Contents
Anyone can call themselves a penetration tester. There is no licence required to use the term, no register you have to join, and no law that stops a one-person operation with a scanning tool from quoting you for a “full penetration test“. That is exactly why the word on the quote tells you so little, and why buyers need a reliable signal of who is actually doing the work and to what standard.
When it comes to cybersecurity, and penetration testing in particular, CREST accreditation is one of the few signals that genuinely carries weight. If you have seen it on a provider’s website, or an insurer or auditor has asked whether your testing is CREST-accredited, this guide explains what it actually means, how it differs from the NCSC’s CHECK scheme, and why it should matter when you are choosing who to trust with your systems.
What is CREST?
CREST is an international not-for-profit body that accredits organisations and certifies individuals across the technical security industry, penetration testing included. It exists to raise and police the standard of security testing, so that a business buying a test has some assurance of what they are getting rather than having to take a provider’s word for it.
Crucially, CREST operates at two levels, and understanding the difference is the key to the whole subject. It accredits companies, and it certifies the individual testers who work for them. A provider that describes its testing as CREST-accredited should be able to demonstrate both.
What does CREST-accredited penetration testing actually mean?
At the company level, becoming a CREST member is not a matter of paying a fee and displaying a logo. The organisation has to pass a demanding assessment of how it works, covering its testing methodology, its internal processes, the way it handles client data, and the policies and codes of conduct its staff operate under. Membership is then subject to ongoing scrutiny rather than being a one-off badge, which means the standard has to be maintained, not just reached once.
CREST certifies testers through rigorous written and practical exams that assess genuine hands-on competence. So, at the individual level, the most common qualifications you will come across are the CREST Registered Tester, known as the CRT, and the more senior CREST Certified Tester, or CCT, with the CREST Practitioner Security Analyst sitting at entry level. When a CREST-accredited provider assigns testers to your engagement, those people have had their skills independently verified rather than simply asserted on a CV, giving you more confidence in their ability to deliver the work safely and efficiently.
Put the two together and CREST-accredited penetration testing means work delivered by an audited, accountable company, carried out by testers whose competence has been independently proven, to a methodology that has been checked against a recognised standard. That is a meaningfully different proposition from an unverified provider, even when the two quotes look similar on the surface.
CREST vs CHECK: what is the difference?
The other term you are likely to meet is CHECK, and the two are related but not the same. CHECK is a scheme run by the National Cyber Security Centre, which is part of GCHQ, and it governs penetration testing of UK government and public-sector systems. Where CREST is international and applies across every industry, CHECK is specifically a government assurance scheme.
CHECK team members and team leaders are required to hold CREST or equivalent qualifications, so the competence bar is shared, but CHECK adds the layer of security clearance and government oversight that testing sensitive public-sector systems demands.
| CREST | CHECK | |
| Run by | CREST, an international not-for-profit body | The NCSC (part of GCHQ) |
| Applies to | Any organisation, in any sector | UK government and public-sector systems |
| Assesses | Companies and the individuals within them | Approved companies and cleared individuals |
| When it matters to you | Almost any commercial penetration test | Testing systems that hold data classified OFFICIAL or above |
For most private-sector businesses, CREST is the accreditation that matters, and it is the right thing to look for. CHECK becomes relevant if you are a government department, a public-sector body, or a supplier testing systems that handle classified government data, in which case CHECK-approved testing is the expectation. Notably, a provider can hold both, which is common among the more established firms.
Why look for CREST accreditation when choosing a provider
When choosing a penetration testing provider, there are a few practical reasons why CREST accreditation should shape your decision, and the first is competence you can actually verify. Rather than trying to judge technical skill from a sales conversation, CREST provides independent confirmation that the people testing your systems have passed assessments designed to prove they can do the job.
The second is a consistent, recognised methodology. A CREST member works to an audited approach rather than improvising, which means your test follows a structured process and your report arrives in a form that auditors and insurers recognise.
The third is one that is easy to overlook, and it concerns what happens to your data. A penetration test report is essentially a detailed map of how to break into your organisation, so how securely that document is produced, stored and transmitted genuinely matters. CREST accreditation assesses exactly this kind of data handling, which is reassurance you simply do not get from an unaccredited provider.
Fourthly, CREST members operate under a code of conduct and a complaints process, so there is a route to redress if something goes wrong. An unaccredited one-person operation offers no such backstop.
Perhaps most importantly for anyone with a compliance obligation, CREST-accredited testing is widely recognised by the frameworks and third parties you answer to. Cyber insurers increasingly ask for it, and it slots neatly into compliance work such as ISO 27001 and PCI DSS, where auditors want confidence that technical testing was carried out competently and independently.
Does CREST accreditation guarantee a good test?
In the interests of honesty, no accreditation can promise that, and it would be misleading to suggest otherwise. CREST tells you that a provider is competent, audited and accountable, which rules out a great deal of what can go wrong. What it cannot tell you is whether that provider will take the time to understand your particular business and scope the test around your real risks.
That part comes down to how the provider works with you, which is the heart of consultant-led penetration testing and something we would encourage you to probe regardless of the badges on display. The strongest position is a provider who is both CREST-accredited and genuinely consultative, because you then get verified competence and the judgement to point it at the right targets. If you want a fuller set of questions to put to any provider before you commit, our guide to what you are actually paying for when you buy a penetration test lays them out, and our piece on what businesses get wrong about penetration testing covers the traps to avoid.
Frequently asked questions
What does CREST stand for in penetration testing?
CREST is an international not-for-profit accreditation and certification body for the technical security industry. In practice, “CREST-accredited penetration testing” means testing delivered by a CREST member company, carried out by testers who hold CREST qualifications, to an audited and recognised standard.
Is CREST accreditation a legal requirement?
No. There is no legal obligation to use a CREST-accredited provider, and no law regulating who may call themselves a penetration tester. That absence of regulation is precisely why a voluntary, independently assessed standard like CREST is such a useful signal of quality.
What is the difference between CREST and CHECK?
CHECK is the NCSC’s scheme for testing UK government and public-sector systems, while CREST is an international accreditation that applies across all sectors. The two share a competence bar, since CHECK testers hold CREST or equivalent qualifications, but CHECK adds the clearance and oversight needed for sensitive government work. So, unless you’re working with UK government or public-sector systems, CREST is the relevant mark.
Do I need a CREST-accredited provider for ISO 27001 or PCI DSS?
Neither framework names CREST as a strict requirement, but both expect testing to be carried out competently and independently, and CREST-accredited testing is a widely recognised way to demonstrate that. For PCI DSS in particular, using an accredited provider makes your evidence far easier for an assessor to accept.
How do I check that a provider is genuinely CREST-accredited?
Ask for the company’s CREST membership and confirm it, and ask which CREST qualifications the specific testers on your engagement hold. A genuine member will answer both without hesitation, because the accreditation is verifiable and they have no reason to be vague about it.
Looking for CREST-accredited penetration testing?
Fortifi is a CREST-accredited provider, and our testing is carried out by qualified, independently assessed consultants working to a recognised methodology, with your report handled to the standard that accreditation demands. Better still, we pair that verified competence with a proper scoping conversation, so your test is aimed at the risks that matter to your business rather than run to a template. Get a quote today.