Amazon SP-API DPP Penetration Testing

Clause 2.7.2 states that the Solution Provider must perform penetration testing at least every 365 days using an industry-recognized methodology, and it enumerates four scope categories: network infrastructure, cloud environments, application-layer assets, and other in-scope systems. It sits alongside 2.7.1, which requires vulnerability scanning at least every 30 days and scanning after significant network, application or infrastructure changes, and 2.7.3, which requires critical findings remediated within 7 days and high within 30. Section 2 applies where a restricted role handles personally identifiable information. Source: the Data Protection Policy on sellercentral.amazon.com.

Our published price. The plan for a DPP submission is the Compliance Plan at INR 1,79,999, which covers two scopes, and each additional scope is INR 74,999. Because clause 2.7.2 enumerates four scope categories, a DPP engagement is normally four scopes, one each for the web application, the API backend, the cloud environment and the network. That is INR 3,29,997. Where the estate allows the work to come to three scopes it is INR 2,54,998. Both figures exclude taxes and both include 12 hours of founder-led consulting and one free retest. We publish this rather than quote the two scope price and raise it once we have seen your architecture.

A scope is six business days, five days of testing and one day writing the report. One scope is 6 and two is 12. A DPP engagement normally covers more surfaces than that, and we confirm the full schedule when we scope the estate. Business days are Monday to Friday; the weekend is a quality buffer and is not counted. The retest itself takes one to three business days.

Clause 2.7.2 requires an industry-recognized methodology, and we name ours in the report rather than asserting it. Application-layer testing follows OWASP WSTG v4.2 and the OWASP API Security Top 10 2023, with findings carrying their OWASP Top 10:2025 category. The engagement overall follows PTES. Cloud work covers IAM and least privilege, encryption at rest against the policy minimum, environment separation, and logging. The report names the standard against each finding, so a reviewer can see which methodology was applied rather than taking the word for it.

Yes. Two Amazon Solution Providers have engaged Cybersecify for the clause 2.7.2 penetration test under signed statements of work, and both engagements are in delivery. We also publish the evidence set from a DPP engagement of our own: three reports covering the clause 2.7.2 scope categories, available on request. Three limits in the same breath, because a number without them is worth less than no number. We are describing signed and running engagements, not completed submissions. The free retest is part of every engagement, so none of these is a closed file. And none carries an Amazon decision on record, so we quote no approval rate and have none to quote; Amazon decides submissions and we are not in that room. What we can show you is the work. We also publish what the policy requires in detail, including the parts that are commonly misread, such as the fact that the DPP contains no SOC 2 or ISO 27001 requirement and that its stated encryption minimum at rest is AES 128 or RSA 2048 rather than AES 256.

No. The Data Protection Policy contains no SOC 2 and no ISO 27001 requirement. Control mapping to those frameworks is useful for your own auditors and for enterprise customers asking security questions, and we include it on the Compliance Plan, but it is not something Amazon asks for in a DPP submission. Treat anyone selling it as an Amazon requirement with caution.

Not routinely. The policy has no clause requiring you to upload or send the report as a matter of course. Section 3 requires that you maintain the books and records needed to verify compliance during the agreement and for 12 months afterwards, and that upon written request you certify in writing that you are compliant, with Amazon reserving a right to audit. So the report is evidence you hold rather than evidence you file, which is why the quality of the document and the methodology it names matter.

Clause 2.7.3 sets the clock: critical findings remediated within 7 days and high within 30. Your report is ordered so the items on those clocks are unambiguous, each with reproduction steps and specific remediation guidance rather than a generic recommendation. The free retest then confirms the fixes and produces a v2.0 report recording the closed state, which is the document you want on file when section 3 is invoked.