No security audit is needed beyond the annual SOC 2 review

We are assuming the portal is covered by the existing annual SOC 2 review and needs no separate penetration test.

Why it matters — an external pen test is roughly six weeks of lead time and a five-figure cost, neither of which is in the plan.

How we will validate it — written confirmation from the security lead that the new authentication flow falls inside the existing audit scope.

If it turns out false — book the test now, because the lead time is the problem, not the money.