Frequently asked questions
Straight answers — including the certification myth, costs, and what CISA gives away free.
Is there such a thing as CISA certification?
No. CISA — the Cybersecurity and Infrastructure Security Agency, part of DHS — publishes guidance (CPGs, binding operational directives, Secure by Design) and runs free services. It does not certify companies, endorse consultants, or issue badges. Anyone selling you a “CISA certificate” is selling fiction.
What does it cost to implement CISA guidance?
CISA's guidance and scanning services are free. Implementation help is where money goes: our labeled estimates put a CPG gap assessment at $15,000–$50,000 and a zero-trust roadmap at $40,000–$150,000. See our cost guide and 2026 pricing report for sourced numbers.
Do binding operational directives apply to my company?
BODs are legally mandatory only for federal civilian agencies. But contractors and critical-infrastructure operators widely adopt them — especially KEV-remediation timelines — because agency customers and auditors expect it.
Who are these consulting firms, really?
Independent cybersecurity consultancies and assessment firms with verified websites and real federal or critical-infrastructure practices. CISA does not endorse any of them, and neither do we — profiles are factual, listings are alphabetical, and nobody can pay for placement.
How much does it cost?
Published sources and our labeled estimates put a CPG gap assessment at $15,000–$50,000, a zero-trust roadmap at $40,000–$150,000, and an incident-response retainer at $50,000–$200,000/year. CISA's Cyber Hygiene scanning: $0. Every figure below is labeled with its provenance. See the cost guide.
How long does implementation take?
A realistic end-to-end range for a first CPG-alignment program: 6–12 months. Here's where the time goes — and how to compress it. See the timeline.
How do you make money?
When you request quotes, matched firms may pay us a lead or referral fee. That never affects which firms we list or what our guides say — firms can't pay to change a profile or buy a recommendation.
Are the firms on this site endorsed by CISA?
No. CISA does not endorse private firms. Our listings are independent, alphabetical, and never sold.
Still have questions?
Ask us — or get matched with firms who answer for a living.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.