How long does a CMMC readiness test take?

Scoping takes 24 hours. Depending on scope, testing takes from 2 business days for an external network to 5 business days for a web application, API or internal network, and the report follows within 10 business days.

Will a penetration test affect our production systems?

We agree rules of engagement before testing. Where possible we test a staging environment that mirrors production. Production testing is throttled and coordinated with your team, and denial-of-service testing is excluded unless you request it.

What happens if you find a critical vulnerability?

We notify you immediately, not at the end of the engagement. You fix it, we retest for free, and the final report shows the issue as closed.

Is penetration testing required for CMMC?

Not by name at Level 2. NIST SP 800-171 requires you to assess and validate controls, and penetration testing is a strong way to do that.

Which CMMC level does this support?

Mainly Level 2 readiness, which maps to the 110 requirements of NIST SP 800-171.

Does the Phase 2 suspension mean we can wait?

No. Phase 1 self-assessment and your DFARS 252.204-7012 and NIST SP 800-171 obligations remain in effect.

Can you test a CUI environment?

Yes, using the handling rules agreed at scoping.

Do you test Active Directory?

Yes. Active Directory is a core part of internal network testing for defense contractors.

Do you retest after remediation?

Yes. A free retest is included.

Can this help with our self-assessment score?

It gives technical evidence of whether your controls work, which helps you score accurately. Your score remains your own attestation.

CMMC Penetration Testing & NIST 800-171 Readiness

Q: Is this a CMMC assessment?

No. It is readiness testing. Certification assessments are performed by authorized third-party assessors.

24 hours

To a fixed-price scope

From $1,600*

External network pentest

Free retest

Included in every engagement

2,000+

Clients served worldwide

*Final pricing is determined after scoping.

Why CMMC readiness needs a penetration test

What is CMMC penetration testing? CMMC penetration testing is technical readiness testing of the systems that handle Controlled Unclassified Information (CUI). It checks whether your NIST SP 800-171 controls hold up against a real attacker. It is not a CMMC assessment or certification. Certification assessments are performed by authorized third-party assessors.

A written policy does not show that access controls and segmentation work in practice. Testing from the position of a phishing victim shows how far an attacker could actually go. Status below is as of October 2026.

Policy is not proof

Documents describe intent. A test shows whether controls work against real attack techniques.

Self-assessment scores must be accurate

Testing shows whether your scores reflect what an attacker can really do.

Primes pass requirements down

Subcontractors are asked for evidence regardless of regulatory timing.

Topic

Where it stands

What it means for you

CMMC rule

Effective November 10, 2025, with Phase 1 self-assessments in place

Self-assessment scores need to be accurate

Phase 2

Planned move suspended in July 2026 while the Department of War reviews the program

Watch for the outcome. Do not wait to fix gaps

DFARS 252.204-7012 and NIST SP 800-171

Obligations continue regardless

Primes still expect evidence that controls work

What assessors and primes expect around CUI

A defined CUI boundary. With a current asset inventory.
Controls that work in practice. Not only written policy.
Tested segmentation. Between the CUI environment and everything else.
Protected privileged access. Including MFA on remote and privileged accounts.
Evidence of remediation. Findings fixed and retested.
Accurate self-assessment. Scores that reflect what testing finds.

Requirements vary by prime contractor and assessor. Confirm yours before scoping, and we will align the test to them.

CMMC readiness pentest services

We scope to the CUI environment and the systems connected to it, so the test supports your readiness and your budget is not spent outside it.

External network

Internet-facing hosts, VPNs and services an attacker can reach today.

Internal network and Active Directory

Assumed breach from a standard user, including certificate services, delegation and service accounts.

Segmentation testing

Testing that the CUI environment is isolated from the rest of the network.

Web application

Applications that store or process CUI. See our API penetration testing.

Cloud environment

Configuration, identity and privilege escalation. See cloud penetration testing.

Retest

Free retest from the same starting position after you fix findings.

Want a deeper look at identity? Ask about our Active Directory Security Assessment. Also complying with other frameworks? See SOC 2, PCI DSS and ISO 27001 penetration testing.

How much does CMMC readiness testing cost? External network testing starts from $1,600* at Redfox. Internal network testing starts from $4,000* and cloud testing from $2,400*. *Final pricing is determined after scoping and depends on the size of the CUI environment. You get a fixed quote within 24 hours.

