CREST vs NCSC CHECK penetration testing

CREST vs NCSC CHECK penetration testing: which one to require

If you are a UK central government department, public sector body, or critical national infrastructure operator, CHECK is the scheme you should require for authorised penetration tests, because it is the NCSC scheme built for that work. CREST is a UK not-for-profit that accredits member companies and certifies individuals, so it is a separate signal of company and person quality rather than a substitute for the NCSC's assurance. For central government systems processing data marked OFFICIAL and above, the NCSC says those systems should be assessed by CHECK companies, and it strongly recommends CHECK for other public sector bodies. Ask the provider to confirm its CHECK status in writing, and ask which named Team Leader and Team Members will do the work and whether each holds the required title and valid SC clearance.

A private company outside the public sector does not need a CHECK provider, according to the NCSC's buyer guidance, so the decision is different. In that case, CREST credentials are often the stronger signal. A CREST-accredited company has been assessed as a company, and CREST-certified individuals hold an exam-based credential in disciplines such as security testing and red teaming. This matters most when your regulator or contract names CREST, or when you are buying covert or threat-led work. The Bank of England names CREST as the accreditation and certification body for CBEST, so a financial firm under that regime should check which credentials its supervisor expects before it signs. Confirm the exact certificates and expiry dates directly with CREST and the provider, since your requirement may be narrower than the general scheme.

For a public body that also works with a regulated sector, or a CNI operator whose supply chain includes private firms, asking for both is often the practical answer. CHECK tells you the provider has been assessed against the NCSC methodology and that its Team Leaders and Team Members meet the title and clearance rules. CREST tells you the company is accredited and that individuals hold current technical certificates, which CREST states must sit alongside CHECK title holders and be re-passed every three years with 75 hours of CPD over that cycle. Write both requirements into the tender, and verify them against the scheme registers rather than accepting a logo on a proposal.

How CHECK and CREST differ on scope, people and proof

This table compares the NCSC CHECK scheme and CREST accreditation on what each is, who it serves, who gets assessed, individual titles, certificates and the evidence a buyer receives. Read it by first matching your organization type to the designed-for row, then checking which proof your procurement or regulator will ask for.

Dimension	NCSC CHECK	CREST
What it is	A government-developed scheme under which NCSC-assured companies conduct authorised penetration tests	CREST (International), a UK not-for-profit company that accredits member companies and certifies individuals
Designed for	Central government, public sector bodies and UK critical national infrastructure organisations	Broader market, including private companies, and disciplines such as security testing and red teaming
Who is assessed	Companies (assured by the NCSC) and the individuals on their CHECK teams	Member companies are accredited, and individuals are certified separately
Individual titles	Team Leader (at least Principal Cyber Security Professional, Security Testing) and Team Member (at least Practitioner)	Individual certifications such as CRT for Team Members and CCT INF or CCT APP for Team Leaders, as listed by CREST
Security clearance	Both Team Leaders and Team Members must hold valid SC clearance	Clearance is not a stated requirement of the CREST certification; confirm with CREST for your use case
Technical certificates and CPD	CHECK title holders must also hold a valid technical certificate, re-passed every three years, plus 75 hours of CPD over a three-year cycle	Certificates are re-passed on their own cycle; confirm current renewal rules with CREST
Who assesses the provider	The NCSC assesses all companies offering CHECK services to confirm they follow its methodology	CREST assesses and accredits member companies
Evidence a buyer receives	A CHECK-assured provider and CHECK-titled staff, verifiable through NCSC scheme information	A CREST-accredited company and CREST-certified individuals, verifiable through CREST membership listings

What each buyer type should require from a provider

The NCSC says central government systems processing data marked OFFICIAL and above should be assessed by CHECK companies, so for this group CHECK is required rather than optional. CHECK was developed for central government departments, and the NCSC assesses every CHECK company against its methodology. Your procurement file should show that the provider holds current CHECK status before work starts.

CHECK status: Ask for written confirmation that the company is a current CHECK provider and that the scope falls within the services it is authorised to deliver.
Named Team Leader: Request the name of the Team Leader and evidence that they hold at least a Principal Cyber Security Professional (Security Testing) title from the UK Cyber Security Council.
Named Team Members: Request names and evidence of at least a Practitioner title for each member, plus the technical certificate CREST describes for CHECK title holders.
SC clearance: Require evidence that the Team Leader and every Team Member hold valid SC clearance before they access your systems.

