Free Assessment

Table of Contents

Reach SOC 2 Compliance in 6 Weeks or Less.

Request a Demo

Home

  /

  / CMMC Readiness Assessment: Find Gaps Before Your C3PAO

CMMC Readiness Assessment: Find Gaps Before Your C3PAO

Picture of Pedro Dias
Copy Link

CMMC requirements started appearing in Department of Defense contracts on November 10, 2025, when the final DFARS rule took effect. By November 10, 2028, the clause at DFARS 252.204-7021 must appear in every solicitation and contract where contractor systems process, store, or transmit Controlled Unclassified Information (CUI). For most of the Defense Industrial Base (DIB), the math is blunt: pass a CMMC assessment or lose eligibility for DoD work.

A CMMC readiness assessment is how you find out whether you’d pass before the stakes are real. It’s a structured review of your environment, documentation, and evidence against the requirements of the Cybersecurity Maturity Model Certification, done before you sit for a self-assessment or a Certified Third-Party Assessment Organization (C3PAO) audit. A good one tells you exactly where you stand and what to fix first.

This guide covers what a readiness assessment includes, how the process works at each CMMC level, what it costs, how long it takes, and how to pick someone to run one.

What Is a CMMC Readiness Assessment?

A CMMC readiness assessment is a pre-certification evaluation that measures your organization against the specific requirements of your target CMMC level. It examines your scope, implemented controls, System Security Plan (SSP), Plan of Action and Milestones (POA&M), and the evidence supporting them, then produces a gap analysis and a remediation roadmap.

The purpose is simple: surface every deficiency while it’s still cheap to fix. An assessor who finds a scoping error during a readiness review costs you a few weeks of rework. A C3PAO who finds the same error during a certification assessment can cost you the assessment fee, months of delay, and in some cases contract eligibility.

How It Differs From an Official C3PAO Audit

An official CMMC Level 2 certification assessment is conducted by a C3PAO accredited by the Cyber AB, the official accreditation body for the CMMC ecosystem. The C3PAO’s findings are binding. Results go into the DoD’s assessment systems, and a passing result produces a CMMC status that contracting officers verify before award. A readiness assessment carries no official weight. Nothing gets filed or certified, and a poor result costs you nothing beyond the work needed to fix it. That’s the whole point. It’s the only stage in the entire process where failure is free.

There’s also a conflict-of-interest rule worth knowing. A C3PAO cannot provide consulting and remediation services to an organization and then certify that same organization. If a C3PAO helps you prepare, a different C3PAO has to assess you.

How It Differs From a Mock Assessment

A mock assessment is a dress rehearsal. It simulates the certification assessment itself: assessors interview control owners, request evidence on the spot, and score findings the way a C3PAO would. A readiness assessment is broader and comes earlier, and its job is discovering and closing gaps rather than rehearsing the exam. Most organizations run a readiness assessment first, remediate, then run a mock assessment a few weeks before the real one to see whether staff and evidence hold up under live questioning.

How It Differs From a Self-Assessment

A self-assessment is a formal CMMC mechanism rather than a preparation exercise. CMMC Level 1 and a subset of Level 2 contracts let organizations self-assess, post the results to the Supplier Performance Risk System (SPRS), and have a senior official affirm compliance annually. That affirmation is a representation to the government, and false or careless affirmations carry False Claims Act exposure. A readiness assessment is the check you run before making that representation, so the number you affirm reflects reality.

Why a CMMC Readiness Assessment Matters

Why a CMMC Readiness Assessment Matters

Avoiding Failed Certification Attempts

CMMC Level 2 covers all 110 security controls of NIST SP 800-171, evaluated against 320 assessment objectives. Every objective has to be met for a control to score, and there’s no partial credit. Organizations that skip readiness work routinely walk into certification believing they’re compliant because controls are “mostly” implemented. Mostly implemented scores the same as not implemented.

Protecting DoD Contract Eligibility

Under the phased rollout that began in November 2025, CMMC status is a condition of award. Prime contractors also have to flow the requirement down to subcontractors that handle Federal Contract Information (FCI) or CUI, and they’ve been pushing their supply chains hard. So a missed certification hurts twice: you lose the immediate contract, and you risk dropping out of a prime’s approved supplier pool during the exact window when those pools are being rebuilt around CMMC status.

