Free Assessment

Table of Contents

Reach SOC 2 Compliance in 6 Weeks or Less.

Request a Demo

Home

  / ,

  / ISO 27001 Implementation Roadmap: A Step-by-Step Guide to Certification

ISO 27001 Implementation Roadmap: A Step-by-Step Guide to Certification

Picture of Pedro Dias
Copy Link

Most organisations that fail their first ISO 27001 certification audit don’t fail because their security is lacking. They fail because they lack a systemic approach to their IT systems. ISO 27001:2022 is not a technology exercise. It is a governance framework, and getting certified requires your entire organisation to demonstrate that it manages information security systematically, continuously, and with documented intent.

This guide provides a practical, phase-by-phase roadmap to ISO 27001 implementation, covering everything from initial scoping to certification audit preparation. Whether you are building an ISMS from scratch or modernizing a legacy system, the structure below reflects how implementation actually works in practice.

The ISO 27001 Implementation Roadmap at a Glance

An ISO 27001 implementation roadmap is a structured project plan that takes an organization from its current security posture to certified compliance with ISO/IEC 27001:2022. The roadmap defines phases, deliverables, roles, and timelines, giving your team a clear line of sight from day one through to the certification audit.

The standard itself has two components. Clauses 4 through 10 define the mandatory management system requirements: context, leadership, planning, support, operations, performance evaluation, and improvement. Annex A provides a reference catalogue of 93 security controls, organised into four themes: organisational (37 controls), people (8 controls), physical (14 controls), and technological (34 controls). A well-structured roadmap addresses both components in a logical sequence, with risk driving every decision.

Pro Tip: What Procurement Teams Actually Accept

In our experience at Axipro, most sophisticated procurement teams care about three things: (1) that an independent auditor tested your controls, (2) that the criteria used are recognised and rigorous, and (3) that the report covers a recent period (ideally the last 12 months). Whether the cover page says “SOC 2” or “ISAE 3000” matters less than you think, unless the policy explicitly mandates one or the other. Always ask.

Prerequisites and Planning Before You Start

Define the Scope of Your ISMS

Scope definition is the single most consequential decision in the entire implementation. The scope should reflect the business units, locations, processes, and information assets that are most critical to your organization and most relevant to your customers and stakeholders.

A well-defined scope document should identify the boundaries of the ISMS, the interfaces and dependencies with external parties, and any intentional exclusions, with justification for each. Auditors scrutinize scope boundaries carefully. Any exclusion that appears to cherry-pick convenient systems will attract challenge.

Form Your ISO 27001 Implementation Team

Three roles are non-negotiable: an executive sponsor with authority to allocate resources and enforce decisions; a project manager who owns the day-to-day implementation timeline; and an information security lead who understands both the technical controls and the documentation requirements. Larger organisations may also need departmental representatives from IT, HR, legal, and operations.

The most common implementation failure mode is assigning ISO 27001 entirely to the IT team. The standard requires evidence that security is embedded across the organisation. HR owns the people controls. Legal owns the contractual and regulatory requirements. Finance owns the asset valuation. If those functions are not engaged early, you will discover gaps at the worst possible time. If your organisation lacks in-house expertise, working with an experienced ISO 27001 consultant can bridge that gap efficiently.

ISO 27001 Implementation Roadmap: Phase-by-Phase Breakdown

Phase 1 (2 weeks): Foundation and Planning Phase

The first 14 days establish the governance foundation. Key deliverables include a documented ISMS scope; an approved information security policy signed by top management; a defined organisational context covering internal and external issues, interested parties, and legal requirements; and a completed gap assessment that maps your current state against the standard’s requirements.

From this list, the gap assessment is the most important document. It identifies which controls are already in place, which need to be built from scratch, and which exist informally but require documentation. Our gap analysis services are designed specifically for this phase, helping organisations cut through the ambiguity and get a clear remediation picture fast. 

Phase 2 (2 weeks): Implementation Phase

The second 14 days focus on risk and documentation. Your team completes the formal risk assessment, identifies and values assets, maps threats and vulnerabilities, and determines risk levels against your defined risk appetite. From this, you produce a Risk Treatment Plan that specifies which risks will be mitigated, accepted, transferred, or avoided, and which Annex A controls address each risk.

