Compliance

Does SOC 2 Require a Penetration Test? What Auditors Actually Expect

SOC 2 never names penetration testing, yet auditors expect it as evidence for CC4.1 and CC7.1. Here's what actually satisfies the Trust Services Criteria.