Reducing Remediation Costs and Delays

Gaps found early get fixed on your schedule with your choice of solution. Gaps found during certification get fixed under deadline pressure, often with whatever expensive tooling can be deployed fastest. There’s a conditional CMMC status for organizations that pass with a limited POA&M, but closeout has to happen within 180 days, and only certain lower-weighted controls are POA&M-eligible in the first place. Readiness work keeps you out of that corner.

Worth Knowing: The DoD Assessment Methodology

The DoD Assessment Methodology weights each NIST SP 800-171 control at 1, 3, or 5 points, deducted from a starting score of 110. The floor is -203. To achieve even a conditional Level 2 status, you need a minimum score of 88. A handful of unmet 5-point controls, such as FIPS-validated encryption or multifactor authentication, can put certification out of reach on their own, so a readiness assessment should always show the point weight attached to every gap.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

Schedule a consultation

When to Conduct a CMMC Readiness Assessment

  • Before your first self-assessment. If a contract requires a Level 1 or Level 2 self-assessment, run readiness work before you post a score to SPRS. The score you affirm is a legal representation, and it’s far easier to fix the environment than to explain a misstated score later.
  • When contract requirements are approaching. If CMMC language has shown up in a solicitation you plan to bid, or your prime has set a certification deadline, count backward. Remediation after a readiness assessment typically takes six to twelve months for organizations starting from a moderate posture, and C3PAO scheduling adds lead time on top.
  • After a significant environment or system change. A migration to a new cloud tenant, an acquisition, a new facility, or a redesigned CUI enclave can invalidate assumptions your entire compliance program rests on. Reassess whenever the boundary moves.
  • On a recurring basis. CMMC requires an annual affirmation of continued compliance by an affirming official. An annual internal readiness cycle gives that affirmation a factual basis and catches drift before it compounds.

What a CMMC Readiness Assessment Includes

A thorough readiness assessment covers nine areas, and the order matters because each builds on the last.

  1. Scope definition and CUI boundary mapping.
    Everything starts with scope. The assessment identifies where FCI and CUI live, which systems process, store, or transmit them, and whether the boundary is defensible. Plenty of organizations discover their assumed CUI enclave leaks: a backup job copies CUI to an out-of-scope server, or a shared mailbox pulls it into the corporate tenant.

  2. Information flow and asset inventory review.
    Assets get categorized the way CMMC scoping guidance requires, including CUI assets, security protection assets, contractor risk managed assets, and specialized assets. Data flow diagrams get tested against reality rather than against what the network diagram from 2022 says.

  3. Control evaluation against CMMC requirements.
    Each in-scope control gets evaluated at the assessment objective level. For Level 2, that means all 320 objectives across the 110 controls of NIST SP 800-171, judged as met, not met, or not applicable.

  4. SSP review. The System Security Plan is the anchor document of any CMMC assessment. Assessors check whether it describes the environment as it actually exists, addresses every control, and matches the scoping documentation. An SSP that contradicts the evidence is one of the fastest ways to lose an assessor’s confidence.

  5. POA&M validation. Open items get reviewed for POA&M eligibility, realistic milestones, and assigned owners. Items that should’ve been closed years ago get flagged, because a stale POA&M signals a compliance program that isn’t actually running.

  6. SPRS score calculation and review. The assessment recalculates your score under the DoD Assessment Methodology and compares it with what’s currently posted in SPRS. Discrepancies get corrected before they become a problem in an official review.

  7. Evidence and documentation compilation. For every objective, the assessment confirms that evidence exists, is current, and can be produced quickly. Policies, screenshots, configuration exports, training records, and log samples get organized into an evidence library mapped to objectives.

  8. Gap analysis and risk assessment. Every deficiency gets documented with its affected control, point weight, risk severity, and remediation difficulty.

  9. Remediation roadmap development. Findings become a sequenced plan: quick wins first, high-point-value controls next, long-lead items such as FIPS-validated cryptography or physical security changes scheduled with realistic dates and owners.

