Unverified50% confidenceDecision RuleExact time
When preparing for SOC 2 or ISO 27001 certification, signing larger customers, or filling out security questionnaires, formal penetration testing should be added, because auditors or customers will ask for manual test reports.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSOC 2 Type 2 certification requires an auditing firm to spot-check the actual operational effectiveness of a company's security controls over a period of time (typically 6–12 months), rather than merely reviewing written policies.75% similarUnverifiedDeprovisioning reconciliation tasks should be idempotent, and deprovisioning operations must be recorded in audit logs to meet the access control change tracking requirements of compliance frameworks such as SOC 2 and ISO 27001.72% similarUnverified渗透测试报告通常包括执行摘要、技术详情、风险评级（采用CVSS通用漏洞评分系统）和修复建议69% similarUnverifiedCompliance frameworks (such as SOC 2, PCI DSS, and ISO 27001) typically have explicit requirements for integrity and non-repudiation of audit logs.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1068469API
curl https://kongchang.com/api/v1/knowledge/claims/1068469MCP
get_claim(id=1068469)