CybersecurityAssessment & Penetration Testing
By How a hands-on assessment validates scanner findings, safely proves which are exploitable under a signed rules of engagement, and ranks fixes by real risk, including how validated findings map to CISA BOD 26-04 remediation clocks.
Every federal system owner has a scan report. Most of them run to thousands of findings, ranked by a generic severity score that knows nothing about the agency's network, its compensating controls, or what an attacker could actually reach. The report says what might be wrong. It does not say which weaknesses a real adversary could use, and that is the question an Authorizing Official, an Inspector General and now a remediation deadline all ask.
The deadlines have tightened. CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaced the old KEV and internet-facing remediation directives with risk-based clocks for civilian agencies: three days, 14 days, 60 days, or fix at the next upgrade, depending on whether an asset is publicly exposed, whether the flaw is in CISA's Known Exploited Vulnerabilities catalog, whether exploitation can be automated, and whether it gives an attacker total control. An agency that does not know which findings are real and reachable does not know which clock applies.
This paper is written for CISOs, ISSMs and ISSOs, system owners, Authorizing Officials and the contracting officers who buy the work. It describes Avalon Technology Services' Vulnerability Assessment & Exploitation service: a hands-on engagement that
A full-scope engagement runs four to eight weeks at a firm fixed price set by scope tier. Section 9 illustrates three representative scopes, from a $20K external-only test to a $100K comprehensive assessment, and shows how validated findings map to the BOD 26-04 clocks. The engagement produces evidence; it does not grant an ATO, certify CMMC compliance, or replace a FedRAMP recognized assessor.
A scanner is good at finding candidate weaknesses and poor at judging them. It flags thousands of items, many of which are false positives, unreachable from any path an attacker has, or neutralized by controls the scanner cannot see. The agency is left with three risks.
| Risk | How it shows up |
|---|---|
| Compliance | FISMA requires periodic independent assessment. The RMF Assess step precedes every authorization. Superficial testing surfaces later as an IG finding or a weak Security Assessment Report. |
| Mission | An unproven finding is an unmanaged risk. The one exploitable path into a mission system can sit unnoticed on page 90 of a 4,000-line report. |
| Cost and priority | Remediation staff and budgets are finite. Without validation, they go to the loudest findings rather than the reachable ones. |
Federal environments make the problem harder. Long-lived systems carry end-of-life components that cannot simply be replaced, so the agency needs to know which known weaknesses are actually exploitable. Testing is tied to the FISMA, RMF and FedRAMP calendars rather than discretionary spending. Most program offices have no offensive-security staff, and assessment independence favors testing by a party outside the system's operators.
"Our scan report is thousands of findings and we don't know where to start." "Our ATO is up for renewal and the assessor wants testing evidence." "We had an IG finding on vulnerability management." "We think we're fine but leadership wants proof." "We can't hire penetration testers." Each is an opening for this service.
BOD 26-04 replaced BOD 22-01 and BOD 19-02 for Federal Civilian Executive Branch agencies. Instead of one timeline for every KEV entry, it assigns a remediation window from four questions about each vulnerability.
| Decision point | What it asks |
|---|---|
| Exposure | Is the vulnerable asset reachable from outside the agency network? |
| Known exploitation | Is the CVE in CISA's Known Exploited Vulnerabilities catalog? |
| Automatable | Can an attacker automate every step needed to exploit it? |
| Technical impact | Does exploitation give total control of the system, or only partial control? |
The highest-risk combinations, such as a KEV-listed flaw that yields total control, must be fixed within three days, with forensic triage to check whether the system is already compromised. Other combinations get 14 or 60 days, and vulnerabilities that meet none of the criteria are fixed at the next upgrade. Agencies had to update policy immediately, update processes within 60 days, and meet the full timelines within about 180 days of issuance.
Two of the four inputs are facts about the agency's own environment, not about the CVE. Whether an asset is truly reachable from outside, and whether the vulnerable component is present and exploitable as configured, is exactly what validation establishes. A scanner's guess at either one can put a finding on the wrong clock: too slow for a real exposure, or an emergency for a component that is not reachable at all.
