Penetration Testing in Virginia

The Virginia threat landscape

Virginia carries the densest defence-industrial attack surface in the United States, and its adversaries are patient. State-aligned actors have pursued controlled unclassified information through the subcontractor tiers of the Northern Virginia and Hampton Roads supply chain for more than a decade, because a shipyard supplier or a software subcontractor is reachable where a prime contractor is not; the Department of Defense answered with DFARS 252.204-7012 in 2017 and, since 10 November 2025, with CMMC 2.0 requirements written into selected solicitations, making a verified NIST SP 800-171 posture a condition of doing business rather than a self-attestation. Loudoun and Prince William counties host the physical substrate of the US cloud: hyperscale regions, colocation campuses and the management planes, building-automation systems and remote-hands processes that sit behind them, where a single tenant-isolation or badge-system weakness has consequences far beyond Virginia. Richmond and McLean concentrate consumer banking, card issuing, mortgage finance and insurance, drawing business email compromise against treasury functions and credential attacks against customer identity. Health systems from Inova and Sentara to Carilion, UVA Health and VCU Health carry the clinical-ransomware exposure that has defined US healthcare since 2020. The Commonwealth's own institutions have shown the failure modes: in December 2021 a ransomware attack on the Division of Legislative Automated Systems took down the Legislative Information System that lawmakers use to draft and track bills and the related legislative sites weeks before the General Assembly session, and in 2023 a hosting provider's weakness exposed voter records held by a neighbouring jurisdiction's election board. Virginia regulates the result through several instruments: section 18.2-186.6 of the Code of Virginia, which requires notification of affected residents and the Attorney General without unreasonable delay, with the Attorney General able to seek civil penalties of up to 150,000 dollars per breach; the Virginia Consumer Data Protection Act, in force since 1 January 2023, which requires controllers to maintain reasonable administrative, technical and physical data security practices and to document data protection assessments for sensitive data; the Virginia Insurance Data Security Act, in force since July 2020 for licensees of the State Corporation Commission; and the SEC530 Information Security Standard that the Virginia Information Technologies Agency imposes on executive-branch agencies and their suppliers. Engagements in Virginia routinely uncover CUI enclaves that share identity with the general corporate network, data-centre management interfaces reachable from tenant segments, shipyard and manufacturing networks with vendor remote access that was never decommissioned, mortgage and card platforms with privileged service accounts shared across environments, and hospital clinical devices visible from guest wireless.

Virginia and US compliance frameworks we report against

Engagement deliverables, a penetration testing statement, executive summary, technical report with proof-of-concept, and a remediation tracker, are formatted to satisfy the evidence requirements of each framework below without additional documentation. US auditors, examiners and CMMC and FedRAMP assessors accept HackersHub reports as primary evidence of testing.

• Code of Virginia section 18.2-186.6 breach notification: affected residents and the Office of the Attorney General without unreasonable delay, consumer reporting agencies when more than 1,000 residents are notified at once, civil penalties of up to 150,000 dollars per breach
• Code of Virginia section 32.1-127.1:05 breach of medical information notification
• Virginia Consumer Data Protection Act (Code of Virginia title 59.1 chapter 53, in force since 1 January 2023): reasonable administrative, technical and physical data security practices, documented data protection assessments for sensitive data and targeted advertising, Attorney General enforcement with a 30-day cure period
• Virginia Insurance Data Security Act (Code of Virginia sections 38.2-621 to 38.2-629, in force since 1 July 2020, with 14VAC5-430 regulations since June 2021): written information security programme, risk assessment, third-party oversight and annual certification by domestic insurers
• Commonwealth of Virginia SEC530 Information Security Standard (VITA, built on NIST SP 800-53 Rev. 5) for executive-branch agencies and their suppliers
• CMMC 2.0 (32 CFR Part 170, in force since 16 December 2024; DFARS 252.204-7021 in solicitations from 10 November 2025) Level 2 against NIST SP 800-171 Rev. 2, Level 3 against NIST SP 800-172
• DFARS 252.204-7012 safeguarding of covered defense information and 72-hour cyber incident reporting, with DFARS 252.204-7019 and 7020 NIST SP 800-171 assessment scores in SPRS
• NIST SP 800-171 Rev. 2 security assessment (CA.L2-3.12.1) and vulnerability scanning (RA.L2-3.11.2) practices as CMMC applies them
• FISMA 2014, NIST SP 800-53 Rev. 5 CA-8 and FedRAMP Rev. 5 penetration testing for agency and cloud service provider systems
• GLBA Safeguards Rule (16 CFR Part 314, amended 2023), FFIEC IT Examination Handbook and NCUA 12 CFR Part 748 for banks and credit unions
• HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation
• NERC CIP-005 / CIP-007 / CIP-010 for PJM-connected bulk electric system entities
• US Coast Guard maritime cybersecurity rule (33 CFR Part 101, in force since July 2025) for MTSA-regulated facilities and vessels
• PCI DSS v4.0.1 Requirement 11.4 penetration testing
• SOC 2 Trust Services Criteria CC7.1 / CC7.4
• NIST SP 800-115 technical security testing

Why Virginia enterprises choose HackersHub

HackersHub is a practitioner firm, not a platform reseller, and it is headquartered in Amsterdam with no US office. We structure Virginia engagements around that fact rather than around a sales map. External, web-application, API and cloud testing is delivered remotely from the Netherlands; internal network, Active Directory, wireless, OT, data-centre and physical engagements are delivered on site in Northern Virginia, Richmond, Hampton Roads, Charlottesville and the Roanoke and Blacksburg corridor by travelling testers. HackersHub is not a FedRAMP 3PAO and not a CMMC C3PAO: we perform the penetration testing that prepares an organisation for those assessments and validates remediation. Our testers do not hold US security clearances, so engagements are scoped to unclassified systems, with CUI and export-control questions settled with the client's legal team before testing begins. Scoping calls, status updates and report walkthroughs are scheduled on US Eastern business hours. Every engagement is led by named OSCP-, OSWE- or CREST-certified offensive security professionals, with Michael van Mameren (OSCP) acting as engagement lead, and reports are written directly against CMMC 2.0, NIST SP 800-171, DFARS, FedRAMP, GLBA, HIPAA, VCDPA and SEC530 evidence categories. Senior-level scoping calls happen within one business day.