Confirm the data classification rules and any departmental requirements with the NCSC and your own security authority before you issue the scope.

How CREST certificates feed CHECK team status

This sequence shows how an individual moves from a CREST technical certificate and a Cyber Security Council title to the CHECK Team Leader or Team Member roles, and why the buyer still needs to verify status at the point of purchase.

Confirm the role and required Cyber Security Council title
The individual first identifies whether they will work as a CHECK Team Leader or a CHECK Team Member. Team Leaders must hold at least a Principal Cyber Security Professional (Security Testing) title from the UK Cyber Security Council, and Team Members must hold at least a Practitioner title. The person, or their employer, confirms the title with the Cyber Security Council. The step is complete when the title is held and can be evidenced to the company's CHECK assessment.
Obtain valid SC national security clearance
Both Team Leaders and Team Members must hold valid SC clearance before they can be named on a CHECK team. Clearance is granted through the UK vetting process, not by CREST or the NCSC, so the individual's sponsoring organization handles the application. The step is complete when the clearance is in force and the employer can show that it is current for each named tester.
Pass the technical certificate for the role
CREST states that CHECK title holders must also hold a valid technical certificate. A Team Member uses a CRT certificate, and a Team Leader uses a CCT INF or CCT APP certificate. CREST issues these certificates after the individual passes its examination. The step is complete when the certificate is listed as valid in CREST's records for that person.
Maintain the certificate by re-passing every three years
The technical certificate is not permanent. CREST states that it must be re-passed every three years. Without a valid certificate, an individual no longer meets the technical requirement for CHECK, even if the Cyber Security Council title and clearance remain in place. The employer should diarize the expiry date for each certificate and treat a lapse as a removal from the team until a valid certificate is shown.
Complete 75 hours of CPD each cycle
CREST states that CHECK title holders must complete 75 hours of continuing professional development over a three-year cycle. Employers typically track CPD records for each tester and ask for evidence on request. This recurring obligation sits alongside the certificate re-pass, so a tester who has passed the exam but has not logged the CPD hours does not satisfy the requirement. Ask the provider for its CPD log for each named tester.
Assess the company against the NCSC methodology
Individual qualifications do not make a company a CHECK provider. The NCSC assesses every company offering CHECK services to confirm that it follows the NCSC methodology. The company's status is therefore a separate assessment from each person's titles and certificates. The step is complete when the NCSC has assessed the company and it appears as a CHECK provider in the NCSC's current listing.
Verify current status before buying
Buyers should not assume CHECK status from a certificate or a logo. Before contracting, ask the provider to confirm that the company is currently assessed as a CHECK provider and that each named Team Leader and Team Member holds the required title, clearance and valid certificate on the test dates. Check the NCSC's published CHECK information and confirm the individual details in writing. Record the verification in the contract file, because statuses change after assessment and re-passing.

What CHECK assurance and CREST accreditation each tell you

CHECK and CREST are separate signals that often appear in the same procurement. Each one checks something different about the company, the people or the clearance, and none of them certifies the quality of a specific engagement.

Company assessed against CHECK methodology

The NCSC assesses every company offering CHECK services to confirm it follows the NCSC methodology. For a buyer, a CHECK company listing shows the firm has passed that assessment, which matters most for central government systems handling OFFICIAL and above data. It does not show that your scope, rules of engagement or retest plan were sound, so ask the provider how it will define targets and handle findings.

CREST company accreditation

CREST is a UK not-for-profit that accredits member companies and certifies individuals. A CREST-accredited firm has met CREST's company standard, which is the accreditation the Bank of England names for CBEST. It is a company-level signal that sits alongside CHECK, not a substitute for it. Confirm which CREST disciplines the firm holds for the test type you are buying.

Team Leader and Team Member titles

CHECK Team Leaders must hold at least a Principal Cyber Security Professional (Security Testing) title from the UK Cyber Security Council, and Team Members at least a Practitioner title. These titles show the individual has a recognised professional level in security testing. They do not show that a named person was assigned to your engagement, so ask for names and titles in the proposal and confirm them against the team that actually tests your systems.