Insider Note: Scoping errors sink more certification attempts than technical control failures do. Assessors can only assess the boundary you present, and if CUI turns out to flow outside it, the assessment stops being a test of your controls and becomes a test of your credibility. Spend a disproportionate share of readiness time proving the boundary, especially anywhere email, file sharing, or managed service provider access touches CUI. Your MSP or MSSP belongs in a shared responsibility matrix that states, control by control, who does what. And if a cloud provider stores or processes CUI on your behalf, it needs to meet FedRAMP Moderate or equivalent.

CMMC Readiness Assessment Process: Step-by-Step

Step 1: Initial scoping and kickoff.
Define the target CMMC level, identify the contracts driving the requirement, map where CUI and FCI live, and agree on the assessment boundary. This step also sets logistics: who gets interviewed, what documentation exists, and what access the assessors need.

Step 2: Documentation and control review.
Assessors review the SSP, policies, procedures, network diagrams, asset inventories, and the existing POA&M. Documentation gaps surface here, and they’re usually extensive. Most organizations have implemented more than they’ve documented, which matters because an undocumented control often can’t be verified.

Step 3: Technical testing and interviews.
Assessors validate that controls operate as described. That means reviewing configurations, sampling logs, checking MFA enforcement, inspecting encryption settings, and interviewing the people who own each control. Interviews expose the difference between a policy that exists and a practice that happens.

Step 4: Gap analysis and reporting.
Findings get consolidated into a gap report scored against the assessment objectives, with an updated SPRS calculation and a severity ranking for each deficiency.

Step 5: Remediation planning.
The final step converts findings into a plan with owners, dates, dependencies, and budget implications, ordered so the highest-weight and longest-lead items start first.

Readiness Assessment by CMMC Level

CMMC 2.0 has three levels, and readiness work scales sharply between them.

  • Level 1 readiness verifies the 15 basic safeguarding requirements for FCI. The work is light, but the annual self-assessment and affirmation still carry legal weight, so evidence should exist for every requirement.
  • Level 2 readiness is where most of the DIB lives. It covers the full NIST SP 800-171 control set at the objective level, and it’s the level this article’s process describes. Contracts specify whether Level 2 requires a C3PAO certification or a self-assessment. The security bar is identical either way.
  • Level 3 readiness applies to a small slice of contractors supporting the most sensitive programs. It requires a final Level 2 certification first, then implementation of 24 enhanced requirements from NIST SP 800-172 built to resist advanced persistent threats. The assessment is performed by the government’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) rather than a C3PAO, and readiness work has to address the stricter Level 3 scoping model as well as the enhanced controls.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

Schedule a consultation

CMMC Readiness Assessment Deliverables

A credible readiness engagement ends with five artifacts.

  • The gap analysis report documents every deficiency at the objective level with severity and point impact.
  • The updated SSP and POA&M reflect the environment as found, with POA&M entries limited to genuinely eligible items.
  • The SPRS score summary shows your recalculated score, the delta from what’s posted, and where the score lands as remediation progresses. The prioritized remediation roadmap sequences the work with owners, dates, and cost estimates.
  • Finally, the executive summary gives leadership what they actually need: certification probability today, the investment required, the timeline, and the contract revenue at risk if the timeline slips.

CMMC Readiness Assessment Checklist

Use this as the closing pass before you schedule anything official.

  • Confirm every control is implemented and verifiable. Implemented means all assessment objectives are met, and evidence proves it. If you can’t produce the evidence within a day, treat the control as unverified.

  • Validate the SSP and POA&M are current. Both documents should describe today’s environment, reference today’s system names, and carry no entries that contradict each other or the network reality.

  • Recalculate and review your SPRS score. Run the DoD Assessment Methodology from scratch rather than editing last year’s spreadsheet, and reconcile the result with what SPRS currently shows.

  • Check consistency across systems and documents. Assessors cross-reference constantly. The asset inventory, the SSP, the data flow diagrams, and the actual configurations have to tell one story.

  • Validate control ownership. Every control needs a named owner who can speak to how it works. “The IT team handles that” is an interview answer that fails.

  • Conduct a mock assessment. Once gaps are closed, rehearse under live conditions with someone playing an unfriendly assessor.

