External surface
Everything reachable from outside the organization.
- Exposed services and remote access
- Public applications and portals
- Email and domain security
- Unpatched and unsupported software
ISO/IEC 27001 does not contain a clause saying "perform an annual penetration test". What it contains is Annex A 8.8, management of technical vulnerabilities, together with clause 9 on monitoring and measurement and clause 10 on improvement - and an auditor who wants evidence that you do what 8.8 says. A penetration test is the most straightforward evidence there is, which is why almost every certified organization has one.
Not a certificate from us. Evidence that the controls in your Statement of Applicability are operating, that you find technical weaknesses, that you act on them, and that the loop closes. A penetration test provides all four if it is scoped to the ISMS and the remediation is documented afterwards.
The scope question is the one that catches people. A test of one application when the ISMS covers the whole organization is evidence about that application and nothing else. We scope from the Statement of Applicability and the ISMS boundary, and where something in that boundary is out of our reach we say so in the report rather than leaving a gap the auditor finds.
Scoped from your ISMS boundary and Statement of Applicability, with each finding mapped back to the Annex A control it touches.
Everything reachable from outside the organization.
The largest group of controls in the Annex, and the easiest to evidence badly.
Segregation, filtering and what actually crosses.
Secure development controls, measured against the running system.
Where the ISMS boundary now usually extends.
The reason the test is being bought.
Yours, not ours. The ISMS boundary decides what the test covers.
Mapped to the boundary, with anything unreachable flagged now rather than in the report.
Manually, against the boundary, outside and inside.
Each finding tied to the control it touches.
The part that satisfies clause 10.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows ISO/IEC 27001:2022 Annex A, ISO/IEC 27002:2022, OWASP Web Security Testing Guide and NIST SP 800-115, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our compliance and audit service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
Not in those words. There is no clause mandating one. Annex A 8.8 requires technical vulnerabilities to be identified and acted on, and clauses 9 and 10 require monitoring and improvement. A penetration test is the most straightforward way to evidence all three, which is why certified organizations almost always have one - but it is evidence for a control, not a requirement in itself.
Annually is the normal rhythm, and it is what most certification bodies expect to see across a three-year cycle. More useful than the interval is testing after significant change, because that is when new technical vulnerabilities actually appear.
It has to be representative of it, and the report has to be honest about what was and was not covered. A test of one application presented as evidence for an organization-wide ISMS is the gap auditors find most often.
We do readiness and gap work - see the compliance and audit page - but we are not a certification body and cannot certify you. Anyone offering both should be asked how they square the independence.
Yes. The control mapping in our report uses the 2022 Annex A structure, including the reorganised control numbers. If you are still transitioning from the 2013 version we will map to both.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.