SC clearance for staff

CHECK requires both Team Leaders and Team Members to hold valid SC clearance. For work touching government data, this is the control that lets a tester access sensitive systems under UK vetting rules. Clearance is held by the individual, so it should be checked for each person on the team. It says nothing about technical skill or whether the tester's approach fits the target.

Individual CREST technical certificates

CREST states that CHECK title holders must also hold a valid technical certificate: CRT for Team Members, or CCT INF or CCT APP for Team Leaders. These certificates are re-passed every three years. They show a tester has passed a practical technical assessment at a stated level. They do not prove the tester can handle your stack, such as cloud, mobile or operational technology, so match the certificate to the scope.

Continuing professional development

CREST requires CHECK title holders to complete 75 hours of CPD over a three-year cycle. This shows that certified staff are still active in the field, which matters because testing techniques change quickly. CPD hours do not measure quality, and a log of hours does not show what was learned. Ask whether the testers on your engagement are current on the techniques your target uses.

When CHECK and CREST work together, and what neither replaces

CHECK and CREST answer different questions, so they can be combined. CHECK tells a buyer that an NCSC-assured company is authorised to run a penetration test for a UK government or critical national infrastructure system, and the NCSC assesses those companies against its methodology. CREST accredits member companies and certifies individuals, and the Bank of England names it as the accreditation and certification body for CBEST. A common arrangement is to require CHECK for a government-facing system, while a CREST-accredited company tests a private subsidiary or a related engagement that the government contract does not cover. Confirm with the contract owner whether the subsidiary's systems are in scope of the government requirement before splitting the work, because a split that leaves a shared service untested by an approved provider creates a gap that no single scheme will close.

Neither scheme replaces a scoped rules of engagement, a clear test objective or the remediation work that follows. A CHECK or CREST badge on the supplier says something about the company and its people, not about whether your particular engagement has defined targets, permitted techniques, testing windows, emergency contacts and data handling terms. NIST SP 800-115 includes a rules of engagement template in Appendix B for this reason. Ask the provider to show a signed rules of engagement for your test, and check that the objective (for example, proving that a specific customer data path can be reached from the internet) is written down before testing begins. Remediation is also outside what either scheme certifies. Budget internal effort to fix, retest and record each finding.

NIST SP 800-115 notes that organizations often combine techniques to reach an in-depth assessment at an acceptable level of risk, and that principle applies to scheme choice as well. Treat CHECK and CREST as inputs to procurement, not as a substitute for judgment. Before issuing a tender, confirm which scheme your contract, regulator or procurement rules name, whether they require CHECK specifically, accept CREST in its place, or ask only for a recognized accreditation. Where the answer is unclear, ask the regulator or the buyer's assurance team in writing and record the reply in the supplier file.

What to ask for in the deliverables from either scheme

This table lists what a buyer should request from a CHECK or CREST-accredited engagement, why each item matters and which scheme makes it easier to verify. Use it to write the statement of work and to confirm details before any testing begins.

Deliverable	Why it matters	Easier to verify under
Scope and rules of engagement	Defines which systems, networks and applications are in bounds, permitted techniques, testing windows and escalation contacts. Ambiguity here causes disputes and outages, so the contract should set these terms in writing before work starts.	Either scheme, provided the buyer requires the written document. Neither scheme replaces a buyer-approved rules of engagement.
Named team with titles and certificate status	Shows who will actually test your systems. Confirm each person's role, and whether they are Team Leader or Team Member, before the engagement begins.	CHECK: the NCSC describes Team Leader and Team Member titles that must be held, with SC clearance. Confirm titles through the provider.
Clearance and certification evidence for named staff	Confirms that the people named hold the credentials the scheme requires. For CHECK, confirm SC clearance and the Cyber Security Council title. For CREST, confirm the individual certification and its current status.	CHECK for SC clearance and title requirements. CREST for individual certification status, including the three-year renewal and CPD record the CREST page describes.
Methodology followed	Explains how the test was run, so the buyer can judge coverage. Ask which methodology the provider uses and how it maps to your target types, such as network, web application or cloud.	CHECK: the NCSC assesses CHECK companies against its methodology, so ask the provider to show this. CREST accredited companies must meet CREST's own standards.
Findings report and severity basis	Tells you what was found, how it was exploited, how severity was assigned and what to fix first. Ask for the severity scale in writing so findings can be compared across tests.	Either scheme. Confirm the report format and severity method in the contract, since neither scheme's facts supplied here set a format.
Retest arrangements	Establishes whether and how fixed findings are checked. Agree in the contract whether retests are included, how many, and how long the provider has to confirm closure.	Either scheme. The contract should set retest scope, timing and cost. Confirm these before work starts.
Evidence of work performed and access controls	Shows what testers did, from which location and with which accounts, plus how test credentials and data were handled. This supports incident response and audit trails.	Either scheme. Ask for it in the statement of work rather than assuming the provider will supply it.
Handling of findings and data	Sets how sensitive results, credentials and any client data encountered are stored, shared and destroyed. For public bodies and critical national infrastructure, confirm this against the buyer's own information security policy.	Either scheme. Confirm terms with the provider and your information security team.