The Statement of Applicability (SoA) is produced during this phase. It documents all 93 Annex A controls, the justification for including or excluding each one, and the current implementation status. The SoA is typically the first document an auditor requests. It connects your risk assessment to your control selection and demonstrates that your ISMS is risk-driven rather than checklist-driven.

Phase 3 (1 to 3 weeks): Audit and Approval

The final phase focuses on executing the controls, training staff, and preparing for audit. Technical controls from the risk treatment plan are deployed. Operational procedures are finalised and approved. Security awareness training is delivered to all staff. An ISO 27001 internal audit is conducted to identify nonconformities before the certification body arrives. A management review is completed to demonstrate leadership engagement.

This 6-week timeline is achievable for most organizations with existing security foundations and dedicated implementation resources. Rushing the process to meet an arbitrary deadline is the leading cause of audit failures and certification theatre, a situation where documented controls exist only on paper and fall apart under auditor questioning. For a detailed breakdown of where implementations go wrong, see our guide on common pitfalls in ISO 27001.

6-Week Detailed Implementation Timeline

Week 1: Project Initiation

Secure executive sponsorship in writing. Establish the project team and define roles. Brief key stakeholders on the standard’s requirements and business case. Set up project governance, including a steering committee and regular status reporting.

Week 2: Define ISMS Scope and Context and Conduct Gap Assessment

Document the organisational context using Clause 4 requirements. Identify interested parties and their requirements. Define and document the ISMS scope boundary. Obtain approval from top management.

Assess current security controls against ISO 27001 requirements and all 93 Annex A controls. A thorough ISO 27001 gap analysis produces a gap report that quantifies the remediation work required, prioritises gaps by risk impact and implementation effort, and forms the foundation of a credible project plan and budget.

Week 3: Policy Development and Leadership Alignment

Draft the overarching information security policy. Develop supporting topic-specific policies covering areas such as access control, acceptable use, incident management, and supplier relationships. Obtain formal approval from top management.

Week 4: Risk Assessment Framework and Assessment

Define the risk assessment methodology, including criteria for likelihood, impact, and risk acceptance thresholds. Create the asset inventory. Establish the risk register structure and tooling. Agree the risk appetite with the executive sponsor.

Identify and assess information security risks across all assets and processes within scope. Assign risk owners. Evaluate each risk against the defined criteria. Produce the initial risk register with risk scores and preliminary treatment decisions.

Develop the Risk Treatment Plan with control selections, owners, timelines, and residual risk levels. Produce the Statement of Applicability, documenting justifications for all 93 Annex A controls. Obtain formal approval from management.

Week 5: Develop Operational Procedures and Control Implementation

Document operational procedures for the selected controls. These are the how-to instructions that evidence the controls are actually being operated, not just defined. Procedures should be concise, practical, and version-controlled.

Deploy technical controls from the risk treatment plan. This typically includes access controls, network security configurations, logging and monitoring, backup and recovery systems, and physical security measures. Capture evidence of implementation as you go. For organisations with significant technical exposure, this is also the right point to schedule vulnerability assessment and penetration testing to validate that controls are functioning as intended.

Week 6: Employee Security Awareness and Training, Internal Audit, and Audit Preparation

Deliver security awareness training to all staff within scope. Cover key policies, reporting obligations, phishing and social engineering awareness, and incident escalation procedures. Record completion. Auditors routinely test staff awareness during the Stage 2 audit — this is not a box-tick exercise.

Conduct the internal audit against all applicable clauses and Annex A controls. The internal auditor must be independent of the processes being audited. Document findings, classify nonconformities and observations, and issue corrective actions. Verify that corrective actions are implemented before the certification audit.

Conduct the management review, covering ISMS performance, audit results, risk status, and improvement opportunities. Produce formal management review minutes. Assemble the certification audit evidence pack. Confirm Stage 1 and Stage 2 audit logistics with the certification body.

