Show your auditor that your application was tested.
For ISO 27001, NEN 7510 or NIS2 an auditor wants to see what was tested, when, what was found and whether it was fixed. A pentest by HackIndex puts that on paper, with a retest and on request a statement for your auditor.
- Scope and accountability in the report
- Retest with the status of each finding
- Statement for your auditor on request
Standards
When you need a pentest for an audit
-
ISO 27001
You have to show that you test the security of your application and fix the weaknesses you find.
-
NEN 7510
In healthcare you have to show that systems with patient data have been tested.
-
NIS2
If NIS2 applies to you, you have to show that you test your systems and manage the risks.
-
A client or tender
A client or tender asks for a recent pentest report as proof.
HackIndex does not do ISO audits itself and gives no verdict on your compliance.
What your auditor sees
What your auditor wants to see is in the report
A report within 10 working days of the test, with everything an auditor asks for.
- Scope and accountability What was tested, on which days, from which IP addresses and with which approach.
- Findings with severity Every finding with a CVSS score in version 4.0 and 3.1.
- Status after the retest For each finding fixed, partly fixed, not fixed or deliberately accepted.
- What was not tested With the reason, so it is clear where the limits are.
- One-page statement On request: date, scope and the status after the retest, without findings. So you do not have to share the report itself.
View the sample report An 18-page PDF, with made-up data.
Retest
Once fixed, every finding is tested again
An auditor wants to see not only what was found, but also what was done about it.
- Included
- In Standard and Extended. Available separately with Basic.
- Within
- 90 days of the report
- Result
- Updated report with the status of each finding
- Fixed The flaw is gone and the fix works.
- Partly fixed The risk is smaller, but not gone. The report says what is still needed.
- Not fixed The flaw still works. You get an explanation of why the fix did not work.
- Risk accepted You choose not to fix this. It stays visible in the report, with your reason.
Planning
Plan back from your audit
Plan the test so there is still time before the audit to fix and retest. Otherwise the report only shows open findings.
-
Scope
What needs testing, with a fixed price.
-
Start
By arrangement, usually within two weeks of the scope being fixed.
-
Test
Within the agreed test window, in the evenings and at weekends. You hear about critical findings right away.
-
Report
Within 10 working days of the test.
-
Fixing
The time your own team needs.
-
Retest
Within 90 days, with an updated report for your auditor.
To be fair
What a pentest does and does not show
IN Does
- That your application was tested by hand
- What was found and how severe it is
- What was fixed after the retest
- Where the limits of the test were
OUT Does not
- A certification, HackIndex does not do ISO audits and gives no verdict on your compliance.
- A guarantee, A pentest is a snapshot of an agreed scope.
- An end point, Test yearly and after big changes. A yearly arrangement is possible, with a price agreed together.
Frequently asked questions
May I share the report with my auditor?
Yes. You may share the report with your accountant, auditor, regulator or the supplier fixing the findings.
Does a scan count too?
Usually not. An auditor asking for a pentest wants to see that permissions and logic were checked by hand.
Can the test be on a fixed date, just before the audit?
Yes, by arrangement. Do leave time to fix and retest, otherwise the report only shows open findings.
What happens to personal data during the test?
Confidentiality is agreed in advance in an NDA. If personal data may be touched, there is also a data processing agreement.
Plan your pentest for the audit.
Tell when the audit is and what needs testing. You get a proposal with a fixed price.