As part of the ISO 27001 certification process, auditors are increasingly asking to see a penetration test report. But where does this requirement come from if the word pentest or penetration test does not exist in the text of ISO 27001?
ISO 27001 is the international standard for setting up and operating an ISMS (Information Security Management System). Appendix A of this standard contains control objectives for implementation. A more specific explanation of the individual controls can be found in the ISO 27002 standard, which corresponds in its document structure to the control objectives of Appendix A of ISO 27001.
In Appendix A of ISO 27001, section A.18.2 now contains the requirement to carry out “information security reviews”. The ISO27002 implementation guideline for this control includes performing vulnerability scans and/or penetration testing as a solution to fullfill this requirement.