Key Stages of the ISO 27001 Certification Process

ISO 27001 Readiness Assessment

Before engaging a certification body, organisations typically conduct an internal readiness assessment to evaluate whether the ISMS is mature enough for external audit. This is distinct from the gap assessment conducted at the start of implementation. The readiness assessment asks whether documented controls are operating effectively, whether evidence is available and current, and whether staff can demonstrate awareness of their security responsibilities.

Gap Assessment

The formal ISO 27001 gap analysis maps your current security posture against the standard’s requirements. It identifies missing documentation, absent controls, and areas where informal practices need to be formalised. A well-executed gap assessment produces a prioritised remediation list that forms the foundation of the implementation plan.

Stage 1 Audit

The Stage 1 audit is a documentation review. The auditor evaluates whether your ISMS is designed correctly: whether the scope is defined, whether the information security policy is in place, whether the risk assessment has been completed, and whether the Statement of Applicability is present and coherent. Stage 1 typically lasts one to two days. Any major nonconformities identified at Stage 1 must be resolved before Stage 2 can proceed.

Stage 2 Audit

The Stage 2 audit is the certification audit. The auditor conducts an on-site or remote assessment of whether the controls documented in your ISMS are actually operating effectively. Auditors interview staff, review evidence records, inspect systems, and test whether the processes described in your documentation match what is happening in practice. A Stage 2 audit typically takes three to seven days depending on organisation size.

Experienced auditors ask questions that reveal whether controls are understood or just documented. They ask staff: what would happen if a server went down, how they would report a phishing email, who is responsible for approving access to sensitive data. Your answers must be consistent with your documented procedures. Zero incidents reported is a red flag, not a sign of excellence.

Surveillance Audit

ISO 27001 certificates are valid for three years. Annual surveillance audits — typically shorter than the initial certification audit — verify that the ISMS continues to operate effectively and that improvements are being made. Surveillance audits focus on areas where nonconformities were previously identified, as well as any significant changes to the organisation, its risk environment, or its technology landscape.

Recertification

At the end of the three-year cycle, a full recertification audit reassesses the entire ISMS. This resembles the original Stage 2 audit in scope and depth. Organisations that have maintained their ISMS diligently through annual surveillance cycles typically find recertification straightforward. Those that have allowed the ISMS to drift often face significant remediation work before they are ready to re-engage the certification body.

Core Components of ISO 27001 Implementation- Checklist

Build Your Information Security Management System (ISMS) 

The ISMS is the governance framework above all individual controls,  defining how your organisation identifies risks, operates controls, and improves. It requires active leadership and clear accountability, not just a folder of policies.

Create and Publish ISMS Policies, Procedures, and Documentation 

Policies set direction, procedures describe execution, and records prove compliance. All three are mandatory and all three are assessed at audit.

Conduct Risk Assessment and Risk Treatment 

Every control decision flows from the risk assessment,  identifying assets, mapping threats, estimating likelihood and impact, and documenting treatment decisions. Aim for 40 to 80 well-scoped risks rather than hundreds of near-identical entries.

Prepare the Statement of Applicability (SoA) 

The SoA lists all 93 Annex A controls and justifies every inclusion and exclusion. You do not need to implement every control, but unjustified exclusions are a leading cause of Stage 1 failures.

Implement Access Control and Authentication Processes 

Access must be granted on a need-to-know basis, reviewed regularly, and revoked promptly when staff leave. MFA is required as a minimum for all remote and privileged access.

Protect Against Network and Web-Based Threats 

Network segmentation, intrusion detection, vulnerability management, and the 2022 additions of web filtering (A.8.23) and data leakage prevention (A.8.12) are baseline expectations,  auditors want to see them operating with documented evidence.

Ensure Data Backup and Recovery 

Backups must be tested and proven restorable. Auditors ask for evidence of recovery tests, not just confirmation that backups are being taken.

Implement Physical Security Measures 

Entry controls, visitor management, clean desk policies, and secure media disposal are all in scope. These controls are routinely underestimated in planning,  budget time for them early.

Monitor and Review Your ISMS 

Define what you measure, how often, and what triggers action. Monitoring outputs must feed into management reviews, which produce documented improvement decisions.

