Compliance-driven testing

Compliance-Driven Testing

An auditor asked, a customer's security review is stuck, or there's a date on the calendar. We scope to the question being asked and hand back evidence your auditor and your engineers can both use.

Scope a compliance test See what we test
SOC 2

SOC 2 Penetration Testing

Manual, senior-led testing of the systems in your SOC 2 scope, with a report built for engineers and auditors alike.

What's tested
  • Web application and APIs
  • External perimeter
  • Cloud configuration
  • Mobile apps and AI features, if they're part of the service
Approach

We start from your system description, not a generic target list, so the test lines up with what your auditor is reviewing. We test logged in, at every role.

Deliverables
  • Executive summary your leadership, auditor, and customers can read
  • Scope, testing dates, and methodology, stated plainly
  • Each finding with severity, evidence, reproduction steps, and real-world impact
  • Remediation retest included

SOC 2 penetration testing in depth →

Scope this test →

PCI DSS

PCI DSS Gap Analysis & Requirement 11 Pentest

PCI DSS 4.0 gap analysis and readiness. Scope your CDE, close the gaps, and cover the Requirement 11 pentest in one engagement.

What's tested
  • How cardholder data moves through your environment
  • Your controls against the 12 requirements
  • Where segmentation, tokenization, or P2PE can reduce scope
  • The Requirement 11 penetration test
Approach

The people who map your CDE are the same senior testers who run your Requirement 11 pentest. We're not a QSA and we don't issue a Report on Compliance. We get you ready for the formal assessment.

Deliverables
  • CDE scope definition and cardholder data flow documentation
  • Gap register mapped to all 12 PCI DSS 4.0 requirements, risk ranked
  • Prioritized remediation roadmap with owners and effort
  • Requirement 11 penetration test report
  • Retest of the pentest findings included

PCI DSS gap analysis in depth →

Scope this engagement →

FAQ

Compliance testing questions

Does SOC 2 require a penetration test?
Not explicitly. The SOC 2 criteria don't mandate a pentest, but many auditors expect independent testing as evidence for monitoring and vulnerability management controls, and many customers ask for one in security reviews. If your own policy commits to annual testing, your auditor will expect to see it. Ask your auditor what they want to see, then we can scope to it.
Will your report get us through our audit?
No pentest firm can promise that, and you should be wary of one that does. Your auditor evaluates your controls as a whole. What we give you is a clear, credible report of what was tested, what we found, and what you fixed, which is the evidence auditors and customers typically ask for.
Are you a QSA?
No. We don't perform formal PCI DSS assessments or issue a Report on Compliance (ROC) or Attestation of Compliance. We do readiness, gap analysis, and the Requirement 11 penetration test, so you go into your QSA assessment or SAQ prepared.
Does PCI DSS require a penetration test?
Requirement 11.4 calls for internal and external penetration testing at least once every 12 months and after significant changes, plus testing of segmentation controls if you use segmentation to reduce scope. Which of these apply to you depends on how you validate, for example which SAQ you file. We'll sort that out during scoping.
Do you retest after we fix findings?
Yes. Retests are included within 90 days of report delivery, and the report is updated to show which findings are closed.
Is the price fixed?
Yes. Once we've scoped the work you get a fixed price, and the remediation retest is part of it. We'll also sign your NDA and MSA before any testing begins.

Got an audit or a deadline coming up?

Tell us your framework and your date. We'll come back with a scope, a timeline, and a fixed price.

Start the scoping form Email info@mavericksec.com