SOC 2 penetration testing for your audit evidence
SOC 2 does not require a penetration test, but auditors commonly look for regular, independent vulnerability testing as evidence under its security criteria, and your auditor decides what counts. BERRY9 tests your applications, APIs and networks by hand from Hyderabad and hands you an executive report, an engineering report with a proof of concept and a CVSS 3.1 score for each finding, and a remediation matrix that shows the fixes.
- Tests start from
- INR 27,000 + 18% GST
- Severity
- CVSS 3.1 per finding
- SOC 2 report
- Issued by your CPA firm
- Delivery
- Remote from Hyderabad
Last reviewed
Executive report: the scope, the findings and the business risk, written for management and for your auditor.
Engineering report: reproduction steps, a proof of concept and a fix for each finding.
CVSS 3.1 severity scored against your own systems and data, not a generic scale.
Remediation matrix: every finding beside its fix, ready to track to closure.
01 / What SOC 2 expects
Does SOC 2 require a penetration test?
Whether a test is needed, and what it should cover, comes down to the evidence your auditor looks for and the systems your report covers.
A report only your auditor can issue
SOC 2 is an examination of a service organization's controls against the Trust Services Criteria, which are published by the AICPA, the American Institute of Certified Public Accountants. A SOC 2 report is issued by a licensed CPA firm after it examines your controls. A testing firm only supplies evidence: it cannot issue the report or shape the opinion, and that includes BERRY9.
Security is in every SOC 2
The security criteria, often called the common criteria, apply to every SOC 2 examination. Availability, processing integrity, confidentiality and privacy are added only when you choose to include them. Penetration test evidence speaks mainly to the security criteria.
Type 1 and Type 2
A Type 1 report looks at whether controls are suitably designed at a point in time. A Type 2 report also looks at whether they operated effectively over a period, so the date of your test relative to that period matters.
Auditors look at fixes too
For a Type 2, auditors commonly look for a test dated within the period, evidence that the findings were fixed, and a retest or a documented risk acceptance for anything still open.
Send us your auditor's requirement or evidence request before we scope the test, so the proposal answers it.
02 / Evidence map
What a BERRY9 test gives your auditor
The criteria auditors commonly connect with testing sit in the monitoring activities (CC4) and system operations (CC7) families of the security criteria, with logical access (CC6) close behind. The map pairs each area with the part of a BERRY9 report that speaks to it. It is a planning aid, not a promise: your auditor decides what is accepted.
| Criteria area | What the criterion asks for | What the BERRY9 report supplies |
|---|---|---|
| CC4.1 Ongoing and separate evaluations | Evaluations that show whether the components of internal control are present and functioning | An independent, manual test of the systems in scope, with the scope and the five-phase method set out in the report |
| CC4.2 Communicating deficiencies | Deficiencies evaluated and communicated in time to the people responsible for corrective action | A remediation matrix pairing each finding with its fix, and an engineering report your developers can act on |
| CC7.1 Detecting new vulnerabilities | Procedures that identify configuration changes that introduce vulnerabilities, and susceptibility to newly discovered ones | Each confirmed finding with a proof of concept and a CVSS 3.1 severity scored against your environment |
| CC6.1 and CC6.6 Logical access and the system boundary | Logical access security, and protection against threats from outside the system boundary | Findings on sign-in, sessions, roles, tenant separation and exposed services, from the web, API, cloud or network tests in scope |
| CC3.2 Identifying risks | Risks to the entity's objectives identified and analyzed | An executive report that explains what each finding means for the business, for management to weigh |
Criteria references follow the AICPA's 2017 Trust Services Criteria (with revised points of focus, 2022). Check which version your auditor works from.
03 / Scoping
Agree the scope with your auditor first
A test that misses a system your auditor treats as in scope may have to be run again, and the audit period will not wait. Settle these points with your auditor, and then with us, before any testing starts.
Show details for Agree the scope with your auditor first
- The system boundary. Which applications, APIs, cloud accounts and networks fall inside the system your SOC 2 report describes, and which sit outside it.
- Report type and period. Type 1 or Type 2, and for a Type 2 the first and last dates of the audit period, so the test falls where your auditor expects to find it.
