Thanks for the responses. We're looking to hire a firm to do penetration-style testing. The firm we have in mind is a one person shop and hires contractors as needed. We feel good about the owner, but do not know anything about the contractor. The owner and all contractors are bonded.
This was something that an examiner brought up.