Carrying Out an ISO 27001 Pentest

Information security is a continuous process, not a one-off effort. Organizations need to constantly stay in control of their security measures in order to minimize risks. An essential part of this is security monitoring, including vulnerability scanning and penetration testing (pentesting). In this article, we discuss how pentesting fits within the ISO 27001 standard and what requirements it meets.

Staying in control of information security

ISO 27001 is an internationally recognized standard for information security. This standard offers a systematic approach to protecting information and safeguards the confidentiality, availability and integrity of data within an organization.

The ISO 27001 standard and pentesting

Within the standard, pentesting is often deployed as part of risk management and continuous improvement processes. The role of the pentest is to identify risks and implement appropriate security measures based on these risks. Although pentesting isn't mandatory under ISO 27001, it can contribute to organizations proactively working on exposing vulnerabilities within software and systems.

Vulnerability Scanning within ISO 27001

Besides an in-depth penetration test, vulnerability scanning can also add value for your digital resilience. Vulnerability scanning can also help safeguard a continuous improvement process. The advantage is that, with most tooling, it provides continuous insight into vulnerabilities within software and systems, whereas pentesting has more of a "snapshot in time" character.

Still, pentesting goes a step further than vulnerability scanning. Where a scan only identifies known vulnerabilities, a pentest actually tests how a malicious actor could exploit these vulnerabilities. During a pentest, the actual business impact of the vulnerabilities becomes far clearer.

Hacking as a Service

Tozetta's goal is to continuously expose vulnerabilities within software and systems, including for parties that are working toward or already hold ISO 27001 certification. Tozetta facilitates continuous insight into vulnerabilities to improve digital resilience.

Tozetta Reports Vulnerability Portal

Within Tozetta Reports, the results of a pentest and the results of the vulnerability scanner are shown in a single environment. Tozetta offers the possibility to interactively work on the vulnerabilities found, and to request feedback and/or a re-scan of the vulnerabilities found during the improvement process.

Vulnerability Scanner

Within Tozetta Reports, Tozetta uses Guardian360's vulnerability scanners. This Dutch tooling scans daily for vulnerabilities within your internal network and/or web applications. Besides vulnerabilities, it also offers the ability to stay compliant with various rules within, among others, the ISO 27001, NEN 7510 and GDPR standards.

All results come together, giving the compliance officer, security officer, or auditor insight into your improvement process and progress in the field of vulnerability management. Of course, it's also logged when vulnerabilities are first detected and when the issue has been resolved.

Working with Tozetta?

Do you hold ISO 27001 certification and are you looking for a way to stay in control of information security? At Tozetta, we offer Hacking as a Service as the solution to stay in control of vulnerabilities within software and systems. In line with our own standards, we meet the requirements for a pentest intended for the ISO 27001, DigiD, or NEN 7510 guidelines.

Curious about working together? Get in touch, no obligation!