What is CMMC penetration testing?
CMMC penetration testing is an authorized, manual attack on the systems that store, process or transmit Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Its purpose is to show whether the controls you documented for the Cybersecurity Maturity Model Certification actually stop an attacker, before an assessor or an adversary finds out for you.
What we are, and are not. Ghost Ops Security is an independent penetration testing firm. We are not a C3PAO and we do not issue CMMC certifications. We provide testing and evidence that support your readiness and your assessment.
Where testing fits in CMMC
| Level | Based on | Penetration testing |
|---|---|---|
| Level 1 | 15 basic safeguarding requirements for FCI | Not required |
| Level 2 | 110 requirements of NIST SP 800-171 Rev. 2 | Not required by name. Supports the scanning, remediation and control-assessment requirements. |
| Level 3 | Level 2 plus selected NIST SP 800-172 requirements | Required: CA.L3-3.12.1e |
CMMC rollout dates and contract requirements have shifted more than once. Confirm what applies to your contract with your contracting officer or the DoD CIO's CMMC guidance.
What we test
- The CUI boundary. Can an attacker get from your corporate network, guest Wi-Fi or a vendor connection into the enclave?
- External attack surface. VPNs, remote access, email and anything internet-facing that leads toward CUI.
- Internal network and Active Directory. Privilege escalation, lateral movement and paths to the systems holding CUI.
- Cloud and GCC High tenants. Identity, conditional access, storage and sharing misconfigurations.
- Applications and portals. Web apps and APIs that handle CUI or authenticate the people who do.
- Access control and authentication. MFA coverage, session handling, least privilege and separation of duties in practice.
- Wireless and physical, on site, where they are in scope.
How findings map to NIST SP 800-171
| Control | What it asks for | What our test contributes |
|---|---|---|
| RA.L2-3.11.2 | Vulnerability scanning | Validated scan results, with false positives removed and exploitability confirmed |
| RA.L2-3.11.3 | Vulnerability remediation | Prioritized fixes and a retest showing each one closed |
| CA.L2-3.12.1 | Security control assessment | Independent evidence of whether controls are effective as implemented |
| CA.L2-3.12.3 | Control monitoring | A repeatable test, or continuous testing through PTaaS |
| SI.L2-3.14.1 | Flaw remediation | Missing patches and misconfigurations that are actually reachable |
| AC, IA and SC families | Access control, authentication, boundary protection | Technical proof that the stated controls hold under attack |
What you get
- A report with every finding tagged to its NIST SP 800-171 requirement identifier.
- Kill Chain Replay™ attack paths showing exactly how CUI could be reached.
- POA&M-ready remediation items and notes on anything that contradicts your SSP.
- An executive summary and attestation letter you can share with a prime contractor or assessor.
- A live readout and a free retest of all reported findings within 6 months.
Why Ghost Ops Security
- Veteran-owned small business, SAM registered, with an active Secret clearance.
- Founder-led: the named, credentialed operator you meet runs your test. Nothing is outsourced.
- 100% manual testing. AI-assisted tooling runs on locally hosted, air-gapped inference, so your data is never sent to third-party AI services.
- Remote or on site anywhere in the United States.
CMMC penetration testing FAQ
Does CMMC require a penetration test?
Not at Level 1 or Level 2. Level 2 is built on the 110 requirements of NIST SP 800-171 Rev. 2, which call for vulnerability scanning, remediation and periodic assessment of your controls, but not a penetration test by name. Level 3 does require penetration testing (CA.L3-3.12.1e, from NIST SP 800-172). Many contractors test at Level 2 anyway, because it is the most direct way to show controls work in practice.
Can Ghost Ops Security certify us for CMMC?
No. Only an authorized C3PAO (or DCMA DIBCAC for Level 3) can perform a CMMC certification assessment. We are an independent testing firm. We provide penetration testing and evidence that supports your readiness and your assessor's review.
Which requirements does your testing support?
Primarily RA.L2-3.11.2 (vulnerability scanning), RA.L2-3.11.3 (vulnerability remediation), CA.L2-3.12.1 (security control assessment), CA.L2-3.12.3 (control monitoring) and SI.L2-3.14.1 (flaw remediation), plus technical checks of access control, authentication and boundary protection. Each finding in the report carries the requirement identifier it relates to.
Will you touch CUI during the test?
We scope so that we do not need to. Before testing we agree in writing which systems are in the CUI boundary, what data handling rules apply and where evidence is stored. If a finding exposes CUI, we stop, record the minimum needed to prove it and notify you.
How does the report fit our SSP and POA&M?
Findings are written so they can be dropped into your Plan of Action and Milestones: the affected asset, the related requirement, severity, remediation steps and a retest result. Where a finding contradicts a statement in your System Security Plan, we call that out.
How long does it take and what does it cost?
Most CMMC-aligned tests of a defined CUI enclave run one to three weeks, depending on size. Every engagement gets a fixed proposal after a scoping call, and includes a free retest of all reported findings within 6 months.