Continuously Improve Your ISMS 

Nonconformities from audits, incidents, or reviews must be root-cause analysed, resolved, and verified closed. This cycle is what separates a functioning ISMS from one that exists only on paper.

Mandatory Documents Required for ISO 27001 Implementatio

ISO 27001:2022 mandates a specific set of documented information. Auditors request these as a baseline during Stage 1:

  • ISMS Scope (Clause 4.3) — defines the boundaries and applicability of the management system
  • Information Security Policy (Clause 5.2) — top management’s formal commitment to information security
  • Risk Assessment Process (Clause 6.1.2) — your methodology for identifying, analysing, and evaluating risks
  • Risk Treatment Plan (Clause 6.1.3) — documented decisions on how each identified risk will be treated
  • Statement of Applicability (Clause 6.1.3d) — the definitive reference for all 93 Annex A control decisions
  • Information Security Objectives (Clause 6.2) — measurable targets linked to the policy and risk assessment
  • Evidence of Competence (Clause 7.2) — training and qualification records for ISMS-related roles
  • Operational Planning Results (Clause 8.1) — evidence that security operations are carried out as planned
  • Risk Assessment Results (Clause 8.2) — the documented output of the risk assessment process
  • Internal Audit Programme and Results (Clause 9.2) — confirmation that internal audits have been planned and conducted
  • Management Review Records (Clause 9.3) — minutes and decisions from management reviews
  • Nonconformity and Corrective Action Records (Clause 10.1) — documentation of identified nonconformities and their resolution

How to Accelerate Your ISO 27001 Implementation

Common Delays to Avoid

Scope creep. Expanding scope mid-project forces rework across the risk assessment, SoA, and documentation set. Define boundaries precisely at the start and hold them.

Weak executive engagement. Implementations stall at policy approvals and resource decisions when sponsors delegate and disengage. The sponsor should attend steering meetings and have weekly visibility during active phases.

Late-stage documentation. Deferring documentation until after controls are implemented produces thin, retrospective evidence. Write documentation in parallel with implementation, not after.

Accelerators That Speed Up the Process

Templates. ISO 27001-aligned policy and procedure templates can compress the documentation phase by several weeks. Adapt them to your context rather than treating them as off-the-shelf compliance.

GRC tools. Purpose-built platforms provide structure for risk registers, the SoA, and audit evidence management — replacing spreadsheets that become unmanageable at scale. Our compliance tools comparison covers the leading platforms in depth.

External consultants. Their value is pattern recognition: they know what auditors scrutinise, which documentation gaps attract nonconformities, and what a credible risk assessment looks like. For organisations without in-house expertise, consultant engagement typically pays for itself in avoided rework. Our Compliance Accelerator Program offers a structured, supported path to certification through software automation with a free 30-day trial.

Pro Tip: What Procurement Teams Actually Accept

In our experience at Axipro, most sophisticated procurement teams care about three things: (1) that an independent auditor tested your controls, (2) that the criteria used are recognised and rigorous, and (3) that the report covers a recent period (ideally the last 12 months). Whether the cover page says “SOC 2” or “ISAE 3000” matters less than you think, unless the policy explicitly mandates one or the other. Always ask.

What tools can help accelerate compliance?

Once certified, maintaining your ISMS requires continuous monitoring, evidence collection, and audit readiness. GRC and compliance automation tools take much of that manual burden off your team. Our Drata vs Thoropass vs Vanta comparison is a good starting point for evaluating your options.

The most consistently cited challenges are: securing sustained top management engagement beyond the initial sponsorship conversation; maintaining momentum through the documentation-heavy middle phases of implementation; achieving cross-functional participation from HR, legal, and operations teams that may not see information security as their responsibility; and building a risk assessment that is genuinely risk-driven rather than a mechanical exercise designed to justify a predetermined control set.

Yes. Organisations with experienced information security professionals and strong project management capability routinely achieve certification without external consultants. The standard’s requirements are publicly available, and the approach is logical once understood. The risk of a DIY implementation is not that it cannot be done, but that it takes longer and is more susceptible to documentation gaps and scoping errors. For organisations without in-house expertise, engaging a consultant on the gap assessment and SoA phases alone, with internal teams handling implementation, often provides the best balance of cost and quality.