  • Maintain continuous monitoring. Readiness decays. Patch cadence, log review, access recertification, and training records need to keep running between assessments, because the annual affirmation asserts that they did.

Pro Tip: Run Evidence Drills before any Assessment

Run evidence drills before any assessment, readiness or official. Pick ten random assessment objectives and give the control owner 30 minutes to produce current proof for each. Organizations that pass certification smoothly are rarely the ones with the best security tooling. They're the ones that can retrieve any artifact in minutes, because slow evidence retrieval reads as weak control operation even when the control itself is fine.

How Long Does a CMMC Readiness Assessment Take?

The assessment itself typically runs two to six weeks. Small organizations with a contained CUI enclave sit at the short end. Mid-sized contractors with a few hundred employees and multiple systems usually need four to six weeks, and large or multi-site environments can take two to three months before the report is final.

The larger number is what follows. Remediation commonly takes six to twelve months depending on where you start, and the biggest schedule drivers are consistent: unclear CUI boundaries that force re-scoping, long-lead technical items such as FIPS-validated cryptography, dependency on MSPs whose own posture has to be verified, and documentation debt that takes longer to clear than anyone budgets. Environment complexity, staff availability for interviews, and how much evidence already exists in retrievable form all move the timeline more than headcount does.

Common Challenges During a CMMC Readiness Assessment

Underestimating time and resources. Readiness work competes with day jobs. The interview schedule alone can eat dozens of staff hours, and remediation always uncovers second-order work.

Scoping and CUI boundary uncertainty. Many contractors can’t say with confidence where all their CUI is. Legacy file shares, email threads, and subcontractor exchanges scatter it, and every newly discovered location expands scope.

Manual documentation management. Spreadsheets tracking 320 objectives across policies, evidence files, and owners break down fast. Version confusion between the SSP, the POA&M, and reality is one of the most common findings in readiness work.

Linking controls, risks, and evidence. Assessors think in terms of objective, implementation, and proof. Organizations that store evidence by department or by tool rather than by control spend the assessment scrambling to translate.

Choosing a CMMC Readiness Assessment Partner

Look for credentials issued within the CMMC ecosystem. A Registered Provider Organization (RPO) is authorized by the Cyber AB to provide consulting and preparation services. Individual practitioners should hold the Certified CMMC Professional (CCP) or Certified CMMC Assessor (CCA) credential, with CCAs bringing direct experience of how official assessments actually get scored.

Before hiring, ask a few pointed questions. How many Level 2 environments has the team taken through readiness, and how many of those went on to pass certification? Will the assessment evaluate at the assessment objective level or only at the control level? Does the deliverable include an updated SSP and a costed roadmap, or just a findings list? How do they handle MSP and cloud provider responsibilities? Vague answers to any of these predict a shallow engagement.

On independence: an in-house readiness review beats none, and it builds internal capability. But independent assessors catch what familiarity hides, and their findings carry more weight with leadership when remediation needs budget. If your certification path runs through a C3PAO, remember that the assessing C3PAO can’t also be your preparation consultant, so plan for separate parties from the start.

A CMMC readiness assessment is the cheapest point in the entire certification journey to discover bad news. It defines your true scope, scores your real posture against every applicable assessment objective, aligns your SSP, POA&M, and SPRS score with reality, and converts everything it finds into a sequenced plan. With CMMC clauses now flowing into DoD contracts and full inclusion required by late 2028, the contractors who treat readiness as a project this year will be the ones still bidding in three.

Frequently Asked Questions

Is a CMMC Readiness Assessment Required?

No. Neither 32 CFR Part 170 nor the DFARS clauses require one. What the rules require is the outcome a readiness assessment protects: a truthful SPRS score, a passing assessment at the required level, and an annual affirmation you can stand behind.

Yes, and for Level 1 it’s often enough. For Level 2, internal reviews work best as a recurring discipline, supplemented by an external assessment before certification. Internal teams tend to assess intent while external assessors assess evidence, and certification is scored on evidence.

A gap analysis is one component: the comparison of your current state against the requirements. A readiness assessment wraps that comparison in scoping validation, SSP and POA&M review, SPRS recalculation, evidence compilation, and a remediation roadmap.

