ISO 27001 never uses the words “penetration test”, but Annex A 8.8 and 8.29 make one the evidence auditors expect. Here’s what that means in practice.
Tag:
audit
-
-
SOC 2 never uses the words “penetration test” but most auditors expect one anyway. Here is what CC4.1 actually requires, how often to test, and what a Type II audit …