Axipro Author

Picture of Pedro Dias

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.
Copy Link

Blog Highlights

Explore More Articles

Read More Blogs

Agentic AI Risk Management: Why Agentic Autonomy Needs Its Own Line in Your Risk Register

For the past two years, enterprise AI risk conversations have centered on a familiar set of concerns: model bias, hallucination, data privacy, and dependency on third-party models. These are real risks, and most organizations now run some version of a governance program to manage them. But something has shifted. Organizations are no longer just deploying AI that generates content for a human to review. They’re deploying AI that acts. Agents now plan multi-step tasks, call APIs, move data between systems, execute transactions, and coordinate with other agents, often with no human checkpoint in the loop. That shift deserves more than a footnote in the existing AI risk category. It deserves its own line in the risk register: Agentic Autonomy Risk. What Is Agentic AI Risk Management? Agentic AI risk management is the practice of identifying, assessing, and controlling the risks created when AI systems take autonomous action on an organization’s behalf. Where traditional AI governance evaluates outputs (accuracy, bias, privacy), agentic AI risk management governs what agents actually do: the tools they call, the permissions they inherit, and the downstream consequences of their actions. That distinction is the reason existing risk registers struggle with agents, and it’s worth unpacking properly. What Agentic AI Actually Changes Traditional AI systems, even generative ones, are advisory. They produce an output such as a summary, a prediction, a draft email, or a classification, and a human remains the last checkpoint before anything happens in the real world. Agentic AI removes that checkpoint. An agentic system doesn’t just produce an answer. It pursues a goal. It decides which tools to call and in what order, then executes those actions directly against live systems: submitting a purchase order, modifying a database record, sending an external communication, or orchestrating a set of sub-agents to complete a broader workflow. Agentic autonomy is the degree to which a system can plan and execute actions without a human explicitly authorizing each step. It’s a spectrum rather than a binary. At one end, the AI drafts and a human approves every action. At the other, the AI operates within broad guardrails and only escalates exceptions. The further an organization moves along that spectrum, the less its exposure looks like software risk and the more it looks like delegated authority risk, the kind normally reserved for employees, contractors, and automated financial systems. Why Existing Risk Registers Miss Agentic AI Risks Most enterprise risk registers were built on a reasonably safe assumption: a human initiates consequential actions, and the technology around that human behaves deterministically. Agentic AI breaks both halves of that assumption at once. A few specific gaps show up quickly when organizations try to map agentic deployments onto existing categories. Operational risk registers assume process failures come from human error or system outages, not from a system independently choosing an unanticipated path to a stated goal. Cybersecurity risk registers are built around unauthorized external access, while an agent problem usually involves an authorized system taking unauthorized internal actions with its own legitimate credentials. Model risk frameworks, borrowed largely from financial services, evaluate output accuracy rather than action consequences, which matters most when those actions can’t be reversed. And third-party risk assessments treat vendors as static entities, not as autonomous agents that might invoke other vendors’ agents on your behalf. See our guide to the NIST AI Risk Management Framework for how output-focused frameworks are structured. The result is a governance blind spot. An organization can be compliant against its AI policy, its cybersecurity policy, and its vendor risk policy, and still have nobody accountable for the specific risk of a system initiating a harmful sequence of actions before anyone notices. Defining Agentic Autonomy Risk Agentic Autonomy Risk is the risk that an AI system, operating with delegated decision-making and execution authority, takes actions that are harmful, non-compliant, or misaligned with organizational intent before adequate human oversight can intervene. Those actions might happen independently or in coordination with other agents. It deserves standing as a named category alongside cybersecurity, operational, legal, financial, and third-party risk because the loss event itself is different. The harm is a completed action in a live system, and it may be difficult or impossible to reverse. The accountability structure is different too: when an orchestrating agent delegates to sub-agents, responsibility for the outcome gets distributed in ways existing ownership models don’t cleanly capture. So is the detection window. Traditional controls assume a human is positioned to catch an error before it compounds, but an agent can execute dozens of dependent actions faster than any human review cycle. 7 Agentic AI Risk Scenarios to Put on Your Register 1. Unauthorized autonomous decision-making. An agent takes an action within its technical permissions but outside its intended business mandate. It adjusts pricing, approves a refund, or modifies a customer record, and no policy ever explicitly authorized that scenario. 2. Goal misalignment. The agent optimizes for a literal interpretation of its objective in a way that diverges from actual business intent, particularly under ambiguous or adversarial inputs. 3. Multi-agent interactions and cascading failures. One agent’s flawed output becomes another agent’s trusted input. A single error can propagate across a chain of agents faster than anyone can detect it, amplifying the original mistake instead of containing it. 4. Excessive tool or system permissions. Agents get provisioned with broad, standing access “to be safe” rather than scoped, least-privilege access tied to specific tasks. A productivity tool quietly becomes a privilege-escalation path. 5. Regulatory non-compliance. Autonomous actions trigger obligations under data protection, financial services, employment, or sector-specific regulation, and they execute without the compliance review a human-initiated process would normally receive. 6. Explainability and accountability gaps. An autonomous action causes harm and the organization can’t clearly reconstruct why the agent chose that path, or establish whether the business owner, the AI governance function, or the vendor is accountable for the outcome. 7. Autonomous third-party actions. A vendor’s agent, integrated into your environment, takes action on your behalf, or your agent acts against a