At minimum, annually, aligned with the affirmation cycle, plus after any major environmental change and before any official assessment. Continuous monitoring between cycles keeps the annual pass small.

No. It cuts the risk of surprise to near zero if you remediate what it finds, but the certification result depends on the official assessment of your environment on the day. Any provider guaranteeing certification is telling you something about their integrity rather than your posture.

A C3PAO can perform readiness and consulting work, but it can’t then conduct your official certification assessment. If you want a C3PAO’s perspective during preparation, engage one C3PAO for readiness and a different one for certification, and confirm the separation in writing.

Axipro Author

Picture of Pedro Dias

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.
  • CMMC
Copy Link

Blog Highlights

Explore More Articles

Read More Blogs

Agentic AI Risk Management: Why Agentic Autonomy Needs Its Own Line in Your Risk Register

For the past two years, enterprise AI risk conversations have centered on a familiar set of concerns: model bias, hallucination, data privacy, and dependency on third-party models. These are real risks, and most organizations now run some version of a governance program to manage them. But something has shifted. Organizations are no longer just deploying AI that generates content for a human to review. They’re deploying AI that acts. Agents now plan multi-step tasks, call APIs, move data between systems, execute transactions, and coordinate with other agents, often with no human checkpoint in the loop. That shift deserves more than a footnote in the existing AI risk category. It deserves its own line in the risk register: Agentic Autonomy Risk. What Is Agentic AI Risk Management? Agentic AI risk management is the practice of identifying, assessing, and controlling the risks created when AI systems take autonomous action on an organization’s behalf. Where traditional AI governance evaluates outputs (accuracy, bias, privacy), agentic AI risk management governs what agents actually do: the tools they call, the permissions they inherit, and the downstream consequences of their actions. That distinction is the reason existing risk registers struggle with agents, and it’s worth unpacking properly. What Agentic AI Actually Changes Traditional AI systems, even generative ones, are advisory. They produce an output such as a summary, a prediction, a draft email, or a classification, and a human remains the last checkpoint before anything happens in the real world. Agentic AI removes that checkpoint. An agentic system doesn’t just produce an answer. It pursues a goal. It decides which tools to call and in what order, then executes those actions directly against live systems: submitting a purchase order, modifying a database record, sending an external communication, or orchestrating a set of sub-agents to complete a broader workflow. Agentic autonomy is the degree to which a system can plan and execute actions without a human explicitly authorizing each step. It’s a spectrum rather than a binary. At one end, the AI drafts and a human approves every action. At the other, the AI operates within broad guardrails and only escalates exceptions. The further an organization moves along that spectrum, the less its exposure looks like software risk and the more it looks like delegated authority risk, the kind normally reserved for employees, contractors, and automated financial systems. Why Existing Risk Registers Miss Agentic AI Risks Most enterprise risk registers were built on a reasonably safe assumption: a human initiates consequential actions, and the technology around that human behaves deterministically. Agentic AI breaks both halves of that assumption at once. A few specific gaps show up quickly when