ISO 27001 Penetration Testing in Australia: Is It Required and What Auditors Expect

ISO 27001 doesn't name penetration testing as a mandatory requirement, but in practice most Australian organisations seeking or keeping certification need one: Annex A control 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance) expect you to find and fix exploitable weaknesses, and ISO/IEC 27002 guidance recommends periodic, documented penetration tests. Auditors look for evidence that testing happened, matched your risk assessment and led to remediation. At Aussie Pentest, human-led penetration testing starts from $5,000 + GST, and every report maps findings to ISO 27001 control themes.

This guide covers what the standard actually says, what a certification auditor wants to see, how to scope a pentest that supports your Statement of Applicability, what it costs in Australia, and how ISO 27001 testing overlaps with SOC 2, Essential Eight and the Privacy Act. If you're still deciding between frameworks, start with Essential Eight vs ISO 27001.

Does ISO 27001 require penetration testing?

Not by name, but the controls you'll almost certainly declare applicable can't be properly evidenced without technical testing. ISO/IEC 27001:2022 sets out requirements for an information security management system (ISMS) and an Annex A list of 93 reference controls. You compare your risk treatment against Annex A and record each control as included or excluded, with justification, in your Statement of Applicability (SoA).

In Australia the standard is published by Standards Australia as AS/NZS ISO/IEC 27001:2023, an identical adoption of ISO/IEC 27001:2022. So the requirements are the same whether your auditor quotes the international or the Australian designation.

The Annex A controls that point to testing

▸8.8 Management of technical vulnerabilities: get information about technical vulnerabilities, evaluate your exposure and take appropriate action. ISO/IEC 27002:2022, the implementation guidance, recommends planned, documented and repeatable penetration testing by competent, authorised people, either internal staff or an independent third party, alongside scanning and patch management.
▸8.29 Security testing in development and acceptance: define and run security testing during development and before systems go live. For SaaS businesses this usually means web application and API testing before major releases.
▸5.35 Independent review of information security: your approach to information security should be reviewed independently at planned intervals or after significant change. A third-party pentest isn't a full independent review, but it's strong supporting evidence.
▸8.34 Protection of information systems during audit testing: tests on operational systems need to be planned and agreed so they don't disrupt the business. That is exactly what written rules of engagement are for.

Why "not mandatory" is the wrong takeaway

If you exclude 8.8 or 8.29 from your SoA, you have to justify why, and for an organisation running internet-facing systems that justification is very hard to defend. Once the controls are in scope, the auditor will ask how you know they work. A vulnerability scanner shows that you look for known issues. A penetration test shows whether those issues, and the ones scanners miss, can actually be exploited.

What do ISO 27001 auditors look for in a pentest?

Auditors want evidence that testing was risk-driven, properly scoped, performed by competent people, and that findings flowed into your risk treatment and corrective action process. A glossy report on its own isn't enough.

Typical evidence requests include:

Scope and rationale: why these systems were tested, linked to your risk assessment and ISMS scope
Tester competence and independence: who performed the test and how conflicts of interest were managed
Rules of engagement: authorisation, testing windows and safeguards for production (control 8.34)
The report: severity-ranked findings, evidence and remediation guidance
Risk treatment: findings logged in your risk register or corrective action log with owners and dates
Remediation proof: retest results or change records showing fixes were verified
Cadence: a defined frequency, plus testing after significant change

Certification bodies and the audit cycle

ISO itself doesn't certify organisations. In Australia, certification is issued by certification bodies accredited for ISO/IEC 27001, which you can check on the JAS-ANZ register. Certification usually runs on a three-year cycle: Stage 1 and Stage 2 audits, then annual surveillance audits, then recertification. Each surveillance audit is a chance for the auditor to ask what testing you've done since last year, so one test before Stage 2 and nothing after is a common gap.

The 2013-to-2022 transition is over

Under the International Accreditation Forum's IAF MD 26, every certificate issued against ISO/IEC 27001:2013 had to move to the 2022 edition by 31 October 2025, or expire or be withdrawn. If a customer or tender asks for your certificate, it should name ISO/IEC 27001:2022. Testing evidence should reference the 2022 control numbers (8.8, 8.29), not the old 12.6.1 and 14.2.8 references.

What should an ISO 27001 penetration test cover?

Scope should follow your ISMS scope and risk assessment, not a generic template. If your certificate covers a SaaS platform and its supporting cloud environment, testing a head office printer network won't impress anyone. Testing the application, its APIs and the cloud identity layer will.