Read more

SOC 2 Penetration Testing Cost: 2026 Price Ranges

A SOC 2 penetration test costs between $1,000 and $30,000 for most companies. A typical SaaS scope, meaning one web application, its API layer, and the cloud infrastructure behind it, usually lands between $2,000 and $20,000. Early-stage startups with a narrow scope can get an auditor-accepted test for $1,000 to $8,000, while enterprises with multiple products and hybrid infrastructure regularly spend $20,000 to $50,000 or more. The spread is wide because “penetration test” covers everything from an automated scan with a cover page to weeks of manual testing by senior engineers. Auditors know the difference, and so do the enterprise customers who asked for your SOC 2 report in the first place. This guide breaks down what drives the price, where the hidden costs sit, and how to buy a test that holds up in fieldwork without overpaying for it. What Is SOC 2 Penetration Testing?​ A SOC 2 penetration test is a simulated attack on your systems, performed by a qualified security professional, scoped to the environment covered by your SOC 2 report. The tester tries to exploit real weaknesses the way an attacker would: broken access controls, injection flaws, misconfigured cloud services, exposed credentials. The output is a report your auditor reads as evidence that your security controls work in practice, not only on paper. That last part matters. A pentest bought for SOC 2 has a second audience beyond your security team. If the report doesn’t map findings to your audit scope, document its methodology, and show remediation, it fails the job you bought it for. We cover the full deliverable in our guide to what a SOC 2-ready VAPT report includes. How Penetration Testing Fits Into SOC 2 Compliance​ SOC 2 is built on the AICPA’s Trust Services Criteria, and the Security category (the Common Criteria) applies to every report. Penetration testing is the standard way to satisfy CC7.1, which expects you to detect and monitor for new vulnerabilities, and it supports CC4.1, which covers ongoing evaluations of whether controls actually function. The AICPA’s points of focus explicitly mention vulnerability scanning and penetration testing as examples of how companies meet these criteria. In practice, the test slots into your audit timeline as an evidence item. Your auditor will ask for the report, check the test date against the audit period, and review how you handled the findings. Remediation is often scrutinized harder than the test itself, because it shows whether your vulnerability management process runs or merely exists. Is Penetration Testing Required for SOC 2?​ Strictly speaking, no. The Trust Services Criteria never use the word “mandatory” about penetration testing. You could theoretically satisfy CC7.1 with vulnerability scanning and strong monitoring alone. In reality, almost every auditor expects one, and skipping it invites two problems. First, your auditor may push back during fieldwork or add exceptions to the report. Second, the enterprise buyers reviewing your SOC 2 report increasingly look for pentest evidence specifically, and a report without it raises questions during procurement. Treat the test as effectively required and budget for it from the start of your SOC 2 compliance checklist. How Much Does SOC 2 Penetration Testing Cost? Typical Price Range for SOC 2 Pen Testing Most companies pay $1,000 to $30,000, with the median engagement for a SaaS business sitting around $12,000 to $15,000. Compliance-focused tests at the lower end of the market start around $1,000 to $5,000. Deep manual testing from established firms runs $10,000 to $30,000. Anything quoted below roughly $3,000 is almost certainly automated scanning packaged as a pentest, which auditors are getting better at spotting. Cost by Company Size (Startup, SMB, Enterprise) Company size is a proxy, not the driver. A 15-person company with three products and a legacy on-prem component will pay more than a 200-person company with one tightly scoped SaaS platform. Testers price effort, and effort follows scope. Cost by Test Type (Network, Web App, API, Cloud, Internal/External) Most SOC 2 engagements bundle two or three of these. The common package for a cloud-native SaaS company is web app plus API plus cloud configuration, which is why the $1,000 to $20,000 band comes up so often. Companies with office networks and internal systems in their audit scope add internal network testing, and the price climbs accordingly. Factors That Influence SOC 2 Penetration Testing Cost Scope and Number of Assets Tested Scope is the single biggest cost driver. Every additional application, API endpoint group, cloud account, or network segment adds testing hours. A pentest priced without a scoping call is a pentest priced on guesswork, and the guess usually favors the vendor. Complexity of Application or Infrastructure​ A simple CRUD app with two user roles tests quickly. A multi-tenant platform with role hierarchies, workflow engines, file processing, and third-party integrations takes far longer, because each of those features creates attack surface a tester has to work through manually. Authentication tiers matter especially: every distinct role needs testing for privilege escalation and cross-tenant data access. Testing Methodology (Black Box, Grey Box, White Box) Black box testing gives the tester nothing but a URL, grey box adds credentials and documentation, and white box adds source code and architecture diagrams. Grey box is the default for SOC 2 and usually the best value, since the tester spends time exploiting rather than discovering. White box costs more upfront but finds deeper issues. Black box sounds rigorous but often wastes paid hours on reconnaissance an attacker would run for free. Depth of Testing and Manual vs. Automated Approaches Automated scanning finds known vulnerability patterns. Manual testing finds business logic flaws, chained exploits, and authorization gaps that no scanner catches, and it’s the part auditors and security-literate customers actually value. The ratio of manual work to automation is the honest explanation for most price differences between two quotes covering the same scope. Tester Credentials and Firm Reputation Senior testers holding OSCP, GPEN, or CREST credentials bill higher rates, and firms with recognized methodologies charge a premium for the credibility their letterhead carries

