Compliance
Compliance & Certification Services
We pair framework readiness with the technical testing auditors and reviewers expect, so you can demonstrate security, not just document it.
See which frameworks apply to your sector on the industries page.
Reports auditors accept
Findings written as usable evidence for your assessor or reviewer, not a raw scanner dump.
Mapped to your controls
Every finding tied to the specific requirements your framework's auditors ask about.
Timed to your audit
Scheduled around your audit window, with a complimentary retest before it closes.
What we cover
Testing and certification for every framework
From audit-ready testing to full Cyber Essentials Plus certification, choose the standard you need to meet, or combine several into a single, coordinated scope. Our guide to penetration testing compliance requirements shows which frameworks require a test.
PCI DSS
The internal, external, and segmentation tests Requirement 11.4 demands, with QSA-ready evidence and a free retest once each fix lands.
ExploreCE Plus Certification
Readiness testing that gets US companies through the Cyber Essentials Plus audit on the first try, with an assessor-ready evidence pack.
ExploreSOC 2
The penetration test auditors expect for your SOC 2 Type I or Type II examination, mapped to the trust services criteria that it supports.
ExploreHIPAA
Testing scoped to the systems handling ePHI, mapped to the HIPAA Security Rule’s technical safeguards, with evidence for the risk analysis.
ExploreISO 27001
The ISO 27001 penetration testing requirements, Annex A 8.8, 8.29, and Clause 9, met with findings mapped to controls and an attestation letter for your auditor.
ExploreGDPR
Article 32 testing of the technical measures protecting EU personal data.
ExploreNYDFS 500
Annual internal and external penetration testing to meet the NYDFS §500.5 mandate.
ExploreCMMC Level 2
Penetration testing that validates your NIST SP 800-171 controls before the C3PAO assessment does.
ExploreFTC Safeguards
The annual penetration test and six-monthly vulnerability assessments 16 CFR 314.4(d)(2) requires of dealers, lenders, and tax preparers.
ExploreHITRUST
Penetration testing inside your HITRUST e1, i1, or r2 assessment scope, reported the way External Assessors read it, with a free retest.
ExploreCCPA Audit
The penetration testing and vulnerability scans the CCPA cybersecurity audit must assess, delivered as evidence your independent auditor can rely on.
ExploreReg S-P
Testing that shows your Regulation S-P safeguards and incident response program work, for advisers, broker-dealers, funds, and transfer agents.
ExploreNY Hospital 405.46
The annual penetration test and vulnerability scanning 10 NYCRR 405.46 requires of New York general hospitals, scoped around patient care.
ExploreReady to test your defenses?
Talk to our team about scoping compliance testing for your environment.