Pen testing is not a requirement for SOC 2 Type I but it is a requirement for SOC 2 Type II

OR