Does SOC 2 require a penetration test? Sources
Read on 12 November 2026. Published by Excession Labs.
Post: https://excessionlabs.ai/blog/soc-2-penetration-testing/

This post has no data set. It quotes public documents. Each quote in the post comes from a page we opened on the date above. We checked every quoted string against the page text.

Primary text (criteria)
  AICPA, TSP Section 100, 2017 Trust Services Criteria for Security, Availability,
  Processing Integrity, Confidentiality, and Privacy, Red-lined Version (includes March 2020 updates).
  File on the AICPA site:
    https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-redlined.pdf
  That address redirects to an AICPA web page on 12 November 2026, so we read the PDF from the Internet Archive copy:
    https://web.archive.org/web/20220117114302/https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-redlined.pdf
  Used for: CC3.2, CC4.1 and its points of focus (types of evaluation, scope and frequency, objectivity,
  knowledgeable personnel), CC4.2 and its point of focus "Monitors Corrective Action", CC7.1 and its point of
  focus "Conducts Vulnerability Scans", paragraph .04 on points of focus, and the Type 1 and Type 2 definitions.
  The word "penetration" appears once in the document (CC4.1 point of focus). The text sets no test interval.

  AICPA download page for the 2022 revised points of focus (free account needed; we did not open the PDF):
    https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
  Checked 12 November 2026. Title on the page: "2017 Trust Services Criteria (With Revised Points of Focus - 2022)".
  The post says what we could not check: the 2022 wording of the CC4.1 point of focus comes from Linford (below),
  and we did not compare the other rows with the 2022 file.

Secondary sources (CPA firms)
  Linford & Company LLP, "SOC 2 Criteria for Monitoring Activities", 25 January 2023
    https://linfordco.com/blog/soc-2-criteria-monitoring-activities/
    Used for: 2022 wording of the CC4.1 point of focus; "A person cannot monitor or check their own work."
  Linford & Company LLP, Lois Colby (partner), "Penetration Testing for SOC 2 Reports: What is a Pentest?", 16 June 2021
    https://linfordco.com/blog/what-is-penetration-testing-soc-2/
    Used for: "not required in order to meet the Trust Services Criteria"; report contents; "point in time test".
  Linford & Company LLP, Mark Larson (partner), "Vulnerability Assessment vs Penetration Testing for SOC 2", 23 June 2021
    https://linfordco.com/blog/soc-2-vulnerability-assessment-vs-penetration-testing/
    Used for: "the simple answer is no"; frequency and scope set by risk assessment.
  Linford & Company LLP (L&Co Staff Auditors), "The 351-Day Risk Window: Why Annual Pentests Fail", published 22 April 2026, updated 11 August 2026
    https://linfordco.com/blog/why-annual-pentests-fail/
    Used for: "At a minimum, annually for compliance purposes."
  Linford & Company LLP, "What Period Is Covered In A Type II SOC Examination?", 10 January 2017
    https://linfordco.com/blog/period-covered-type-ii-soc-examination/
    Used for: Type II period length.
  MJD Advisors (Mike DeKock, CPA), "SOC 2 Reports and Penetration Tests", republished by the Cloud Security Alliance, 2 February 2024
    https://cloudsecurityalliance.org/blog/2024/02/02/soc-2-reports-and-penetration-tests
    Used for: "no explicit requirements"; the customer contract case.

Vendor source (not an audit firm)
  Secureframe, "Pen Testing Requirements", Brady Price, 13 July 2026
    https://support.secureframe.com/en/articles/15111430-pen-testing-requirements
    Used for: "may vary from auditor to auditor"; "at least annually"; pentest timing for Type 1 and Type 2.

Our own pages used
  https://excessionlabs.ai/penetration-testing/ (FAQ: report states scope, method, findings and retest results; we do not certify anything)
  https://excessionlabs.ai/sample-report/ (format of the sample report)
  https://excessionlabs.ai/blog/vulnerability-scanner-vs-penetration-test/ (3 of 27, 4 of 27 and 21 missed)

Not in the post
  No statement about what auditors accept comes from anywhere except the pages above.
  No price. No claim about a specific audit firm that we did not read on its own page.