Our methodology

Exactly how we choose firms, what we verify, how we label prices — and what we refuse to do.

Which firms get listed

A firm appears in our directory only if, as of our last check, it meets all three: (1) it is a real, operating cybersecurity practice; (2) its official website returns HTTP 200; (3) it does genuine work against at least one NIST publication (CSF 2.0, SP 800-53, or SP 800-171) — assessor roles (3PAO, C3PAO) are described only as the firms themselves claim them.

What we verify — and what we don't claim

For each firm we record headquarters, firm type, and the frameworks its own public materials say it supports. Directory facts were last verified in September 2026; we aim to re-check quarterly.

How we label every price

Consulting fees are scoped per engagement, so most firms publish no prices at all. Where we show a planning range, it always carries one of three labels:

None of these are quotes. Your fee depends on scope, sector, and starting posture. Treat every band as a planning figure and get scope and fee in writing.

What we will never do

• No star ratings or review scores. We have not hired these firms' clients and won't compress fit into a number.
• No testimonials. Every quote-like line on this site would be fabricated — so there are none.
• No pay-for-rank. Ever. Firms cannot pay to be listed, ranked higher, recommended, or have a profile softened.
• No invented statistics. Every number on this site has a clickable source or a visible estimate label.

How we make money

When you request quotes, matched firms may pay us a lead or referral fee. That payment cannot change which firms we list, what our guides say, or which firms we recommend — the firewall is absolute.

Corrections

Wrong price, stale fact, firm missing? Tell us. We check corrections against the firm's own public materials.

Verification log

Row-level log of every firm website and price source check. Append-only: new entries go on top.