Washington, DC Penetration Testing Services

The same fixed prices we publish for everyone: external network testing from $4,200, web application testing from $5,200, API testing from $4,000, internal network testing from $6,000, and cloud testing from $6,800, each agreed in writing before work starts and each including a free retest. There is no travel charge.

Yes. We test the segmentation around the CUI enclave, the identity and remote-access paths into it, and the systems that hold controlled unclassified information, then report findings mapped to the 800-171 control families so the evidence fits a Level 2 self-assessment or a C3PAO assessment, whichever your contracts call for.

With the 110 NIST SP 800-171 requirements and the evidence an assessor will ask for on each one. Our checklist lists them by family and flags the rows a penetration test or validated scan can evidence. Then test the CUI enclave boundary: external testing from $4,200 and internal testing from $6,000, each with a free retest.

Our testers are in-house employees working from our New York office. Findings and evidence are handled through our platform rather than email, rules of engagement and data handling are agreed in writing, and testing artifacts are destroyed on the schedule set in the engagement terms.

Yes, as readiness and pre-assessment testing. We test the systems inside and around the boundary and report to NIST SP 800-115 methodology, so findings are fixed before your assessor arrives. We are not a 3PAO, and our report does not replace the assessor’s: the penetration test that counts toward a FedRAMP authorization is run by the FedRAMP recognized assessor on your path.

Yes. Software and service vendors that host or reach criminal justice information for police departments, courts, or other criminal justice agencies meet the FBI CJIS Security Policy through their contract with each agency. There is no CJIS certification, and the policy does not name a penetration test, but version 6.1 requires vulnerability scanning at least monthly, and an independent test shows whether the controls around that data hold. We run the scanning and the testing; we are not a CJIS auditor.

Yes. Associations and nonprofits hold member and donor records, take dues and donations online, and often run Microsoft 365 with volunteer and board accounts that outlive the role. Recipients of federal awards, subrecipients included, must also take reasonable cybersecurity measures to safeguard information, including personally identifiable information, under 2 CFR 200.303(e). We test the email tenant, the donation and member portals, and the donor database remotely, with reports written for boards and funders.

By arrangement. Most engagements are fully remote. For an internal network test we ship a small device to your office, whether it is in Arlington, Fairfax, or Bethesda, and test the network through it. When a scope needs a person in the building, such as a badge-access assessment paired with a red team exercise, we travel from New York and agree it in the proposal.

Scoping takes about a day, onboarding begins within 24 hours of a signed proposal, and testing typically starts within a week. If you are working to an assessment date or a contract deadline, tell us the date and we plan the engagement around it.