Common scope areas for Australian organisations

▸External network: internet-facing IPs, VPNs, remote access and exposed services
▸Web applications and APIs: authentication, access control, business logic and the OWASP Top 10 categories, which supports 8.29 and 8.28 secure coding
▸Cloud environments: AWS, Azure, GCP and Microsoft 365 misconfigurations, over-privileged identities and exposed secrets
▸Internal network and Active Directory: lateral movement, privilege escalation and credential exposure if the ISMS covers corporate IT
▸Social engineering: phishing simulations where people risk is a material part of your risk assessment

For deeper dives, see web application penetration testing and cloud penetration testing in Australia.

Black, grey or white box?

For ISO 27001 purposes, grey-box testing (where the tester gets user accounts or limited documentation) usually gives the best evidence per dollar. It shows what an authenticated user or a compromised account can reach, which is where many real breaches escalate. Our guide to black, grey and white box testing explains the trade-offs.

How often should you pentest for ISO 27001?

At least annually for in-scope, internet-facing systems, and after significant changes, unless your risk assessment justifies a different cadence. The standard doesn't set a frequency. You do, and then you're audited against what you set.

Practical triggers for an extra test:

▸A major application release, new authentication flow or new API
▸Migrating to a new cloud platform or tenant
▸Mergers, acquisitions or new subsidiaries joining the ISMS scope
▸A significant security incident or near miss
▸Material changes to your MSP or hosting arrangements

Write the cadence into your vulnerability management procedure, then follow it. An auditor will forgive a modest cadence that's justified and followed far more readily than an ambitious one that's ignored. More detail is in how often you should get a penetration test.

Is a vulnerability scan enough for ISO 27001?

A scan supports control 8.8, but it rarely satisfies an auditor on its own for internet-facing or customer-facing systems. Scanning identifies known vulnerabilities at scale and should run continuously. Penetration testing proves exploitability, chains weaknesses together and tests logic flaws scanners can't see, such as one customer viewing another customer's data.

The honest answer is that you need both, at different frequencies:

Activity	What it evidences	Typical cadence
Automated vulnerability scanning	Known vulnerabilities identified and tracked (8.8)	Weekly to monthly, and after changes
Analyst-reviewed automated assessment	Validated findings with human review, faster and cheaper	Quarterly or before releases
Human-led penetration test	Exploitability, chained attacks, business logic (8.8, 8.29)	Annually and after significant change

Our automated security assessment ($80 to $2,000 AUD, analyst-reviewed, 24 to 72 hour SLA) is useful between tests, but it is not a penetration test and we don't sell it as one. See vulnerability assessment vs penetration testing for the full comparison.

How much does ISO 27001 penetration testing cost in Australia?

At Aussie Pentest, fixed-fee human-led engagements start from $5,000 + GST, with most ISO 27001 scopes landing in the Standard or Advanced tiers. Pricing depends on how many IPs, applications, APIs and cloud environments sit inside your ISMS scope. All tiers include a written scope document, a severity-ranked report and proof-of-concept evidence on every critical finding.

Tier	Starting price	Typical ISO 27001 fit
Basic	From $5,000 + GST	External network up to 25 IPs, small web apps; narrow ISMS scopes
Standard	From $12,000 + GST	External and internal network, up to 50 IPs and 2 to 3 web apps, debrief included
Advanced	From $20,000 + GST	Full scale: external and internal, web apps and APIs, social engineering

Engagements are typically delivered in 5 to 10 business days. Every report includes an executive summary, risk-ranked findings, remediation guidance and compliance mapping to ISO 27001, Essential Eight and SOC 2 control themes. Full details are on the pricing page.

What drives the price up or down

▸Number of applications and roles: each user role multiplies access-control testing
▸API surface: documented APIs are faster to test than undocumented ones
▸Cloud complexity: multiple accounts, subscriptions or tenants add effort
▸Internal scope: Active Directory and internal network testing add days
▸Retesting needs: tight certification deadlines may need a quick verification round

Not sure where your ISMS scope lands? Book a 1-on-1 scoping call and we'll give you a fixed-fee quote before anything starts.

How does ISO 27001 testing overlap with SOC 2, Essential Eight and the Privacy Act?

One well-scoped test can support several frameworks at once, as long as the report maps findings to each and the scope covers what each framework cares about. Most Australian organisations pursuing ISO 27001 also face at least one of these.

SOC 2

The AICPA's Trust Services Criteria don't make penetration testing mandatory either. Under CC4.1 (monitoring activities), penetration testing is listed among the types of evaluation management may use. If your SOC 2 system description commits to annual testing, your service auditor will test that commitment. Australian SaaS companies selling into the US often need both ISO 27001 and SOC 2, and the same pentest can serve both.

Essential Eight

ASD's Essential Eight is a technical maturity model, not a management system. ISO 27001 tells you to manage risk; Essential Eight tells you which baseline controls stop the most common attacks. A pentest tests real attack paths; an Essential Eight assessment ($4,950 + GST for up to 50 seats) measures maturity across all eight controls. Many SMBs do the Essential Eight assessment first and use ISO 27001 as the governance wrapper later.

