Ryvx

If you are working towards ISO 27001, someone has probably told you that you need a penetration test. The standard does not say that in so many words. It does ask you to show that you find and deal with technical weaknesses, and a test is the most common way to show it.

What the standard asks for

ISO 27001:2022 includes controls on managing technical vulnerabilities (Annex A 8.8) and on security testing during development and before release (Annex A 8.29). Neither names a penetration test. Both expect you to know where your systems are weak, act on it, and keep a record. For a public website or app, an auditor will usually ask how you know it is not open to attack.

What auditors usually want to see

Expect questions like these. When did someone last test the website, and who? What did they find? Which problems did you fix, and how did you check the fixes? A dated report with findings, fixes and a retest answers all of them. A scan report helps, but on its own it shows that you looked for known problems, not that anyone tried to break in.

Your auditor's view is the one that counts. Ask them early whether they expect a test from an accredited provider, and plan around the answer.

Using a Ryvx review as evidence

A Ryvx Launch Security Review costs £495 per site and gives you a dated report in 3 to 5 working days. Each finding comes with the proof behind it, the fix, and the standards it affects, including ISO 27001. After you fix things we retest once, so your record shows the problem found, fixed and checked. A person checks every report before you see it.

Monthly Monitoring (£100 a month for one site) runs automated checks every two weeks and keeps a dated record, which helps with the ongoing part of vulnerability management between audits.

Ryvx gives you evidence. It is not an auditor or a certification body, it does not certify you, and it is not CREST accredited.