When people first enquire about ISO 27001, the information security management system, they often have lots of questions about the impact it may have on their organisation, both positive and negative.
One question that regularly comes up is:
Do I need to do a Penetration Test to meet the requirements of ISO 27001?
Surprisingly the answer is no. But let’s look at what the standard actually says and why you might still need to do a pen test.
Penetration Testing & ISO 27001
Penetration Testing is not mentioned anywhere within the requirements of ISO 27001:2022 but if you look at the supporting standard ISO 27002:2022 you can find several references.
However, ISO 27002 is does not form part of the certification scheme and, therefore, it is not a mandatory requirement, so you may choose another way to address this.
ISO 27001:2022, 8.8 Management of Technical Vulnerabilities
Control 8.8, Management of Technical Vulnerabilities, requires organisations to obtain information about technical vulnerabilities and appropriate measures taken. A penetration test could satisfy this
The control also notes that pen tests should not be a replacement for risk assessments.
ISO 27001:2022, 5.21 Managing information security in the ICT supply chain & 8.16 Monitoring activities
Penetration testing is also referenced in the guidance for control 5.21, Managing information security in the ICT supply chain, as a way to monitor the ICT capabilities, including those of third parties.
The extend of penetration testing activities, and monitoring in general will depend on your risk profile and it should be recognised that some cloud services will not allow penetration testing to be performed, or will require prior notification.
Likewise, control 8.16, Monitoring Activities, Penetration testing is referenced as a tool that could be used. However there are many other, more effective ways to monitor Networks, Systems and Applications for anomalous behaviour including analysing event logs, implementing intruder detection systems and AI tools.
ISO 27001:2022, 8.25 Secure development life cycle & 8.29 Security testing in development and acceptance
Although not explicitly referenced in ISO 27001, Penetration Testing can be a valuable tool in the software development lifecycle to test applications and infrastructures again common vulnerabilities and human attacks.
Documenting this step in the process and retaining evidence of the results, and remediating actions is important.
Alternatives to Penetration Testing
While pen testing brings many benefits to your organisation, it can also be quite costly, depending on the scope of your project.
There are also many approaches to testing which some call black-box, white-box or grey-box, which generally refers to where in the network the test is run from and how much background knowledge the test has. More about Pen Testing.
Some alternative ways to test your technical network controls might include a web based port scan, vulnerability assessment or even the audit tools already built into your security appliance.
Providing you record and analyse the results of these scans, taking any required action, they can provide a basic level of security.
Other Reasons to Pen Test
Aside from it generally being good practice and an excellent way to manage risks in your network, you may be required to conduct a pen test for other reasons.
Cyber Essentials Plus is a scheme designed by the UK Government and a requirement of many public sector contracts. An explicit requirement of cyber essentials plus is to conduct a penetration test.
Clients may also mandate regular pen tests of a software product, particularly where it is hosting their data.
Conclusion
There’s no doubt, if you can pen test your controls then you should, but don’t let that be a barrier to achieving ISO 27001, which has many more organisational controls which can mitigate risks from human factors through to legal compliance.
Talk to our ISO 27001 Consultants about implementing a comprehensive information security management system.
Our cyber security team can also help you establish a threat management programme which includes penetration testing from our expert partners.
