Capability Statement
Secure Consulting Solutions, LLC (SCS) is a HUBZone-certified small business, founded in 2014, providing operator-led penetration testing and RMF/ATO system accreditation support to federal agencies, federal contractors, and commercial organizations.
Practitioner-led security testing and accreditation.
Testing and accreditation work is performed by senior offensive security practitioners holding OSCP, OSCE, and CISSP certifications, with TS/SCI-cleared staff for classified or sensitive federal environments. President Peter Paccione leads engagements as a working practitioner.
SCS is headquartered in Capon Bridge, West Virginia, which supports its HUBZone certification, and works day to day across Washington, DC, Northern Virginia, and Maryland from an office in Alexandria, Virginia. Delivery is nationwide.
Federal buyers can order through GSA Multiple Award Schedule contract 47QTCA24D0077 under Highly Adaptive Cybersecurity Services (HACS) SIN 54151HACS, covering all HACS subcategories, including Penetration Testing.
Company data
| Legal name | Secure Consulting Solutions, LLC |
| Small business status | SBA HUBZone-certified small business |
| GSA MAS | Contract 47QTCA24D0077 |
| SIN | 54151HACS, Highly Adaptive Cybersecurity Services. All subcategories, including Penetration Testing. |
| UEI | EP16NRKQ45H8 |
| CAGE / NCAGE | 7D7B2 |
| NAICS | 541512, 541519, 541511, 541513, 541690 |
| Registration | SAM.gov registered |
| Founded | 2014 |
| Headquarters | 3622 Old Mill Rd, Capon Bridge, WV 26711 |
| Office | Alexandria, Virginia |
| Credentials | OSCP, OSCE, and CISSP holders. TS/SCI-cleared personnel available. |
What SCS delivers.
1. Penetration Testing
Manual testing of web applications, REST and GraphQL APIs, iOS and Android apps, and internal and external networks. Every critical finding is validated by hand and reported with reproduction steps; retest is available.
2. System Accreditation Support
RMF/ATO support under NIST SP 800-37 and 800-53: control validation, ST&E planning and support, SSP and POA&M development, ISSO support, and continuous monitoring. CMMC Level 2 and 3 readiness, NIST SP 800-171 and DFARS 252.204-7012, and FedRAMP moderate and high gap analysis.
3. Adversary Simulation
Full-scope red team engagements: assumed-breach and external intrusion scenarios, insider threat simulation and lateral movement testing, and detection and response validation with MITRE ATT&CK-aligned findings.
4. AI Security Assessments
Testing of LLM applications, RAG systems, and AI agents for prompt injection, data leakage, and unsafe actions, plus Microsoft 365 Copilot exposure assessments.
Why agencies and contractors choose SCS.
Operator-led
Senior practitioners do the testing and stay with the engagement from scoping through the remediation workshop.
Evidence, not scanner output
Every critical finding is validated by hand and reported with reproduction steps. Compliance controls are tested against the running system, not reviewed on paper.
Federal-ready
HUBZone-certified, on GSA MAS under HACS SIN 54151HACS, with TS/SCI-cleared personnel for classified or sensitive environments.
Proven depth
50+ assessments delivered and three published CVEs from zero-day vulnerabilities found in production federal systems.
Selected engagements.
| Client | Work performed |
|---|---|
| U.S. Department of Homeland Security (CISA) | Penetration testing and security engineering. Onsite testing from insider and outsider perspectives across 50+ applications; zero-day vulnerabilities including RCE, XSS, SQL injection, and CSRF; root compromise of production security appliances. Findings contributed to CVE publication and provided evidence for federal system accreditation. |
| U.S. Department of State | Security engineering and assessment services. Penetration testing across mobile devices, mobile and web applications, LAN, and WLAN; configuration hardening; risk and threat exposure assessments reported to security leadership. |
| Defense contractor (NIST SP 800-171) | Compliance with NIST SP 800-171 under DFARS 252.204-7012: gap assessment, System Security Plan, POA&M, and control implementation for CUI handling, with scope reduced through FedRAMP cloud isolation and continuous monitoring delivered as part of an auditor-ready documentation set. |
| Bishop Fox: Google Partnership Program validation | Web application penetration testing for enterprise clients in travel, media, and SaaS. Every assessed client achieved Google Partnership Program approval after remediation. |
| Qualtrics (SAP) | Web application penetration testing across the production XM platform and beta products, and a red team assessment of the enterprise network. |