# Compliance Penetration Test

> From $5.5K · Offensive Security · https://cisomarketplace.services/services/compliance-penetration-test

Startups and smaller companies often need a real penetration test for an audit or a customer contract, not a multi-week offensive campaign. This is a fixed-scope, human-led test of one application or external perimeter with a report auditors accept, a retest of fixed findings and an attestation letter — the entry point to the Penetration Testing and Red Team services.

## In scope

- One web application or API, or an external perimeter up to 25 IPs
- Manual testing against OWASP Top 10 / ASVS and common misconfigurations
- Authenticated testing with two user roles
- Retest of remediated findings
- Auditor- and customer-ready attestation letter

## Deliverables

- Penetration test report with reproducible findings
- Remediation guidance for developers
- Retest results
- Attestation letter

## Tiers

### Essential Compliance Pentest: $5.5K

ONE target: a single web application or API with up to 2 user roles — alternatively an external perimeter of up to 25 IPs instead of the application, never both. Report, one retest and an attestation letter.

Limits: web apps 1, apis 1, external ips 25

Excludes:
- Internal network testing
- Social engineering and physical testing
- More than one target — that is the Advanced tier

### Advanced Compliance Pentest: $9.5K

Web app plus API, or app plus external perimeter; adds cloud configuration spot-check and a findings walkthrough

Limits: web apps 1, apis 2, external ips 50

Excludes:
- Internal network testing
- Social engineering and physical testing

### Enterprise Compliance Pentest: $14.5K

Up to three applications or environments tested together, with a consolidated report for multiple frameworks

Limits: web apps 3, apis 5, external ips 100

Excludes:
- Internal network testing beyond a single segment
- Red-team style objectives — see Red Team Assessment

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=compliance-penetration-test