Pentest evidence for ISO 27001.On every release.

The standard requires managed vulnerabilities and security testing, not a named pentest. Certification auditors expect a penetration test as the evidence, and most want it repeated at least annually and after significant change.

Certification bodies assess the evidence, not the tool. A report showing scope, method, validated findings with proof, and verified fixes is what they look for, and Parameter's report contains all of it. Confirm with your auditor ahead of the audit; we can share a sample.

A.8.8 wants vulnerabilities identified, evaluated, and acted on as a repeated process. A run on every release, with each finding tracked to a verified fix, is that process made visible.

Now. Evidence of a working vulnerability process during implementation helps the Stage 2 audit, and first findings land within 24 hours of connecting.

No. A scan lists possible weaknesses; a penetration test proves them. Every Parameter finding ships with a working exploit and reproduction steps, and the report states scope and method. The same report maps to SOC 2 CC7.1 and CC4.1, so it serves both audits.

Manual engagements quoted on the market run from about $6,000 to $25,000 a year. Parameter is one annual contract scoped to the environment covered, and it tests every release, so the cost per test falls the more you ship.

No. Parameter holds a SOC 2 Type I report with Type II underway. Status is on the trust center.