Read more

LiteLLM Supply-Chain Breach: How to Check If You’re Exposed and What to Rotate

Two compromised versions of LiteLLM sat on PyPI for roughly 40 minutes on the morning of March 24, 2026. That window was enough to capture secrets from around 434,000 CI/CD pipeline runs across nearly 2,500 organizations, including AWS, Samsung, Cisco, Salesforce, Siemens, and Deloitte. In August, researchers at CloudSEK and Hudson Rock confirmed they had obtained the raw exfiltrated data: a 153GB archive containing 433,909 files of environment variables, cloud keys, Kubernetes secrets, and API tokens harvested live from running pipelines, as covered by Help Net Security’s reporting on the credential archive. If LiteLLM runs anywhere in your stack, or you touch any AI proxy infrastructure at all, you need answers to three things: whether you were exposed, what to rotate first, and whether the rotation you did back in March actually held. That last one matters more than it sounds, because “we rotated everything” has already burned at least one very large company. How the Breach Happened The attack didn’t start with LiteLLM. On March 19, 2026, a threat group called TeamPCP compromised the build pipeline of Trivy, a vulnerability scanner half the industry runs, and pushed a poisoned release. LiteLLM’s own CI pipeline ran Trivy, so the poisoned scanner had legitimate read access to the project’s runner environment. The attackers used that to steal LiteLLM’s PyPI publishing tokens and ship two malicious releases of their own: versions 1.82.7 and 1.82.8. KICS and the Telnyx Python SDK got hit in the same campaign. The payload design is the part worth studying. The malicious package dropped a .pth startup hook into site-packages, so the code ran the moment any Python interpreter started on the machine, whether or not anything imported LiteLLM. From there it harvested environment variables, read local credential files like .aws/credentials and .kube/config, tried to move laterally across Kubernetes clusters, and installed a systemd backdoor dressed up as a generic telemetry service. InfoQ’s coverage of the PyPI compromise put downloads of the compromised release above 40,000. For scale, LiteLLM normally gets downloaded around 3 million times a day. The exfiltration had a nasty fallback, too. According to CloudSEK, stolen data was encrypted and sent to a typosquatted domain, and when that failed, the malware created a public repository inside the victim’s own GitHub account and uploaded the loot as a release asset. Some companies were publishing their own secrets to the open internet and had no idea. Worth Knowing: The malicious code only existed in the PyPI artifacts. The GitHub source repository stayed clean the whole time, so a developer reviewing the code on GitHub saw nothing wrong. Source review isn’t artifact verification. If you don’t check that what the registry serves matches the upstream source, this class of attack is invisible to you. How to Check If You Were Exposed Three checks, from quickest to most involved. 