No, the SOC 2 criteria do not explicitly require a penetration test. They require that you detect vulnerabilities and evaluate your controls on an ongoing basis. A pen test is one common way to show that, and many auditors and customers expect to see one, so ask your auditor early.
What the criteria actually say
The criteria state outcomes, not tools. CC7 covers system operations, including detecting configuration changes that introduce vulnerabilities and finding newly discovered ones. CC4 covers monitoring, meaning ongoing and separate evaluations of your controls. Neither names a specific test.
One audit firm explains it this way: vulnerability scanning is a point of focus that supports CC7.1, and penetration testing supports CC4.1 as a separate evaluation. Neither is mandated by name. The same source adds that a report reader may find a clean report hard to accept if there is no scanning evidence at all.
Scan versus pen test
A vulnerability scan is automated. It runs against hosts, containers or code and lists known weaknesses. It is usually continuous or scheduled.
A penetration test uses people, with tools, to try to exploit weaknesses and chain them together. It is a point in time exercise with a report at the end.
They answer different questions. The scan says what is known and unpatched. The pen test says what an attacker could actually do.
What to do in practice
Treat the auditor as the decision maker. Ask three things before your observation period or audit date:
- Do you expect a third party penetration test in the period?
- Do you expect scan results, and how often?
- What evidence of remediation do you want to see?
Then pick a cadence you can keep. A common small team pattern is automated scanning on every build or weekly, plus one external pen test a year, plus a ticket for every finding with a due date and a closing note.
If you serve customers through a public web application, the audit firm cited above recommends a pen test, with scope and frequency set by your risk assessment. That is a sensible default for most SaaS teams.
Make the evidence easy to read
Auditors test what you wrote down. Keep a short vulnerability management procedure that states how often you scan, what severity gets fixed in what time, and who approves exceptions. Then keep the proof: scan exports with dates, tickets, and the pen test report with your responses.
Do not hide findings. A pen test that found issues you fixed and retested is better evidence than a report with nothing in it. For retest evidence see pen test retest evidence for SOC 2 and questionnaires.
Safeguard offers SBOM and dependency scanning, reachability analysis and a free scan that can supply dated scan evidence for the dependency side. It does not replace a human led pen test.
Quick check
Can we skip the pen test if we scan every week?
Possibly, but the auditor decides what is enough for your scope. Ask before the period starts, and document your reasoning.
Does the pen test have to be done by an outside firm?
The criteria do not say. Buyers usually value independence, so an outside tester is the safer choice for customer facing systems.
Sources
- Vulnerability assessment vs penetration testing for SOC 2 audits
- SOC 2 Trust Services Criteria overview
Last reviewed: 19 October 2026.