The same logic runs through the other frameworks. The RMF Assess step and FISMA's annual assessment need tested evidence, not raw scanner output. For cloud providers, FedRAMP's 2026 rules require the annual penetration test to be performed by a FedRAMP Recognized independent assessment service, with independent testing teams and red team exercises required at the higher certification classes. An outside firm can run readiness testing before that assessment, but cannot substitute for it.
| Activity | What happens |
|---|---|
| Scoping and rules of engagement | Define what is in scope (address ranges, URLs, applications, environments), what is off-limits, testing windows, escalation and abort procedures, and data handling. Captured in a signed ROE and an authorization-to-test letter. |
| Reconnaissance and enumeration | Map the attack surface: live hosts, open services, application endpoints and exposed interfaces. |
| Vulnerability identification | Authenticated and unauthenticated scanning, configuration review against benchmarks, and manual inspection across network, host, application and, where scoped, cloud and identity layers. |
| Manual validation | Triage scanner output by hand to remove false positives and confirm which findings are real. |
| Controlled exploitation | Safely demonstrate that a validated vulnerability is exploitable and reachable, and, where scoped, how far an attacker could move from the first foothold. |
| Impact mapping | Translate findings into mission terms: what an adversary could reach, what data or capability is at stake, and how findings chain together. |
| Reporting and readout | A prioritized findings report and an executive briefing. |
| Remediation guidance and retest | Specific fixes for each finding and, after the agency remediates, a verification pass. |
The method follows NIST SP 800-115, the federal technical testing guide, together with the Penetration Testing Execution Standard, the OWASP Web Security Testing Guide and Application Security Verification Standard for applications, and MITRE ATT&CK for adversary technique mapping and reporting language. Tools are used for identification and proof; the deliverable is the analyzed, prioritized result, not a tool export.
Exploitation in this service is authorized, scoped and controlled. The tester's job is to prove that a vulnerability is exploitable, then stop, document the proof and preserve the evidence.
The ROE and the authorization-to-test letter are signed by an official with authority over the systems in scope before any testing begins. They are the legal and operational boundary for every action the testers take.
| Deliverable | Format | Purpose |
|---|---|---|
| Rules of engagement and authorization-to-test letter | Signed PDF | Legal and operational boundary for the test |
| Technical findings report | PDF, with CSV or JSON export on request | Every finding with severity, evidence, affected assets and remediation |
| Prioritized remediation roadmap | PDF and spreadsheet | Fixes ranked by real risk and the applicable remediation clock, not raw CVSS |
| Executive summary and briefing | PDF and live readout | Mission-level risk picture for leadership |
| Evidence package | Screenshots, logs, artifacts handled per the ROE | Proof of exploitability for assessment and audit files |
| Retest memo (if scoped) | Confirms remediated findings are closed |
| Excluded | Where it belongs |
|---|---|
| Remediation | The agency's engineers, or Avalon's Remediation & Patch Management service. The SOW draws the line. |
| Authorization or certification | The ATO rests with the Authorizing Official; CMMC certification with a C3PAO; FedRAMP's annual assessment with a FedRAMP Recognized assessor. |
| Continuous monitoring | A point-in-time test is a snapshot. Ongoing monitoring is a separate service. |
| A bare scan | Scan-only work is lighter and cheaper, and is scoped and priced separately rather than sold as this service. |
| Network-only or design-stage analysis | Avalon's External & Internal Network Testing and Risk Evaluation & Threat Modeling services; the SOW states which applies. |
| Phase | Duration | What happens |
|---|---|---|
| 1. Kickoff and scoping | 3–5 business days | Scope, ROE and authorization letter signed; windows confirmed; contacts and escalation paths exchanged; credentials for authenticated testing gathered |
| 2. Reconnaissance and identification | 1–2 weeks | Attack surface mapped; scanning and configuration review; candidate findings list |
| 3. Validation and controlled exploitation | 1–2 weeks | False positives removed; exploitable findings confirmed and safely demonstrated; evidence captured |
| 4. Analysis and reporting | 1 week | Mission impact mapped; prioritized report and executive summary; quality review |
| 5. Readout and closeout | 2–3 business days | Technical and executive briefings; remediation roadmap walkthrough |
| 6. Retest (optional) | After remediation | Closed findings verified; verification memo issued |
A small application or external footprint can take two to three weeks. A large multi-boundary environment, an adversary emulation or a High-baseline system with heavy documentation pushes toward the upper end and may need a larger team.
