment.
The Role of Penetration Testing in HIPAA Compliance
HIPAA does not explicitly mention penetration testing. Instead, it refers to periodic technical evaluations of technical safeguards that protect electronically protected health information (ePHI). In practice, this requirement has always been interpreted by the Department of Health and Human Services and HIPAA auditors as a penetration test.
The Necessity of Penetration Testing for SOC 2 Security Standards
A SOC 2 audit makes use of the Trust Services Criteria (TSC) to evaluate a company’s ability to meet specific security and control requirements regarding customer data. SOC 2 audits are typically performed by third-party auditors, who determine whether the audited entity possesses the infrastructure, procedures, and policies to maintain the confidentiality, integrity, and availability of that data. The requirement for penetration testing has not been explicitly stated in SOC 2 standards. With that said, it has become a generally accepted procedure: if a company omits a penetration test, it may expect a closer examination on other fronts.
The Relationship Between ISO 27001 and Penetration Testing
Similar to SOC 2, ISO 27001 does not explicitly require organizations to undergo penetration testing. Rather, it refers to the management of technical vulnerabilities and the testing of technical controls. As such, the ISO 27001 certifying authority will invariably ask you to produce reports regarding your organization’s penetration testing as evidence of compliance with Annex A.12.6.1 and Annex A.14.2.8.
The Relevance of Penetration Testing for FedRAMP and NIST 800-53
NIST 800-53 is a set of cybersecurity standards issued by the National Institute of Standards and Technology, which applies to federal agencies and organizations that work with them. Penetration testing, according to NIST 800-53, is required to evaluate the security posture of an organization and detect possible vulnerabilities that an attacker could use to infiltrate the network. In practice, this requirement applies to all companies that sign contracts with the government. In addition, the Federal Risk and Authorization Management Program (FedRAMP) provides the same protection assessment standard for cloud products and services.
The Applicability of Penetration Testing to GDPR and State Privacy Laws
GDPR does not explicitly mention penetration testing, but rather refers to the “regular testing, assessing, and evaluating” of security measures to ensure the protection of personal data. The European Data Protection Authorities view the GDPR Article 32-compliant security assessment as fulfilling the GDPR data protection requirement. In the United States, laws and regulations on the privacy of personal data (such as the California Consumer Privacy Act or CCPA) do not mention penetration testing, but several states have specific data security breach laws that may apply to your organization.
A Summary of Relevant Compliance Standards and Their Penetration Testing Requirements
The following table summarizes the key points:
Choosing the Right Penetration Testing Service Provider
As you prepare your organization for a compliance audit, you recognize the necessity of penetration testing – but you are unsure of what to look for in a service provider. There are several key questions to ask when choosing a penetration testing company, credentials to look for, and red flags to watch out for.
The Qualifications and Certifications for a Reputable Penetration Testing Service Provider
At the very least, a reliable penetration testing vendor should have certified penetration testers on staff. Some of the most common certifications to look for include:
OSCP (Offensive Security Certified Professional)
CEH (Certified Ethical Hacker)
GPEN (GIAC Penetration Tester)
CREST accreditation – for companies that operate primarily in the European sector
The Value of Questions to Ask a Penetration Testing Vendor
When searching for a penetration testing service provider, make sure to ask the following five questions
- Do you offer a remediation retest service after the initial scan?
- Do your reports address the relevant compliance standards?
- What methodology do you use for your penetration testing?
- Do you offer documentation or examples of your previous reports?
- How will you handle changes in the scope of the assessment?
Warning Signs of an Unreputable or Incompetent Penetration Testing Company
On the other hand, certain red flags indicate incomplete or unnecessary services, such as:
- A report that looks more like an output from an automated scanner, with little analysis or explanation
- The company’s unwillingness to explain its methodology
- The lack of support and retesting after the initial scan
- An unrealistically low price for a “complete” penetration test, without specifying what that entails
How Compliance Software Makes Pen Testing (and Everything Else) Easier
As mentioned previously, there are several regulations and standards that explicitly require or recommend that companies complete a penetration test before submitting to an audit. The most difficult part of the process is the organization itself: coordinating this initiative with other activities, preparing supporting documents, and storing the results in an accessible location.
The Benefits of Automated Compliance Management Software
Compliance software can help you manage your controls, evidence, and requirements more efficiently by automating it. For example, when it comes to penetration testing, your software can store the relevant reports in one place and remind you when your next scan is due, according to the applicable standard. Some compliance software even utilizes data from the penetration testing to track that specific aspect of your controls.
Compliance Software for Small Business Concerns
Many compliance software for small business solutions now cater exclusively to small businesses with limited resources to invest in compliance management. Some of the most common tools for preparing for SOC 2 or HIPAA audits offer features such as automated evidence collection or integration with external service providers, including your penetration testing vendor.
The Advantages of GRC Software Beyond Simple Compliance
GRC (governance, risk, and compliance) software takes the management of controls a step further, integrating it with enterprise risk management and reporting functions. While many organizations will always retain at least some internal auditors, a GRC software can reduce the time spent on repetitive tasks, such as compiling reports for internal stakeholders or analyzing the relationship between your controls and risk exposure. If your organization operates under several standards that share common requirements (for instance, the intersection between PCI-DSS and SOC 2), a GRC software will allow you to apply the same control to multiple standards simultaneously.
Conclusion
Penetration testing is the closest alternative to simulating an attack on your network before an actual attacker does. Some standards, such as PCI DSS and Fed RAMP, explicitly require that a company undergoes a penetration test at least once a year. For other standards, such as HIPAA or SOC 2, this procedure has become a best practice that auditors expect to see during the course of an examination. The smart choice is to utilize a penetration testing service and compliance software to store the results in one accessible location.
Frequently Asked Questions
How often do I actually need a penetration test for compliance purposes?
Most standards require it at least annually anyway. PCI DSS, FedRAMP, and many others explicitly state annual testing requirements and require re-testing after any significant infrastructure changes. Even frameworks that don’t specify a frequency (like SOC 2) will typically want to see some form of annual penetration testing as part of a compliance audit.
Can I use the same penetration test for multiple compliance frameworks?
It depends. If your engagement scope overlaps the requirements of the frameworks you need to satisfy (e.g., testing that satisfies both PCI DSS and ISO 27001 requirements), then a good penetration test provider will be able to design the test scope to fulfill multiple compliance objectives.
How much should a penetration test cost?
It depends on the scope of the assessment, but budget anywhere from $4,000 to $8,000 for a single-application assessment and up to $15,000–$30,000+ for a comprehensive network and application assessment. Avoid providers who charge significantly less than this, as real penetration testing is highly labor-intensive and requires a significant investment of time from qualified professionals.
Do I really need penetration testing for my start-up?
Start-ups that are targeting SOC 2 compliance, handling payment data, or operating as a service to enterprise organizations will most likely need penetration testing.
Can we remediate any critical findings before the audit?
This is totally normal, in fact, most penetration testers will work with you to establish a remediation timeline and retest prior to your audit date, especially if you’re using a good provider. Most auditors understand that having actionable items in your report is far more important than having zero findings.
