👋 Hello, team!

Fatih K. · 2026-10-20T13:57:28.372Z

👋 Hello, team! Providing a Pentest report from the last 12 months is a must for passing SOC2 Type 1 audit?

3 comments

· Sorted by Oldest

Kareem M.
·
·
Hi Faith, pleasure to meet you. My name is Kareem, I'm the GRC Education program manager here at Vanta. As to your question: Not necessarily. SOC 2 does not impose a blanket requirement that every organization provide a penetration test report from the last 12 months. A SOC 2 Type 1 audit assesses whether your controls are suitably designed and implemented as of a specific date. If your control requires annual penetration testing, a completed test within the preceding 12 months would generally support that control, provided it covers the relevant systems. The auditor may also review how you addressed the findings. For Type 2, the auditor also evaluates whether controls operated effectively throughout the audit period. One penetration test may be sufficient for an annual control, but that depends on its timing, scope, and the exact control requirements. Confirm the evidence expectations with your auditor before assuming that one report will be sufficient. If you have any other questions, please join me tomorrow at 1:00 est for my monthly GRC Office hours.
Adarsh k.
·
(edited)·
Hey Fatih K., Short answer: No for SOC 2 Type I. Yes for Type II. You generally need a penetration test for Type II. However on a separate note-- this can vary from one auditor/ CPA firm to another. Some auditors expect the pentest to be conducted during the observation period, even if your policy defines the frequency as annual. In such cases, they may include a note in the SOC 2 report stating that the control did not occur during the observation period. Honestly, I find this approach a bit absurd. If the policy clearly defines the control frequency as annual and the test isn't due during the observation period, I don't think it should automatically be treated as a missed control... so plz align with your auditor also .. dm me for any queries you have. Happy to assist
Fatih K.
·
·
Thank you for the responses. You are right if it is stated in the policy and if the observation period does not cover the time period of the test, they should care the reality and if it is planned.
💜1

Kareem M.
·
·
Hi Faith, pleasure to meet you. My name is Kareem, I'm the GRC Education program manager here at Vanta. As to your question: Not necessarily. SOC 2 does not impose a blanket requirement that every organization provide a penetration test report from the last 12 months. A SOC 2 Type 1 audit assesses whether your controls are suitably designed and implemented as of a specific date. If your control requires annual penetration testing, a completed test within the preceding 12 months would generally support that control, provided it covers the relevant systems. The auditor may also review how you addressed the findings. For Type 2, the auditor also evaluates whether controls operated effectively throughout the audit period. One penetration test may be sufficient for an annual control, but that depends on its timing, scope, and the exact control requirements. Confirm the evidence expectations with your auditor before assuming that one report will be sufficient. If you have any other questions, please join me tomorrow at 1:00 est for my monthly GRC Office hours.
Adarsh k.
·
(edited)·
Hey Fatih K., Short answer: No for SOC 2 Type I. Yes for Type II. You generally need a penetration test for Type II. However on a separate note-- this can vary from one auditor/ CPA firm to another. Some auditors expect the pentest to be conducted during the observation period, even if your policy defines the frequency as annual. In such cases, they may include a note in the SOC 2 report stating that the control did not occur during the observation period. Honestly, I find this approach a bit absurd. If the policy clearly defines the control frequency as annual and the test isn't due during the observation period, I don't think it should automatically be treated as a missed control... so plz align with your auditor also .. dm me for any queries you have. Happy to assist
Fatih K.
·
·
Thank you for the responses. You are right if it is stated in the policy and if the observation period does not cover the time period of the test, they should care the reality and if it is planned.
💜1