Late credentials and access are the most common cause of slippage on this service, so these go into the SOW with dates and owners:
| Framework | What testing supports | Specific requirements |
|---|---|---|
| NIST SP 800-53 Rev. 5 | Assessment and vulnerability management | CA-8 penetration testing (High baseline; tailorable into Moderate); RA-5; CA-2; RA-3; findings feed SI-2 and CA-7 |
| NIST SP 800-37 Rev. 2 | The Assess step before authorization | Control-assessment evidence for the assessor and the Security Assessment Report |
| FISMA | Periodic independent assessment | Independent, evidence-backed testing for annual reporting |
| CISA BOD 26-04 | Risk-based remediation clocks (civilian agencies) | Validated exposure and exploitability inputs for each finding |
| FedRAMP (2026 rules) | Readiness only | Pre-assessment testing for a cloud provider; the annual test itself comes from a FedRAMP Recognized assessor |
| NIST SP 800-171 and CMMC | Evidence for DIB self-assessment | 3.11.2, 3.12.1, 3.12.3, 3.14.1. Penetration testing is not itself a CMMC practice; it supports evidence. |
The accurate claim is narrow: the service gives an agency the tested, evidence-backed findings and the prioritized remediation plan that support a FISMA assessment, an RMF authorization package or a contractor's self-assessment. It does not complete the assessment, grant an authorization, certify CMMC compliance, or guarantee any audit outcome. CMMC Phase 2 third-party certification was suspended on July 13, 2026 while a DoD review runs, but Phase 1 self-assessment and the underlying NIST SP 800-171 obligations remain in force.
The scopes below are a planning illustration, not quotes and not results from any engagement. Durations follow Section 7, and each price is the midpoint of the market-norm ranges for its components.
| Scope | What is tested | Duration | Illustrative price | Market range | Retest option |
|---|---|---|---|---|---|
| External-only test | One internet-facing footprint (perimeter hosts and exposed services) | About 4.2 weeks | $20K | $10K–$30K | About $4.5K |
| System-level test | One Moderate-baseline system: external, internal and one web application | About 6.6 weeks | $65K | $30K–$100K | About $14.6K |
| Comprehensive risk and vulnerability assessment | Multi-vector assessment across several boundaries, including cloud and identity layers | About 7.6 weeks | $100K | $50K–$150K | About $22.5K |
Two things move the price more than anything else: the size of the environment and the depth of exploitation. Validation-only testing costs less than a scope that includes lateral movement, and a red team exercise costs more again. The retest is priced at 15% to 30% of the original engagement and is worth scoping up front, because it produces the evidence that a finding is closed.
The table shows how five representative validated findings would be assigned under the directive, using only combinations whose timeframes are stated in published summaries of BOD 26-04. The finding types are illustrative.
| Finding | Exposed | In KEV | Automatable | Impact | Remediation clock |
|---|---|---|---|---|---|
| Remote code execution on an internet-facing VPN appliance | Yes | Yes | Yes | Total | 3 days, with forensic triage |
| Unauthenticated code execution in a public web application, not yet in KEV | Yes | No | Yes | Total | 3 days |
| Privilege escalation on an internal server, KEV-listed, yields full control | No | Yes | No | Total | 3 days, with forensic triage |
| Automatable flaw on an internal host that yields partial control | No | No | Yes | Partial | 60 days |
| Internal flaw meeting none of the four criteria | No | No | No | Partial | Fix at next system upgrade |
The first two rows show why exposure matters: the same kind of flaw on an unreachable internal host would sit on a longer clock. The point of validation is to put each finding on the right row with evidence, so the three-day work is the work that needs doing in three days.
Appendix C lists every input. The agency's own environment, scope and findings replace them in the scoping phase.
| Engagement type | Typical range |
|---|---|
| External network test (small footprint) | $10K–$30K |
| Internal network test | $12K–$40K |
| Web or application test (per application) | $8K–$30K |
| Comprehensive risk and vulnerability assessment (multi-vector) | $50K–$150K+ |
| Red team or adversary emulation | $30K–$100K+ |
| Retest or verification pass | 15–30% of the original engagement |
These are market-norm planning ranges, validated against the specific environment before any figure appears in a proposal.
Engagements are priced firm fixed price by scope tier, because both the scope (named address ranges, applications and environments) and the deliverables can be defined. Time-and-materials applies only where scope is genuinely open-ended. Most single-system tests fall well under the simplified acquisition threshold of $350,000, so they can be bought as open-market purchases, typically with one-year O&M funds.
