A pentest report built for your audit

We provide the pentest. Your auditor or certification body issues the SOC 2 report or the certificate. Here is how our report fits each framework.

SOC 2

What it asks: SOC 2 doesn't make a pentest mandatory, but auditors commonly accept one as evidence for the monitoring and vulnerability management criteria (such as CC4.1 and CC7.1). Many enterprise customers ask for one alongside the SOC 2 report.
What we deliver: A pentest report and attestation letter dated inside your audit period. The SOC 2 report itself can only be issued by a licensed CPA firm.

ISO 27001

What it asks: Annex A control 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance). Auditors look for regular independent testing and evidence that findings were fixed.
What we deliver: The report, the retest result and the updated letter show both: what was found and that it was fixed.

PCI DSS 11.4

What it asks: An application-layer penetration test by a qualified tester who is organisationally independent, at least once a year and after significant changes.
What we deliver: An application and API test with the tester's independence stated in the report. Quarterly external scans (11.3.2) need an Approved Scanning Vendor; we are not one.

NIS2 (Cyberbeveiligingswet)

What it asks: No explicit pentest duty, but a duty to assess whether your security measures work (article 21). Customers in scope of NIS2 also check their suppliers.
What we deliver: Independent evidence that your app's measures work, which you can show to your board and your customers.

DigiD assessment

What it asks: The yearly DigiD assessment is done by an IT auditor (RE). A recent pentest of the DigiD-connected application is usually part of the evidence.
What we deliver: A pentest of that application, in Dutch or English, with the scope and dates the auditor needs.

What auditors check in a pentest report

Auditors check	Where our report covers it
Independence	We don't build or run your systems. Stated in the report and the letter.
Qualifications	The tester is named, with their background.
Scope	Assets, environment, user roles and versions tested are listed.
Timing	Test dates are on the report and the letter.
Method	OWASP ASVS at a stated level, with the OWASP testing guide.
Findings	Each one has a severity, evidence and a fix.
Remediation	The retest result, and a letter updated after it.

Auditor or compliance consultant? How we work with you