Rheono tests. cSquare GRC tracks. Your auditor decides.
A pentest only closes an audit item when it reaches the control it evidences and the fixes are proven. Rheono runs the test and signs the report. cSquare GRC, our GRC partner, runs your compliance program, maps the report to your controls and tracks remediation. Your independent auditor reviews it all and makes the call. Neither of us audits or certifies you.
Three parties, three jobs
Rheono tests and signs
- Agents pentest your web app and API inside the written scope
- Every finding validated with a working proof of concept
- A signed report: Advanced electronic signature (eIDAS, PAdES-B-T) + qualified timestamp (RFC 3161)
- Retests after your fixes, in the next signed report
cSquare GRC maps and tracks
- Runs your SOC 2 / ISO 27001 / NIS2 / DORA program
- Maps the signed report to the controls you carry
- Tracks remediation until the retest closes it
- Gives your auditor a read-only review workspace
Your auditor decides
- An independent CPA firm (SOC 2) or accredited certification body (ISO 27001), not Rheono
- Reviews the evidence against your audit period and boundary
- Issues the SOC 2 report or the ISO 27001 certificate; we do not
- Independent of Rheono, which has no stake in the outcome
The loop, step by step
Who owns each step, and what proves it happened.
- 01ScopeYou + Rheono; cSquare GRC checks it against your audit boundaryWritten scope: hosts, test window, exclusions
- 02AuthorizeYouSigned authorization with rules of engagement, valid 90 days (ISO 27001 A.8.34)
- 03TestRheonoTimestamped run history in your portal
- 04FindingsRheonoWorking PoC, CVSS, CWE and control references per finding
- 05FixYou; cSquare GRC tracks itTickets in GitHub, Jira or Linear; remediation status in cSquare GRC
- 06RetestRheonoPer-finding retest result in the next signed report
- 07SignRheonoSigned report you can re-verify in the portal at any time
- 08MapcSquare GRCThe evidence pack from your portal, attached to the controls below
- 09ReviewYour auditorThe auditor's own workpapers, from a read-only workspace
- 10ReportYour auditor, onlySOC 2 report or ISO 27001 certificate, issued by the auditor
- 11Stay currentRheono reruns after releases; cSquare GRC tracks freshnessDated runs and the next signed report
Where a pentest lands
The usual mapping. Your auditor decides what counts for your audit.
- SOC 2
- CC4.1 (separate evaluations) · CC7.1 (vulnerability detection)
- ISO 27001:2022
- A.8.8 (technical vulnerabilities) · A.8.29 (security testing) · A.8.34 (protecting systems during testing)
- NIS2
- Art. 21(2)(e) and (f); in Germany § 30 Abs. 2 Nr. 5 + 6 BSIG
- DORA
- Art. 24–25 (resilience testing of ICT systems). Not threat-led testing (TLPT, Art. 26)
What you hold at the end
- A signed report per cycle: scope, method, findings with PoC, an attestation of what was tested
- Retest results for every fixed finding
- An evidence pack from your portal: signed reports, findings register with control references, SHA-256 manifest
- Findings as tickets in your own tracker
- In cSquare GRC: the report mapped to your controls, remediation tracked, a workspace for your auditor
Audit questions
- Is this a certified pentest? No.
- Neither SOC 2 nor ISO 27001 certifies a single pentest, and Rheono is not a BSI-certified IS-Penetrationstest provider. If a contract requires BSI or CREST accreditation, tell us at scoping and we say in writing whether we fit.
- Who signs what?
- Rheono signs the pentest report. Signature: Advanced electronic signature (eIDAS, PAdES-B-T) + qualified timestamp (RFC 3161). Samir Abis is the person named in your contract and accountable for it. That signature proves who issued the report and that it has not changed. It is not an audit opinion: only your auditor signs the SOC 2 report or the ISO 27001 certificate.
- Will my auditor accept the report?
- Your auditor decides, not us. The report is built for their review: scope inside your audit boundary, dates inside your audit period, method, severity, fix and retest status, signed. Send them the sample report before you start.
- Is anyone here marking their own homework?
- No. Rheono tests and retests but does not implement your fixes. cSquare GRC runs the program but does not test. Your auditor reviews work none of it did and issues the result.
- Do you do DORA threat-led penetration testing (TLPT)?
- No. TLPT under DORA Art. 26 needs providers with threat-intelligence and red-team accreditation. Rheono covers the regular testing of web apps and APIs under Art. 24–25.
- How is it priced?
- Rheono is any published plan, flat, no per-scan meter. cSquare GRC prices its program itself. One joint scoping call covers both, and both numbers come in writing before anything runs.