organizations try to map agentic deployments onto existing categories. Operational risk registers assume process failures come from human error or system outages, not from a system independently choosing an unanticipated path to a stated goal. Cybersecurity risk registers are built around unauthorized external access, while an agent problem usually involves an authorized system taking unauthorized internal actions with its own legitimate credentials. Model risk frameworks, borrowed largely from financial services, evaluate output accuracy rather than action consequences, which matters most when those actions can’t be reversed. And third-party risk assessments treat vendors as static entities, not as autonomous agents that might invoke other vendors’ agents on your behalf. See our guide to the NIST AI Risk Management Framework for how output-focused frameworks are structured. The result is a governance blind spot. An organization can be compliant against its AI policy, its cybersecurity policy, and its vendor risk policy, and still have nobody accountable for the specific risk of a system initiating a harmful sequence of actions before anyone notices. Defining Agentic Autonomy Risk Agentic Autonomy Risk is the risk that an AI system, operating with delegated decision-making and execution authority, takes actions that are harmful, non-compliant, or misaligned with organizational intent before adequate human oversight can intervene. Those actions might happen independently or in coordination with other agents. It deserves standing as a named category alongside cybersecurity, operational, legal, financial, and third-party risk because the loss event itself is different. The harm is a completed action in a live system, and it may be difficult or impossible to reverse. The accountability structure is different too: when an orchestrating agent delegates to sub-agents, responsibility for the outcome gets distributed in ways existing ownership models don’t cleanly capture. So is the detection window. Traditional controls assume a human is positioned to catch an error before it compounds, but an agent can execute dozens of dependent actions faster than any human review cycle. 7 Agentic AI Risk Scenarios to Put on Your Register 1. Unauthorized autonomous decision-making. An agent takes an action within its technical permissions but outside its intended business mandate. It adjusts pricing, approves a refund, or modifies a customer record, and no policy ever explicitly authorized that scenario. 2. Goal misalignment. The agent optimizes for a literal interpretation of its objective in a way that diverges from actual business intent, particularly under ambiguous or adversarial inputs. 3. Multi-agent interactions and cascading failures. One agent’s flawed output becomes another agent’s trusted input. A single error can propagate across a chain of agents faster than anyone can detect it, amplifying the original mistake instead of containing it. 4. Excessive tool or system permissions. Agents get provisioned with broad, standing access “to be safe” rather than scoped, least-privilege access tied to specific tasks. A productivity tool quietly becomes a privilege-escalation path. 5. Regulatory non-compliance. Autonomous actions trigger obligations under data protection, financial services, employment, or sector-specific regulation, and they execute without the compliance review a human-initiated process would normally receive. 6. Explainability and accountability gaps. An autonomous action causes harm and the organization can’t clearly reconstruct why the agent chose that path, or establish whether the business owner, the AI governance function, or the vendor is accountable for the outcome. 7. Autonomous third-party actions. A vendor’s agent, integrated into your environment, takes action on your behalf, or your agent acts against a

