# Pentest for an audit

# Show your auditor that your application was tested.

For ISO 27001, NEN 7510 or NIS2 an auditor wants to see what was tested, when, what was found and whether it was fixed. A pentest by HackIndex puts that on paper, with a retest and on request a statement for your auditor.

**From €1,950 excl. VAT**. Web and API pentest, fixed price after scoping

- **Report**: Within 10 working days of the test
- **Retest**: Within 90 days, included from Standard
- **Severity**: CVSS 4.0 and 3.1
- **Statement**: One page, without findings
- **Up front**: NDA, and a data processing agreement where needed

[Request a pentest](https://hackindex.nl/en/contact)

## When you need a pentest for an audit

- **ISO 27001** You have to show that you test the security of your application and fix the weaknesses you find.
- **NEN 7510** In healthcare you have to show that systems with patient data have been tested.
- **NIS2** If NIS2 applies to you, you have to show that you test your systems and manage the risks.
- **A client or tender** A client or tender asks for a recent pentest report as proof.

HackIndex does not do ISO audits itself and gives no verdict on your compliance.

## What your auditor wants to see is in the report

A report within 10 working days of the test, with everything an auditor asks for.

1. **Scope and accountability**: What was tested, on which days, from which IP addresses and with which approach.
2. **Findings with severity**: Every finding with a CVSS score in version 4.0 and 3.1.
3. **Status after the retest**: For each finding fixed, partly fixed, not fixed or deliberately accepted.
4. **What was not tested**: With the reason, so it is clear where the limits are.
5. **One-page statement**: On request: date, scope and the status after the retest, without findings. So you do not have to share the report itself.

[View the sample report](https://hackindex.nl/downloads/hackindex-sample-report.pdf)

## Once fixed, every finding is tested again

An auditor wants to see not only what was found, but also what was done about it.

- **Included**: In Standard and Extended. Available separately with Basic.
- **Within**: 90 days of the report
- **Result**: Updated report with the status of each finding

- **Fixed**: The flaw is gone and the fix works.
- **Partly fixed**: The risk is smaller, but not gone. The report says what is still needed.
- **Not fixed**: The flaw still works. You get an explanation of why the fix did not work.
- **Risk accepted**: You choose not to fix this. It stays visible in the report, with your reason.

## Plan back from your audit

Plan the test so there is still time before the audit to fix and retest. Otherwise the report only shows open findings.

1. **Scope**: What needs testing, with a fixed price.
2. **Start**: By arrangement, usually within two weeks of the scope being fixed.
3. **Test**: Within the agreed test window, in the evenings and at weekends. You hear about critical findings right away.
4. **Report**: Within 10 working days of the test.
5. **Fixing**: The time your own team needs.
6. **Retest**: Within 90 days, with an updated report for your auditor.

## What a pentest does and does not show

### Does

- That your application was tested by hand
- What was found and how severe it is
- What was fixed after the retest
- Where the limits of the test were

### Does not

- **A certification**, HackIndex does not do ISO audits and gives no verdict on your compliance.
- **A guarantee**, A pentest is a snapshot of an agreed scope.
- **An end point**, Test yearly and after big changes. A yearly arrangement is possible, with a price agreed together.

## Frequently asked questions

### May I share the report with my auditor?

Yes. You may share the report with your accountant, auditor, regulator or the supplier fixing the findings.

### Does a scan count too?

Usually not. An auditor asking for a pentest wants to see that permissions and logic were checked by hand.

### Can the test be on a fixed date, just before the audit?

Yes, by arrangement. Do leave time to fix and retest, otherwise the report only shows open findings.

### What happens to personal data during the test?

Confidentiality is agreed in advance in an NDA. If personal data may be touched, there is also a data processing agreement.

## Plan your pentest for the audit.

Tell when the audit is and what needs testing. You get a proposal with a fixed price.

- [Request a pentest](https://hackindex.nl/en/contact)

## Glossary

- **Retest**: Once the issues are fixed, every finding is tested again to confirm the fix works.

Source: https://hackindex.nl/en/pentest-for-audit