What drives the cost and effort of a CHECK or CREST-assured test

A CHECK or CREST-assured test is priced by people, time and scope, not by a tool licence. The cards below set out who is paid for what, which parts are one-time and which recur, and what to ask for in a written quote before you compare providers.

Named staff and clearance level

Each named tester on a CHECK engagement must hold the required title and valid SC clearance, and that clearance and vetting take time and cost the provider money before any testing starts. Ask each provider which named individuals would do the work, their titles and clearance status, and whether the quote assumes those people or a substitute. A quote that names no one leaves you unable to judge the rate you are paying for.

Team Leader and Team Member mix

A CHECK team needs a Team Leader holding the senior title and at least one Team Member at the practitioner level, and the ratio of senior to junior hours drives the day rate blended into your quote. Ask how many hours each role will log, who writes the report, and who reviews it. A lead-heavy mix costs more per hour but may finish faster, so compare total effort, not just the rate.

Scope and number of targets

The number of hosts, applications, APIs, user roles and environments in scope is the largest single driver of effort. Each additional application or role adds test planning, exploitation and reporting time. Ask providers to list every target by type and count in the statement of work, and to state what is excluded, because unclear boundaries are where change requests and overruns usually start.

Internal, external or both

External testing of internet-facing assets and internal testing from inside your network need different access, set-up and travel or remote connectivity arrangements. Running both in one engagement usually costs less than two separate ones, but only if the provider scopes them together. Ask whether the quote covers both viewpoints, how access will be provisioned, and whether any testing must happen on your premises.

Accredited provider requirements

Requiring a CHECK or CREST-accredited company narrows the supplier pool and can raise the rate, since accredited firms carry assurance costs that others do not. Whether you need an accredited provider depends on your sector, as NCSC guidance separates central government and public bodies from private organisations. Confirm the requirement with your regulator or buyer before you issue the tender, not after receiving bids.

Provider-side CPD and certificate upkeep

Certificates such as CRT or CCT, and the continuing professional development needed to keep CHECK titles, are maintained by the provider and their cost sits inside the rates you pay. These obligations recur for as long as the firm stays in the scheme. Ask providers to confirm that every named tester's certificates and CPD are current, and do not expect those costs to appear as a separate line in the quote.

Cost of re-testing

Re-testing after remediation is a separate, recurring decision, and many quotes price the first test only. A focused retest of confirmed findings usually takes less effort than a full test, but the quote should say whether one retest is included, how many findings it covers and what a further round costs. Ask for the retest price in writing before signing, so remediation does not trigger an unplanned second contract.

Questions buyers ask about CHECK and CREST before hiring a tester

Does a private company have to use a CHECK provider?

No. The NCSC says non-public sector organisations do not need a CHECK provider. CHECK was developed for central government departments, public sector bodies and UK critical national infrastructure organisations, so the scheme's requirements apply most directly to those buyers. A private company can still choose a CHECK provider, or a CREST-accredited firm, based on its own risk appetite, customer contracts and regulator expectations. Your sector regulator or contract counterparty may name a scheme, so confirm that requirement in writing before you shortlist. Start with the NCSC's buyer guidance to check the current position.

Is CREST accreditation enough for a public body?

