Risk-led scope
Connect target selection to the ISMS scope, risk assessment, treatment decisions, and organization-defined testing objectives.
ISMS technical evidence
Penetration testing evidence for ISO/IEC 27001
Use authorized penetration testing as technical evidence within an ISO/IEC 27001 information security management system while keeping certification with an accredited body.
Controlled evidence
Capture authorization, methods, findings, limitations, treatment ownership, and verification in the ISMS record.
Independent certification
A certification body, not Revaizor, assesses conformity and makes the certification decision.
Place testing inside the ISMS
ISO/IEC 27001 defines requirements for an information security management system. Penetration testing can inform risk assessment, treatment, monitoring, corrective action, and assurance, but the organization must decide how testing fits its ISMS scope and processes.
Use risk and change to drive coverage
A defensible program selects targets and timing based on information risks, material system changes, prior findings, threat context, and assurance needs. A generic test schedule should not replace the organization’s own risk-based rationale.
- Tie the engagement objective to approved ISMS risks and asset ownership.
- Record scope changes and exclusions through the organization’s governance process.
- Feed findings into treatment, exception, corrective-action, and retest workflows.
Preserve limits with the evidence
The report should state which systems, roles, attack perspectives, and periods were tested and which were not. No-findings results do not prove that the ISMS conforms or that all vulnerabilities are absent.
Verify the current standard and audit criteria
Use ISO’s official page and licensed copy of the applicable standard, including relevant amendments. Coordinate with your certification body on audit scope and evidence expectations rather than relying on summaries of protected standards text.
Frequently asked questions
Does Revaizor certify organizations to ISO/IEC 27001?
No. Revaizor can provide scoped penetration-testing evidence. An appropriately accredited certification body performs the audit and makes the certification decision.
Is penetration testing mandatory for every ISMS in the same way?
Organizations must determine controls and assurance activities through their context, risks, applicable requirements, and ISMS processes. Confirm interpretations with the current standard, qualified advisors, and your certification body.
Can the test report be used as audit evidence?
It may be relevant evidence if it fits the ISMS and audit scope, but acceptance and sufficiency are determined by the organization and its auditor. Align expectations before the engagement.
Define your next security mission
Tell us the target type and desired outcome. Sensitive scope details are collected after qualification.
Request a scoped pentest