By Phantom PenTest · Published
What determines the cost?
Two facilities with similar floor areas can require very different reviews. A single office with a small number of entrances is different from a campus with separate buildings, changing visitor populations and several monitoring arrangements. The quote should describe the work needed to answer your questions, rather than rely on square footage alone.
- Locations and operating complexity: the number of sites, restricted areas, entrances, shifts and stakeholders to consider.
- Assessment focus: access administration, security systems, operating procedures or a combination of services.
- Evidence available: the condition of site plans, equipment inventories, procedures and previous findings.
- Site access: escorts, approved review windows, travel and coordination requirements.
- Reporting and follow-up: the depth of evidence, leadership discussion, remediation planning and any agreed reassessment.
- Controlled testing: scenario planning, authorization, coordination and validation activities where separately included.
Which service matches the question?
Use an Access Control Assessment when your main concern is how permissions, entrances, visitors and restricted areas are managed. A Security Systems Assessment examines physical security technology such as surveillance, alarms and monitoring.
A Security Program Assessment focuses on policies, responsibilities and operational practice. Controlled Physical Penetration Testing evaluates selected safeguards through expressly authorized scenarios. The assessment-versus-testing comparison can help clarify which approach belongs in your request.
What should an assessment proposal include?
A price is easier to evaluate when you can see the assumptions behind it. Ask for the locations and processes in scope, planned activities, exclusions, access arrangements, client responsibilities, timing and deliverables. Confirm whether travel, follow-up discussions and any retesting are included or separately priced.
Phantom PenTest's assessment deliverables are designed around an Executive Summary, Leadership Debrief, Risk-Ranked Findings, Evidence & Recommendations, and a Remediation Roadmap. The engagement proposal should make the agreed coverage clear. A recommendation to replace equipment is different from the cost of buying and installing that equipment.
How can you compare quotes fairly?
Give each provider the same description of your objectives and facilities. Compare the activities and outputs, not only the total. A document review and a review covering documents, interviews and on-site observation are different scopes even if both are called an assessment.
- Will the review include the shifts or operating conditions that concern you?
- Which controls are reviewed, observed or tested, and which remain outside scope?
- Will findings include evidence and practical priorities?
- Who will explain the results to leadership?
- What could change the fee or schedule after the engagement begins?
Ask how incomplete information or unavailable areas will be handled. A clear limitation is more useful than an apparently comprehensive report that does not explain what the assessor could verify.
Can the work be phased?
Where appropriate, start with a defined location, process or security question and agree how later phases will be selected. For example, an organization may review access administration first, then use the findings to decide whether specific entry workflows need controlled validation. Phasing should preserve a useful decision at the end of each stage.
Do not assume one site's findings represent every location. A shared policy may be reviewed centrally while local implementation still requires site-specific attention. Document what the first phase can and cannot establish.
What information helps us scope a quote?
Prepare a brief description of the facility type, approximate size, number of locations, normal operating hours, main concerns and preferred timing. Explain whether you need a broad baseline or validation of a defined control. Our assessment preparation checklist covers the next steps once the scope develops.
Keep the initial inquiry general. Sensitive layouts, access records and detailed vulnerabilities should be shared only through arrangements agreed for the engagement.
Common budgeting questions
Do you publish a standard assessment price?
This guide does not provide a standard fee. Phantom PenTest discusses the objectives, facilities, activities and deliverables before providing engagement-specific pricing.
Does a quote include fixing the findings?
Do not assume that equipment purchases, installation, remediation or later testing are included. Ask for those boundaries in the proposal and distinguish assessment costs from improvement costs.
Can we get a quote before all documents are ready?
You can begin a scoping conversation with a general description of the facility and your objectives. Identify missing information so the proposal can state its assumptions and any items that need confirmation.