Not on its own, for most central government work. The NCSC says central government systems processing data marked OFFICIAL and above should be assessed by CHECK companies, and it strongly recommends CHECK for other public sector bodies. CREST accreditation covers company and individual standards that many buyers use, but CHECK is a separate NCSC-run scheme with its own assessment of each company's methodology and its own requirements for Team Leaders and Team Members. A public body should confirm which scheme its department, accreditor or contract requires, and ask any CREST-accredited provider to show its CHECK status directly.

What does SC clearance mean for a penetration tester?

SC clearance is UK government security vetting that a CHECK Team Leader and Team Member must hold, alongside their professional titles. The NCSC requires both roles to hold valid SC clearance, so a team that lacks it cannot be presented as CHECK-qualified for the work. Clearance is held by the individual, not the firm, and it has to remain valid for the duration of the engagement. Ask the provider to confirm, by name and role, which staff on your proposed team hold current clearance, and check the NCSC's buyer guidance for how clearance interacts with the CHECK titles.

How long does a CREST certificate last, and how does it link to CHECK?

CREST states that CHECK title holders must also hold a valid technical certificate, such as CRT for Team Members or CCT INF or CCT APP for Team Leaders, and that these are re-passed every three years. CREST also requires 75 hours of continuing professional development over a three-year cycle. The link works in one direction: a CREST individual certificate is a prerequisite that CHECK requires alongside the Cyber Security Council titles and SC clearance, but it does not by itself make a person or firm CHECK-approved. Confirm the expiry date of each named tester's certificate in the provider's written submission, and verify it with CREST.

Can our own staff run the penetration test instead of an outside provider?

Your staff can run tests, but a CHECK engagement must be performed by a CHECK company, and its named people must meet the title and clearance rules. Public bodies in scope of the NCSC guidance therefore cannot rely on an in-house team for a CHECK-assured test unless that team sits within a CHECK-assured provider. Other buyers may use internal testers, but a regulator or contract may still require independence from the system owner. Decide which scheme applies first, then ask whether your internal team meets its requirements, and document how any internal test is scoped and reported.

What must we provide during a CHECK-style engagement?

The buyer typically provides the written scope, rules of engagement, target lists, test accounts where authenticated testing is needed, named contacts, and a decision on whether testing runs in production or a staging copy. NIST SP 800-115 provides a rules of engagement template in its Appendix B, which is a useful starting point for the document both sides sign. Agree on incident contacts, emergency stop conditions and data handling before work starts. Ask the provider to list every input it needs in its proposal, because gaps in these inputs are the most common cause of delayed or narrowed testing.

How do we verify a provider's CHECK or CREST status?

Check each status against the official register or listing before you sign. Use the NCSC's CHECK pages and buyer guidance to confirm the company is CHECK-assessed, and use CREST's membership and certificate records to confirm accreditation and individual certifications. Ask for the names of the Team Leader and Team Members who would do the work, then match each person's titles, certificate and clearance against the source. Record the verification date in your procurement file, and repeat it at renewal, since statuses and individual certificates change over time.

How DeployOpen scopes and delivers security testing

DeployOpen is a Chainscore Labs company that plans, implements and supports self-hosted open-source platforms inside your own infrastructure, and runs security testing as part of that work. We do not issue CHECK or CREST status, so the scheme questions on this page are answered by you and the scheme bodies, and we help you prepare the evidence and scope that a qualified provider needs.

How we scope

Engagements are fixed-scope, with targets, deliverables and timelines agreed in writing before work starts.
The written scope states which systems, networks and applications are in scope and which are excluded.
We record who the testers will be and confirm whether the buyer requires a CHECK or CREST qualified provider.

How we build

We prepare the test environment, accounts and access paths that the agreed scope needs before testing begins.
Rules of engagement are documented, including testing windows, contacts and escalation steps for findings.
Testing is carried out against the agreed scope, and we confirm the tester qualifications named in the scope.

How we hand over

Findings are documented with reproduction steps, affected assets and remediation guidance for your team.
We deliver the scope, test records and report in a form your procurement or assurance team can file.
We walk through results with technical staff so remediation owners know what to fix first.

How we support

Retesting of remediated findings can be included in the written scope so closure is documented.
Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement.
Ask us to confirm in writing which scheme requirements our delivery does and does not cover before you sign.

CREST vs NCSC CHECK penetration testing