ISO 27001 Penetration Testing
Human-Led + AI
Penva Security delivers CREST-certified penetration testing engagements aligned to ISO/IEC 27001:2022, producing the evidence your certification body needs for Annex A controls A.8.8, A.8.29 and A.5.23.
Human-led exploitation combined with AI-accelerated coverage gives you broader scope, faster delivery, and a report your auditor will accept the first time, plus a free remediation retest within 60 days.
- Certified Testers
- Security Compliance
- Manual Pentesting
What Is ISO 27001 Penetration Testing?
For Australian organisations pursuing or maintaining certification, this means a single engagement that satisfies your ISMS evidence requirements, the technical vulnerability clauses of Annex A, and — where applicable — the cloud-service security control A.5.23.
What ISO/IEC 27001:2022 Expects
The three Annex A controls most directly satisfied by a penetration test, plus the operational expectations of an accredited certification audit.
Management of Technical Vulnerabilities
Security Testing in Development and Acceptance
Information Security for Use of Cloud Services
Monitoring, Measurement, Analysis and Evaluation
Nonconformity and Corrective Action
Threat Intelligence & Monitoring
Mapped Directly to the Requirements Your Auditor Will Sample
Each Penva engagement produces specific deliverables mapped to the Annex A controls and ISMS clauses your auditor will sample.
A.8.8 Management of Technical Vulnerabilities
Penetration test report with CVSS 3.1 severity, exploitability evidence, business-impact narrative and prioritised remediation. Mapped to OWASP and CWE references.
A.8.29 Security Testing in Development & Acceptance
A.5.23 Cloud Service Security
Clause 10.2 Corrective Action Evidence
Free remediation retest within 60 days with an updated report confirming closure. The single piece of evidence stage-2 auditors most often request.
CREST Attestation Tester Independence & Qualification
Get an Instant Penetration Testing Estimate
Answer a few scoping questions to get a practical estimate for web, API, mobile, infrastructure, and cloud penetration testing.
What type of penetration testing do you need?
Choose the main service you want quoted.
Edit option values
Use this table to assign a dollar value to each option. Open this panel with ?penvaPricing=1 at the end of the page URL.
For permanent changes, copy the pricing config and paste it into the PRICE_OVERRIDES section inside this Elementor HTML widget. Front-end prices are only used to display an estimate and should not be treated as a fixed quote.
ISO 27001 Penetration Testing - Common Questions
Direct answers to the questions Australian organisations ask most often. Updated May 2026.
ISO/IEC 27001:2022 does not name ‘penetration testing’ as a mandatory control, but Annex A controls A.8.8 (technical vulnerabilities) and A.8.29 (security testing in development) cannot be evidenced credibly without it. Accredited certification bodies routinely expect, and audit for, periodic penetration testing — particularly for organisations whose risk assessment identifies internet-facing applications or sensitive data processing. In practice, a CREST-certified pentest is the standard evidence.
At least annually, and after any significant change to your application, infrastructure or cloud environment. Surveillance audits in years 2 and 3 of your certification cycle will sample recent penetration test evidence. Organisations with frequent releases should test after major changes or run continuous testing through a Pay-As-You-Go arrangement.
Primarily A.8.8 (Management of technical vulnerabilities) and A.8.29 (Security testing in development and acceptance). A.5.23 (Information security for use of cloud services) is also commonly evidenced through cloud-configuration testing. ISMS clauses 9.1 (monitoring and measurement) and 10.2 (corrective action) are satisfied through pentest findings and the documented remediation retest.
ISO/IEC 27001:2022 restructured Annex A from 114 to 93 controls and introduced eleven new ones, including A.5.23 (Cloud services), A.5.30 (ICT readiness for business continuity) and A.8.28 (Secure coding). For penetration testing, the change is mostly clarifying: the new control numbering (A.8.8, A.8.29) maps to the older A.12.6.1 and A.14.2.8 from 2013. The transition deadline was 31 October 2025, so all current certifications are now against the 2022 version.
Yes. Penva reports follow CREST methodology and are formatted to satisfy JAS-ANZ-accredited certification bodies operating in Australia. Every report includes executive summary, scope, methodology statement, CVSS 3.1 severity ratings, evidence, remediation guidance and a signed letter of attestation. We have not had a report rejected by a certification auditor.
Most ISO 27001 engagements run 5 to 10 business days of active testing, plus 1 to 2 days for reporting. Smaller scopes can complete in under a week. Penva delivers findings progressively in a shared tracker so your remediation can start during the engagement — useful when your stage-2 audit is on a fixed date.
Yes. Every fixed-price engagement includes one free remediation retest within 60 days. After your developers ship fixes, we re-validate each finding and issue an updated report confirming closure — the documented evidence ISO auditors look for under clause 10.2 (corrective action).