Read more

SOC 2 Penetration Testing Cost: 2026 Price Ranges

A SOC 2 penetration test costs between $1,000 and $30,000 for most companies. A typical SaaS scope, meaning one web application, its API layer, and the cloud infrastructure behind it, usually lands between $2,000 and $20,000. Early-stage startups with a narrow scope can get an auditor-accepted test for $1,000 to $8,000, while enterprises with multiple products and hybrid infrastructure regularly spend $20,000 to $50,000 or more. The spread is wide because “penetration test” covers everything from an automated scan with a cover page to weeks of manual testing by senior engineers. Auditors know the difference, and so do the enterprise customers who asked for your SOC 2 report in the first place. This guide breaks down what drives the price, where the hidden costs sit, and how to buy a test that holds up in fieldwork without overpaying for it. What Is SOC 2 Penetration Testing?​ A SOC 2 penetration test is a simulated attack on your systems, performed by a qualified security professional, scoped to the environment covered by your SOC 2 report. The tester tries to exploit real weaknesses the way an attacker would: broken access controls, injection flaws, misconfigured cloud services, exposed credentials. The output is a report your auditor reads as evidence that your security controls work in practice, not only on paper. That last part matters. A pentest bought for SOC 2 has a second audience beyond your security team. If the report doesn’t map findings to your audit scope, document its methodology, and show remediation, it fails the job you bought it for. We cover the full deliverable in our guide to what a SOC 2-ready VAPT report includes. How Penetration Testing Fits Into SOC 2 Compliance​ SOC 2 is built on the AICPA’s Trust Services Criteria, and the Security category (the Common Criteria) applies to every report. Penetration testing is the standard way to satisfy CC7.1, which expects you to detect and monitor for new vulnerabilities, and it supports CC4.1, which covers ongoing evaluations of whether controls actually function. The AICPA’s points of focus explicitly mention vulnerability scanning and penetration testing as examples of how companies meet these criteria. In practice, the test slots into your audit timeline as an evidence item. Your auditor will ask for the report, check the test date against the audit period, and review how you handled the findings. Remediation is often scrutinized harder than the test itself, because it shows whether your vulnerability management process runs or merely exists. Is Penetration Testing Required for SOC 2?​ Strictly speaking, no. The Trust Services Criteria never use the word “mandatory” about penetration testing. You could theoretically satisfy CC7.1 with vulnerability scanning and strong monitoring alone. In reality, almost every auditor expects one, and skipping it invites two problems. First, your auditor may push back during fieldwork or add exceptions to the report. Second, the enterprise buyers reviewing your SOC 2 report increasingly look for pentest evidence specifically, and a report without it raises questions during procurement. Treat the test as effectively required and budget for it from the start of your SOC 2 compliance checklist. How Much Does SOC 2 Penetration Testing Cost? Typical Price Range for SOC 2 Pen Testing Most companies pay $1,000 to $30,000, with the median engagement for a SaaS business sitting around $12,000 to $15,000. Compliance-focused tests at the lower end of the market start around $1,000 to $5,000. Deep manual testing from established firms runs $10,000 to $30,000. Anything quoted below roughly $3,000 is almost certainly automated scanning packaged as a pentest, which auditors are getting better at spotting. Cost by Company Size (Startup, SMB, Enterprise) Company size is a proxy, not the driver. A 15-person company with three products and a legacy on-prem component will pay more than a 200-person company with one tightly scoped SaaS platform. Testers price effort, and effort follows scope. Cost by Test Type (Network, Web App, API, Cloud, Internal/External) Most SOC 2 engagements bundle two or three of these. The common package for a cloud-native SaaS company is web app plus API plus cloud configuration, which is why the $1,000 to $20,000 band comes up so often. Companies with office networks and internal systems in their audit scope add internal network testing, and the price climbs accordingly. Factors That Influence SOC 2 Penetration Testing Cost Scope and Number of Assets Tested Scope is the single biggest cost driver. Every additional application, API endpoint group, cloud account, or network segment adds testing hours. A pentest priced without a scoping call is a pentest priced on guesswork, and the guess usually favors the vendor. Complexity of Application or Infrastructure​ A simple CRUD app with two user roles tests quickly. A multi-tenant platform with role hierarchies, workflow engines, file processing, and third-party integrations takes far longer, because each of those features creates attack surface a tester has to work through manually. Authentication tiers matter especially: every distinct role needs testing for privilege escalation and cross-tenant data access. Testing Methodology (Black Box, Grey Box, White Box) Black box testing gives the tester nothing but a URL, grey box adds credentials and documentation, and white box adds source code and architecture diagrams. Grey box is the default for SOC 2 and usually the best value, since the tester spends time exploiting rather than discovering. White box costs more upfront but finds deeper issues. Black box sounds rigorous but often wastes paid hours on reconnaissance an attacker would run for free. Depth of Testing and Manual vs. Automated Approaches Automated scanning finds known vulnerability patterns. Manual testing finds business logic flaws, chained exploits, and authorization gaps that no scanner catches, and it’s the part auditors and security-literate customers actually value. The ratio of manual work to automation is the honest explanation for most price differences between two quotes covering the same scope. Tester Credentials and Firm Reputation Senior testers holding OSCP, GPEN, or CREST credentials bill higher rates, and firms with recognized methodologies charge a premium for the credibility their letterhead carries

