# Penetration testing providers by compliance framework

Source: https://pentestcompare.com/compliance/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing providers by compliance framework. Facts come from each provider's own pages, with the date we checked them.

- [CMMC penetration testing companies: compared](https://pentestcompare.com/compliance/cmmc/): CMMC penetration testing companies whose own pages mention CMMC, with what Level 2 and Level 3 say about pentests, CUI handling questions and price drivers.
- [DORA penetration testing companies](https://pentestcompare.com/compliance/dora/): DORA penetration testing providers that mention DORA on their own pages, A to Z, with sources and dates, plus TLPT versus yearly testing in plain words.
- [FedRAMP penetration testing companies: compared](https://pentestcompare.com/compliance/fedramp/): FedRAMP penetration testing companies in one sourced table, A to Z, with the 3PAO rule, what providers state and six questions to ask before you hire.
- [GDPR penetration testing companies: compared](https://pentestcompare.com/compliance/gdpr/): GDPR penetration testing companies from one sourced dataset, A to Z. Article 32 in plain words, data handling questions and what to ask before you sign.
- [HIPAA penetration testing companies: compared](https://pentestcompare.com/compliance/hipaa/): HIPAA penetration testing companies whose own pages mention HIPAA, with the BAA, PHI and evidence questions to ask and what the Security Rule does and does not say.
- [ISO 27001 penetration testing companies: compared](https://pentestcompare.com/compliance/iso-27001/): ISO 27001 penetration testing companies compared from their own pages. ISO 27001 names no pentest, so see what Annex A asks for and what auditors check in a report.
- [PCI DSS penetration testing companies: compared](https://pentestcompare.com/compliance/pci-dss/): PCI DSS penetration testing companies in one sourced table, A to Z, with a segmentation checklist, independence rules and six checks to run before you sign.
- [SOC 2 penetration testing companies](https://pentestcompare.com/compliance/soc-2/): SOC 2 penetration testing companies that name SOC 2 on their own pages, A to Z, with sources and dates, plus what auditors check in a pentest report.

All pages filter one sourced dataset, sorted A to Z and not ranked. [How we compare](/methodology/).