1. Confirm whether the compromised versions ever ran The malicious versions went live on PyPI at 10:39 UTC on March 24, 2026 and got quarantined about 40 minutes later. The project’s advice: treat any install from that day before 16:00 UTC as suspect. Search your lockfiles, pip caches, SBOMs, and container image histories for 1.82.7 and 1.82.8. And check your internal artifact mirrors. An Artifactory or Nexus proxy that cached the bad release in March can keep serving it internally long after PyPI pulled it. Keep the .pth mechanism in mind when you scope this. The question isn’t “which applications import LiteLLM,” it’s “which machines had the package installed at all,” because every Python process on an infected machine triggered the payload. 2. Hunt for persistence Rotation is pointless if the attacker still has a foothold. Check developer machines, CI runners, and containers for unauthorized .pth files in site-packages and for suspicious systemd units, especially anything posing as a system telemetry service. And review activity from March 24 onward, not just the 40-minute window. Persistence is there so the access outlives the infection. Pro Tip: Don’t limit the persistence hunt to live machines. Base container images rebuilt in late March may have baked the payload into every image derived from them since. Scan your image registry for the affected LiteLLM versions and for unexpected .pth files, then trace which running workloads came from flagged images. 3. Check whether your secrets are in the dump Hudson Rock has published a domain lookup tool and is running ethical disclosures for affected organizations, and CloudSEK maintains a high-confidence victim list. Use them, but know their limits. Attribution in this dataset is genuinely hard. One dump with a siriusxm.com committer email actually traced, through its self-hosted GitLab endpoints, to AdsWizz, a SiriusXM subsidiary. And a large share of the dumps are generic pipeline configurations with no identifying domain, email, or server name at all. Absence from a victim list is not evidence of absence. If your pipelines ran the compromised versions, assume exposure no matter what a lookup tool tells you. What to Rotate, in What Order The guidance from both research teams is blunt: treat every secret the LiteLLM environment could reach as compromised. That covers secrets on disk, in memory, injected into CI jobs, and anything retrievable through instance metadata services. Work down by blast radius: Priority Credential type Why it comes first 1 Cloud IAM keys (AWS, GCP, Azure) Direct control of infrastructure, data stores, and billing. This is where attackers monetize fastest. 2 GitHub and GitLab PATs, package publishing tokens These let an attacker poison your releases and turn your company into the next link in the supply chain. 3 Kubernetes service account tokens and kubeconfigs Lateral movement across clusters was built into the payload, not a theoretical risk. 4 Database passwords and third-party API keys Dumped in plain text in the archive, often with no attribution, so nobody will warn you they leaked. 5 AI provider API keys Billing abuse, quota theft, and access to whatever data flows through your LLM routing layer. One word matters more than the rest of this article: revoke, don’t just rotate. That

Read more