- The auditor's request, in writing. Any evidence request list, required report content or expected kind of test, shared with us before scoping.
- Roles, tenants and environments. Which roles and tenants to test as, and whether production, staging or both are in scope; these also set the price.
- Earlier findings. Results of any previous test, so open items are checked again.
- Who signs off. Who approves the rules of engagement in writing, including what testing must not touch.
Where the testing sits in your audit calendar:
Before the period
Readiness test
Shows what to fix while there is still time, before the audit clock starts.
OutputFindings and a remediation matrix
Inside the period
Evidence test
A test that falls inside the audit period, which is what a Type 2 auditor commonly asks to see.
OutputExecutive and engineering reports
After the fixes
Retest
Fixed findings are checked again, on the retest terms in your proposal, so the evidence shows each issue found, fixed and confirmed.
OutputRetest results for the auditor
04 / Which tests
Which tests belong in a SOC 2 scope
SOC 2 does not prescribe which systems to test; the system description in your report and your auditor's view of risk do. For a SaaS product that usually points to the application customers sign in to, the APIs behind it and the cloud it runs on.
Show details for Which tests belong in a SOC 2 scope
Web application
The product your customers sign in to. Tested under each role and tenant, to show whether access rules hold where customer data lives.
APIs
The interfaces your front end, mobile app and partner integrations call. Every endpoint is tried as every role you give us.
Cloud accounts
Where the product runs: identity and access management, security groups, peering and the network around your workloads on AWS, Azure or GCP.
Networks
Office and data-center networks, VPN gateways and any host inside the system boundary that an outsider or insider could reach.
Active Directory
If staff sign in through a Windows domain, the directory decides who can reach production. An internal test shows how far an ordinary account can climb.
ISO 27001 as well
ISO/IEC 27001 also expects technical vulnerabilities to be managed (Annex A 8.8), so the same test report can support both programs, if both auditors agree the scope.
Each test follows the five phases on our VAPT methodology page, and the sample VAPT report shows how the findings are laid out for an auditor to read.
05 / Deliverables
What you get from a SOC 2 penetration test
All five items below come with every BERRY9 test. All are written for two readers at once: your engineers, who fix the findings, and your auditor, who reviews the evidence that they were found and fixed.
Show details for What you get from a SOC 2 penetration test
- An executive report for management and your auditor: what was in scope, what was found and how serious it is for the business.
- An engineering report with the steps to reproduce each finding, a proof of concept and the fix.
- Severity scored with CVSS 3.1, adjusted to your environment rather than left at a default score.
- A remediation matrix listing every finding beside its fix: the record your team updates as items close.
- Retest terms, as set out in the price section of this page.
SOC 2 is an attestation, not a certification, and the SOC 2 report comes only from your CPA firm. BERRY9 does not audit, attest or certify: what we hand over is test evidence for that examination.
06 / Who it fits
Who SOC 2 testing from BERRY9 fits
The fit is strongest where the push for a test comes from customers and auditors rather than from an Indian regulator. Where a regulator or a tender names its own kind of auditor, the answer changes, and you should hear that before any money changes hands.
Show details for Who SOC 2 testing from BERRY9 fits
SaaS companies selling abroad
Indian SaaS firms whose US and enterprise customers ask for a SOC 2 report, and who need the penetration test behind it.
Startups heading into a first audit
Teams preparing for a first Type 1 or Type 2 who want a readiness test early enough to fix what it finds before the audit period opens.
GCC suppliers and IT services firms
Vendors to global capability centers (GCCs) and enterprise clients whose supplier reviews and security questionnaires ask for recent, independent test evidence.
Not a fit: when a CERT-In empanelled auditor is required. If a regulator, a tender or a contract requires a CERT-In empanelled auditor, as SEBI does for its regulated entities under its Cybersecurity and Cyber Resilience Framework and as some government tenders do, BERRY9 is not that firm. We are not CERT-In empanelled, and we say so before you pay. BERRY9 can introduce a CERT-In empanelled auditor when a buyer needs one.