Read more

LiteLLM Supply-Chain Breach: How to Check If You’re Exposed and What to Rotate

Two compromised versions of LiteLLM sat on PyPI for roughly 40 minutes on the morning of March 24, 2026. That window was enough to capture secrets from around 434,000 CI/CD pipeline runs across nearly 2,500 organizations, including AWS, Samsung, Cisco, Salesforce, Siemens, and Deloitte. In August, researchers at CloudSEK and Hudson Rock confirmed they had obtained the raw exfiltrated data: a 153GB archive containing 433,909 files of environment variables, cloud keys, Kubernetes secrets, and API tokens harvested live from running pipelines, as covered by Help Net Security’s reporting on the credential archive. If LiteLLM runs anywhere in your stack, or you touch any AI proxy infrastructure at all, you need answers to three things: whether you were exposed, what to rotate first, and whether the rotation you did back in March actually held. That last one matters more than it sounds, because “we rotated everything” has already burned at least one very large company. How the Breach Happened The attack didn’t start with LiteLLM. On March 19, 2026, a threat group called TeamPCP compromised the build pipeline of Trivy, a vulnerability scanner half the industry runs, and pushed a poisoned release. LiteLLM’s own CI pipeline ran Trivy, so the poisoned scanner had legitimate read access to the project’s runner environment. The attackers used that to steal LiteLLM’s PyPI publishing tokens and ship two malicious releases of their own: versions 1.82.7 and 1.82.8. KICS and the Telnyx Python SDK got hit in the same campaign. The payload design is the part worth studying. The malicious package dropped a .pth startup hook into site-packages, so the code ran the moment any Python interpreter started on the machine, whether or not anything imported LiteLLM. From there it harvested environment variables, read local credential files like .aws/credentials and .kube/config, tried to move laterally across Kubernetes clusters, and installed a systemd backdoor dressed up as a generic telemetry service. InfoQ’s coverage of the PyPI compromise put downloads of the compromised release above 40,000. For scale, LiteLLM normally gets downloaded around 3 million times a day. The exfiltration had a nasty fallback, too. According to CloudSEK, stolen data was encrypted and sent to a typosquatted domain, and when that failed, the malware created a public repository inside the victim’s own GitHub account and uploaded the loot as a release asset. Some companies were publishing their own secrets to the open internet and had no idea. Worth Knowing: The malicious code only existed in the PyPI artifacts. The GitHub source repository stayed clean the whole time, so a developer reviewing the code on GitHub saw nothing wrong. Source review isn’t artifact verification. If you don’t check that what the registry serves matches the upstream source, this class of attack is invisible to you. How to Check If You Were Exposed Three checks, from quickest to most involved. 1. Confirm whether the compromised versions ever ran The malicious versions went live on PyPI at 10:39 UTC on March 24, 2026 and got quarantined about 40 minutes later. The project’s advice: treat any install from that day before 16:00 UTC as suspect. Search your lockfiles, pip caches, SBOMs, and container image histories for 1.82.7 and 1.82.8. And check your internal artifact mirrors. An Artifactory or Nexus proxy that cached the bad release in March can keep serving it internally long after PyPI pulled it. Keep the .pth mechanism in mind when you scope this. The question isn’t “which applications import LiteLLM,” it’s “which machines had the package installed at all,” because every Python process on an infected machine triggered the payload. 2. Hunt for persistence Rotation is pointless if the attacker still has a foothold. Check developer machines, CI runners, and containers for unauthorized .pth files in site-packages and for suspicious systemd units, especially anything posing as a system telemetry service. And review activity from March 24 onward, not just the 40-minute window. Persistence is there so the access outlives the infection. Pro Tip: Don’t limit the persistence hunt to live machines. Base container images rebuilt in late March may have baked the payload into every image derived from them since. Scan your image registry for the affected LiteLLM versions and for unexpected .pth files, then trace which running workloads came from flagged images. 3. Check whether your secrets are in the dump Hudson Rock has published a domain lookup tool and is running ethical disclosures for affected organizations, and CloudSEK maintains a high-confidence victim list. Use them, but know their limits. Attribution in this dataset is genuinely hard. One dump with a siriusxm.com committer email actually traced, through its self-hosted GitLab endpoints, to AdsWizz, a SiriusXM subsidiary. And a large share of the dumps are generic pipeline configurations with no identifying domain, email, or server name at all. Absence from a victim list is not evidence of absence. If your pipelines ran the compromised versions, assume exposure no matter what a lookup tool tells you. What to Rotate, in What Order The guidance from both research teams is blunt: treat every secret the LiteLLM environment could reach as compromised. That covers secrets on disk, in memory, injected into CI jobs, and anything retrievable through instance metadata services. Work down by blast radius: Priority Credential type Why it comes first 1 Cloud IAM keys (AWS, GCP, Azure) Direct control of infrastructure, data stores, and billing. This is where attackers monetize fastest. 2 GitHub and GitLab PATs, package publishing tokens These let an attacker poison your releases and turn your company into the next link in the supply chain. 3 Kubernetes service account tokens and kubeconfigs Lateral movement across clusters was built into the payload, not a theoretical risk. 4 Database passwords and third-party API keys Dumped in plain text in the archive, often with no attribution, so nobody will warn you they leaked. 5 AI provider API keys Billing abuse, quota theft, and access to whatever data flows through your LLM routing layer. One word matters more than the rest of this article: revoke, don’t just rotate. That

Read more