Pen test passed but the payroll API assurance gap
A SaaS company provides an HR platform to 150 enterprise customers, including payroll data for 400,000 employees. It has an annual penetration test with no critical findings, a SOC 2 Type II report, and a completed security questionnaire. A large customer's procurement team asks for evidence that the platform is managed according to ISO/IEC 27034. The security lead says the penetration test and SOC 2 are sufficient. However, the team cannot show traceability from application security requirements to selected controls to verification results for the payroll API. A new API endpoint was released three months ago that exposes salary data to third-party benefits providers; the threat model was not updated. The customer is asking for assurance before renewing a contract worth 12% of annual revenue.
1. Assess whether the penetration test and SOC 2 report provide adequate assurance under ISO/IEC 27034 for the payroll API.
Read the worked answer
They are useful evidence but not adequate on their own. A penetration test is a point-in-time sample of exploitable weaknesses; it does not show that requirements were defined, that controls were selected through risk assessment, or that verification is repeatable across releases. SOC 2 covers organizational controls and may include some application controls, but it is not an application-specific assurance case for the payroll API. The missing traceability is the central gap: the company cannot demonstrate why controls exist, what risk they address, or how they were verified. The new endpoint makes the gap material because salary data now flows to third parties and the threat model was not updated. Under ISO/IEC 27034, assurance depends on lifecycle evidence and confidence that the application behaves as intended, not just a passed test. The company should treat the customer request as a gap assessment, not rebut it with the existing reports.
2. What should the company do before responding to the customer, and how should it treat residual risk if the renewal deadline is 30 days away?
Read the worked answer
Before responding, perform a focused risk assessment of the new payroll API endpoint, including data flows to benefits providers, authentication, authorization, logging and third-party access. Update the threat model and map applicable ONF controls to the endpoint. Collect verification evidence that can be produced within 30 days, such as design review, access-control testing, data-flow review and targeted penetration testing. Where evidence is incomplete, document the gap rather than implying full coverage. Respond with a clear assurance statement: what is covered, what is not, and what remediation is planned. For residual risk, the application owner should formally accept it with compensating controls and a dated remediation plan. If the customer requires full traceability before renewal, offer a conditional arrangement with audit rights or milestone evidence. Transparency is more defensible than claiming that SOC 2 and an annual pen test equal ISO/IEC 27034 assurance.