Overview
UK organisations rarely answer to one framework. A retailer may need PCI DSS testing, an ISO 27001 surveillance audit and a supplier questionnaire in the same year. We scope once against all of them, label each finding with the requirement it relates to and write the report so assessors can follow scope, method and dates. We don't claim CREST, CHECK or QSA status; raise any such need at scoping.
Many security standards require penetration testing, but a generic test does not automatically satisfy them. Each framework expects particular scope, timing and evidence, and an auditor needs to see that those expectations were met, not just that some testing happened. Compliance pentesting starts from the control you must satisfy and works backward, so the engagement is designed from the outset to produce the evidence your assessor is looking for.
For payment environments, PCI DSS v4.0.1 Requirement 11.4 calls for penetration testing at least annually and after any significant change, covering the cardholder data environment and the segmentation that isolates it; we scope the test and the segmentation checks accordingly. For an information security management system, ISO/IEC 27001:2022 Annex A 8.8 on technical vulnerabilities and A.8.29 on security testing in development point to regular testing, and we align the engagement to those controls. For SOC 2, a penetration test is commonly expected as evidence supporting the security criteria, so we document it to suit an attestation.
Above all we keep the work region-neutral and honest. We map findings to the relevant controls, provide an evidence pack covering scope, dates, method and results, and issue an attestation letter once fixes are retested. Where your obligations go further, we align to the security-testing expectations of your regulator and local requirements rather than naming any one authority, so the same engagement supports whichever framework and jurisdiction you report to.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Requirement reviewWe confirm which framework, control and timing your test must satisfy.
- ScopingThe engagement is designed to meet that control, including any segmentation checks.
- TestingWe test the in-scope environment to the depth the standard expects.
- Evidence assemblyFindings are mapped to controls and packaged for audit.
- Retest & attestFixed findings are retested and an attestation letter is issued.
What you receive
- Report scoped and mapped to your framework
- Audit-ready evidence pack with scope, dates and method
- Segmentation test results where PCI DSS applies
- Findings mapped to the relevant controls
- Attestation letter once fixes are retested
Standards & frameworks
- PCI DSS v4.0.1 Req. 11.4
- ISO/IEC 27001:2022 A.8.8
- ISO/IEC 27001:2022 A.8.29
- SOC 2
- NIST SP 800-115
- PTES
- CVSS v4.0
- UK GDPR Art. 32
- NHS DSPT
Frequently asked questions
Which frameworks can this support?
Commonly PCI DSS, ISO/IEC 27001 and SOC 2, and it aligns to the security-testing expectations of your regulator where you have further obligations. We scope the single engagement so its evidence serves whichever standards and jurisdiction you report against.
How often does PCI DSS need a pentest?
Requirement 11.4 calls for penetration testing at least once a year and after any significant change to the environment, covering both the cardholder data environment and the controls that segment it. We scope the test and segmentation checks to match that expectation.
Will our auditor accept your report?
Reports state scope, dates, method and risk-rated findings with evidence, and we map results to the relevant controls. Once fixes are retested we issue an attestation letter. We cannot act as your certifying body, but assessors routinely accept testing documented this way.
Are your prices quoted with VAT?
Proposals are in GBP and exclude VAT. Because we supply from outside the UK, the reverse charge usually applies to UK business customers, so you account for VAT yourself. Your finance team or accountant can confirm the treatment for your organisation.
Can you deliver a CREST or CHECK report?
We don't claim CREST accreditation or CHECK membership. CHECK covers government, public-sector and CNI systems, and its testers need UK security clearance. If a contract names either, raise it at scoping and you'll get a plain answer on whether we can meet it.