Privacy Act and the NDB scheme

Under Australian Privacy Principle 11, organisations covered by the Privacy Act must take reasonable steps to protect personal information. The OAIC's Guide to securing personal information says ICT systems should be tested regularly once operational, and suggests considering penetration or vulnerability testing to discover security weaknesses. More in our guide to Privacy Act cyber security requirements.

APRA CPS 234

APRA-regulated entities and their material service providers have their own testing expectations under CPS 234. ISO 27001 certification doesn't replace them, though the same evidence often helps. See CPS 234 penetration testing.

Why does this matter for Australian businesses right now?

Because customers, insurers and regulators are asking harder questions, and breach numbers keep climbing. An ISO 27001 certificate increasingly sits in tender packs and vendor questionnaires, and buyers then ask the follow-up: "When was your last penetration test, and what did you fix?"

Verified Australian context:

▸The OAIC received 1,205 data breach notifications in calendar year 2025, the highest since the Notifiable Data Breaches scheme began in 2018 and 8% more than 2024. Malicious or criminal attacks caused 716 of them.
▸ASD's Annual Cyber Threat Report 2024–25 recorded over 84,700 cybercrime reports (about one every six minutes). The average self-reported cost of cybercrime per report was $56,600 for small businesses and $97,200 for medium businesses.

Across engagements we keep seeing one pattern: certified organisations with well-written policies but untested controls. The access-control policy says users only see their own data; the API says otherwise. Finding that in a pentest is cheap. Finding it in a breach notification is not.

How do you prepare for an ISO 27001 penetration test?

Line up scope, access and remediation capacity before testing starts, so the report lands in time to fix findings before your audit. A rushed test two weeks before Stage 2 leaves no time to remediate or retest.

Confirm the ISMS scope and pick the systems that carry the most risk
Book testing 6 to 8 weeks before the audit so there's time to remediate and verify
Prepare test accounts for each user role, plus API documentation if you have it
Agree rules of engagement: testing windows, out-of-bounds systems and emergency contacts
Brief your MSP or hosting provider so alerts aren't treated as a real incident
Reserve engineering time for fixes straight after the report lands
Log findings in your risk register with owners, target dates and treatment decisions

Our preparation checklist goes deeper, and what a penetration testing report includes shows what you'll get back.

If you want ongoing help running the ISMS between audits, including the risk register, board reporting and testing cadence, a vCISO retainer runs from $2,500 to $6,500 a month. It's advisory and oversight, not implementation and not incident response. MSPs supporting clients through certification can also resell testing under their own brand through our white-label program.

Frequently asked questions

Can our internal IT team do the ISO 27001 pentest?

ISO/IEC 27002 guidance allows testing by competent internal staff or an independent third party. In practice, auditors and customers give more weight to independent testing, especially when the internal team also built and runs the systems being tested.

Will an ISO 27001 auditor reject a pentest report?

Auditors don't usually reject a report outright. They raise nonconformities or observations when scope doesn't match the ISMS, findings weren't tracked, or remediation wasn't verified. The report is only one piece of evidence; the follow-through matters as much.

Do we need to fix every finding before certification?

No. You need to treat findings according to your risk process. That can mean fixing, mitigating, transferring or formally accepting a risk with justification. Critical and high findings left untreated without a documented decision will draw attention.

Does one pentest cover both ISO 27001 and SOC 2?

Often, yes, if the scope covers the systems in both your ISMS and your SOC 2 system description, and the report maps findings to both. Confirm with your auditors early so the scope matches what each will examine.

Is an automated scan acceptable for surveillance audits?

Scans are good evidence of ongoing vulnerability management under control 8.8. For internet-facing applications and significant changes, most auditors still expect periodic human-led testing. Use both, at the cadence your risk assessment sets.

Bottom line

ISO 27001 won't hand you a clause that says "do a penetration test", but controls 8.8 and 8.29, the ISO/IEC 27002 guidance and your auditor's questions all lead to the same place. Scope the test to your ISMS, run it early enough to fix what it finds, log findings in your risk process and verify the fixes. Done properly, one engagement can support ISO 27001, SOC 2, Essential Eight and Privacy Act obligations together. Aussie Pentest engagements start from $5,000 + GST, with fixed fees, written scope and ISO 27001 mapping in every report.

Ready to scope your test? Book a 1-on-1 call, or review our penetration testing services and pricing.

Sources

This article is general information only, not legal, audit or compliance advice. Aussie Pentest is not an ISO 27001 certification body, and a penetration test supports your certification evidence but doesn't guarantee an audit outcome. Prices are current as of October 2026, and statistics and standards references were checked in October 2026. Check your own situation with your certification body or a qualified adviser, and only test systems you have written authority to assess.