SOC 2 testing is delivered remotely from our one office in Hyderabad, wherever in India your team sits, with on-site work by arrangement. Beyond SOC 2 work, the full list of tests sits on our offensive security services page.
07 / Price
What a SOC 2 penetration test costs
A SOC 2 penetration test with BERRY9 starts from INR 27,000 + 18% GST. That is a starting price, and larger scopes cost more: the figure for yours comes in a written proposal after scoping, once the systems, roles and environments in scope are known.
SOC 2 penetration test
Starts fromINR 27,000 + 18% GST
Starting price for a manual test of the applications, APIs, cloud or network inside your SOC 2 boundary. The final price depends on the number of roles, endpoints, hosts and environments in scope.
- Executive and engineering reports
- Proof of concept and CVSS 3.1 severity per finding
- Remediation matrix
What sets the figure
Priced byScope
Three things move the figure for a SOC 2 test:
- Systems inside the SOC 2 boundary
- Roles and tenants those systems serve
- Environments your auditor expects tested
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
Our VAPT cost guide for India sets out each price factor and what other vendors publish.
08 / Inquiry
Send us your SOC 2 scope and audit dates
Tell us which systems sit inside your SOC 2 boundary, whether you are working toward a Type 1 or a Type 2, when the audit period runs and what your auditor has asked for. The written proposal then sets out the scope and timeline.
To talk it through first, call +91 86868 92922 or write to contact@berry9.com.
09 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Does SOC 2 require penetration testing?
SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough. Auditors commonly look for a recent independent penetration test as evidence under the security criteria, so it is worth asking your auditor early whether they expect one. See the section on Does SOC 2 require a penetration test? above.
Is SOC 2 mandatory in India?
No Indian law requires a SOC 2 report. SOC 2 is a voluntary attestation under AICPA standards; the push for one usually comes from customers, especially US and enterprise buyers who ask their vendors for one during procurement.
Do I need a CERT-In empanelled auditor for SOC 2?
Not for SOC 2 itself. The SOC 2 criteria are the AICPA's and say nothing about CERT-In. A CERT-In empanelled auditor becomes necessary when a regulator, a tender or a contract requires one, as SEBI's cybersecurity framework does for the entities it regulates. BERRY9 is not CERT-In empanelled; if your requirement names one, we tell you before you pay. See the section on Who SOC 2 testing from BERRY9 fits above.
Will my auditor accept your report?
Your auditor decides, and no testing firm can promise their answer. What helps is sending us their requirement before scoping, so the test covers the systems and the period they expect and the report sets out scope, method, findings and fixes for them to review. See the section on What a BERRY9 test gives your auditor above.
Do you issue a SOC 2 report?
No. BERRY9 does not audit, attest or certify. SOC 2 reports are issued only by licensed CPA firms after they examine your controls; our penetration test report is one piece of the evidence you give them.
How often should we run a penetration test for SOC 2?
The criteria call for regular evaluation and for finding new vulnerabilities, but they set no fixed interval. Agree the frequency with your auditor and your own risk assessment, and ask again when a significant change, such as a new product or cloud environment, enters the system boundary.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report gives the auditor's opinion on whether controls are suitably designed at a single point in time. A Type 2 report adds whether those controls operated effectively across a period, which is why the timing of a penetration test matters more for a Type 2.
How much does a SOC 2 penetration test cost?
With BERRY9, a SOC 2 penetration test starts from INR 27,000 + 18% GST. The number of roles, endpoints, hosts and environments in scope sets the final figure, which comes in a written proposal after scoping; our VAPT cost guide explains what moves it. See the section on What a SOC 2 penetration test costs above.
Can you test before the audit period starts?
Yes. A readiness test before the period gives your team time to fix what it finds. Whether that test also counts as evidence for the period is your auditor's decision; for a Type 2 they commonly look for testing within the period, so check before you set dates. See the section on Agree the scope with your auditor first above.
Can you run a SOC 2 test for a team in Bangalore or Chennai?
Yes. Tests run remotely from BERRY9's one office, in Hyderabad, for companies anywhere in India; internal systems are reached through access agreed at scoping, and on-site work can be arranged.