CMMC readiness pentest methodology

Manual testing by senior consultants, aligned to OWASP WSTG, OWASP API Security Top 10, PTES and NIST SP 800-115. Not automated scanning.

01 / Scope in 24 hours

We confirm the CUI boundary, in-scope assets, handling rules and rules of engagement. You receive a fixed-price quote.

02 / Enumeration

We map Active Directory, certificate services, delegation, shares and policy from a standard domain user.

03 / Credential attacks and escalation

We test credential attacks, relay opportunities and paths to Domain Admin and other privileged assets. Critical findings are reported to you immediately.

04 / Reporting and readout call

You receive a report mapped to NIST SP 800-171 practice areas, with attack path graphs and a walkthrough with the engineers who tested.

05 / Free retest

After you fix findings, we retest from the same starting position and issue a closing report.

What a CMMC readiness pentest typically finds

These are the issues we most often find in environments that handle sensitive data, and the ones that matter most to assessors.

Vulnerable certificate templates

Templates that give any user a path to Domain Admin.

Weak service accounts

Service accounts with weak passwords in privileged groups.

NTLM relay opportunities

Unsigned SMB and active LLMNR that allow credential capture and relay.

Credentials in scripts and shares

Passwords in login scripts and shared drives.

Weak segmentation

The CUI environment reachable from the wider corporate network.

Missing MFA

Remote and privileged access without multifactor authentication.

How to prepare for a CMMC readiness test

When should we schedule it? Book the test at least 6 weeks before a self-assessment, prime review or assessor visit. A test, a fix window and a retest together need about six weeks of runway.

01 / Define your CUI boundary

Keep an asset inventory current for every system that stores, processes or transmits CUI.

02 / Share your System Security Plan

Provide the SSP and a current network diagram.

03 / Provide a starting point

A standard domain user on a managed workstation, so we test from the position of a phishing victim.

04 / Agree CUI handling rules

We agree how any CUI is handled during testing before it starts.

05 / Reserve time to fix and retest

Plan engineering time so the free retest lands before your review.

The CMMC readiness report

Reports designed to support your readiness evidence. Readiness testing is not a CMMC assessment or certification. Reports are delivered as PDF.

Document

What it contains

Who uses it

Executive summary

Plain-language scope, results and remediation status

Leadership and compliance teams

Full technical report

Risk ratings, evidence and fix guidance mapped to NIST SP 800-171 practice areas

Security and infrastructure teams

Attack path graphs

Routes from a standard user to privileged assets, with a remediation sequence

Infrastructure teams

Retest report

Verified fixes and a closing report

Compliance teams and primes

Related case study: Active Directory assessment for a financial firm

Illustrative scenario. This related example shows the Active Directory testing used in readiness work. It is not a CMMC engagement and not a named client.

The situation

A UK wealth management firm (1,200 employees) needed evidence that its Active Directory was hardened against ransomware for its cyber insurer and regulator.

What we tested

One forest, two domains, six domain controllers and certificate services, starting as a standard domain user. 7 days of testing.

What we found

3 critical, 6 high and 8 medium findings. Redfox reached Domain Admin in under four hours through a vulnerable certificate template, and found two more independent paths.

The result

The firm closed the critical paths within 72 hours and finished tiering and credential changes over five weeks. The retest from the same starting position found no route to Domain Admin.

Download the full case study (PDF)

See the scope, approach, findings and retest results. Enter your details to get the PDF.

Download case study (PDF)

Oops! Something went wrong while submitting the form.

Why companies choose Redfox for CMMC readiness

Black Hat USA 2026 trainers

Official training provider for Advanced Adversary Tactics and Evasion at Mandalay Bay, Las Vegas. The tradecraft we teach is what we use on your systems.

16+ years in offensive security

Manual, exploit-driven testing, not scanner output.

5,000+ engagements

Delivered for 2,000+ clients worldwide, including SaaS, fintech and healthcare technology companies.

Trusted by compliance firms

SOC 2 and compliance consultancies use Redfox as their white-label penetration testing partner.

Their manual testing approach, clear risk prioritization, and practical recommendations give our engineering team a stronger foundation for fixing security issues that matter.

VertexCloud Technologies

Last updated October 2026.

CMMC penetration testing FAQ

Get your CMMC readiness quote

A senior consultant replies within one business day with a fixed-price quote. Not sure what is in scope? Ask for a free 30-minute scope review.

Thank you! Your submission has been received!