Civilian agencies should also know that CISA offers risk and vulnerability assessments to federal agencies at no cost. Where CISA's schedule fits the agency's deadline, that is a good option. Where an ATO date, a remediation clock or an audit cannot wait for CISA's queue, an outside engagement on the agency's schedule is the alternative.
| Risk | Containment |
|---|---|
| Scope creep during testing ("can you also look at...") | Fixed, signed scope and ROE; additions only by written change order |
| Ambiguity about how far exploitation goes | Depth (validation, lateral movement or red team) stated in the SOW |
| Late credentials, access or allow-listing | Dependencies tracked in writing from kickoff, with dates and owners; schedule relief when they slip |
| Overstated compliance value | Approved language only; the report says what it supports and what it does not |
| A scan delivered as a penetration test | Manual validation and controlled exploitation are required deliverables |
| Weak handling of evidence or CUI | ROE-defined handling, storage and destruction of every artifact |
A scan report tells an agency what might be wrong. A validated assessment tells it what an attacker could actually use, what that would reach, and what to fix first. With remediation clocks now set by exposure and exploitability, that difference has a deadline attached.
Each engagement is scoped to a fixed price, governed by a signed ROE, and staffed with testers who hold recognized offensive-security certifications such as OSCP, GPEN or equivalent, named in the proposal and confirmed before testing begins. Avalon takes one scoped engagement at a time, in unclassified environments. Avalon is a small business without prior federal contracts under this service and says so; the tightly scoped, fixed-price structure is built to let an agency evaluate the work at low risk. To discuss a test, contact Avalon Technology Services at contact@AvalonTechServices.com.
ATT&CK
MITRE's knowledge base of adversary tactics and techniques, used to describe how a finding could be used.
BOD: Binding Operational Directive
A CISA directive that federal civilian agencies must follow. BOD 26-04 sets risk-based remediation timelines.
CVSS
The Common Vulnerability Scoring System, a generic severity score that does not account for an agency's environment.
HVA: High Value Asset
A federal system designated as especially critical, subject to additional assessment requirements.
KEV: Known Exploited Vulnerabilities
CISA's catalog of vulnerabilities with evidence of active exploitation.
PTES
The Penetration Testing Execution Standard, a common methodology for penetration testing.
ROE: Rules of Engagement
The signed document that defines scope, limits, windows, escalation and data handling for a test.
RVA: Risk and Vulnerability Assessment
A multi-vector assessment covering network, application, and often social-engineering and wireless vectors.
3PAO / FedRAMP Recognized assessor
An independent assessment organization recognized by FedRAMP to assess cloud services, including the annual penetration test.
| Control | Name | Evidence the engagement produces |
|---|---|---|
| CA-8 | Penetration testing | Test report, ROE and evidence package |
| CA-8(1) | Independent penetration testing agent or team | Testing by a party independent of the system's operators and developers |
| RA-5 | Vulnerability monitoring and scanning | Authenticated scan results with validation notes |
| CA-2 | Control assessments | Tested evidence for the Security Assessment Report |
| RA-3 | Risk assessment | Impact mapping and chained-finding analysis |
| SI-2 | Flaw remediation | Prioritized remediation roadmap and retest memo |
| CA-7 | Continuous monitoring | Findings and retest results for the monitoring record |
| 800-171 3.11.2, 3.12.1, 3.12.3, 3.14.1 | Vulnerability scanning; control assessment and monitoring; flaw correction | Evidence for a contractor's self-assessment |
All values are planning assumptions. None is drawn from a specific agency or a completed engagement.
| Assumption | Value | Basis |
|---|---|---|
| Phase durations | Within the Section 7 ranges; 4.2 weeks, 6.6 weeks, 7.6 weeks for the three scopes | Section 7 |
| External-only price | $20K | Midpoint of $10K–$30K |
| System-level price | $65K | Sum of midpoints for external, internal and one application test |
| Comprehensive assessment price | $100K | Midpoint of $50K–$150K |
| Retest | 22.5% of the engagement price | Midpoint of 15–30% |
| BOD 26-04 assignments | Five illustrative findings | Only combinations whose timeframes are stated in published summaries of the directive |
| Excluded | Remediation, travel, cleared-staff premiums | Outside the engagement or environment-specific |
