Penetration testing and ISO 27001: what a test can and cannot show

ISO/IEC 27001 asks an organisation to run an information security management system. It includes controls on managing technical vulnerabilities and on testing security. A penetration test supports these, but it is evidence, not certification.

What a test can show an auditor

• That you checked a defined scope independently.
• What was found, how serious it was, and when.
• That findings were fixed and tested again.

What it cannot show

• That the whole management system works.
• That other systems outside the scope are safe.
• Compliance on its own. Certification is decided by the certification body, not by the tester.

Using it well

Keep the report, the fix records and the re-test results together, and link them to your risk assessment. An auditor is usually more interested in the process of finding and fixing than in a clean report.