Read almost any UK penetration testing tender and two words will come up: CREST and CHECK. They are often treated as interchangeable or as legal requirements, and they are neither. This guide explains what each scheme is, when you genuinely need an accredited provider, and how to judge any provider on the evidence.
What is CHECK?
CHECK is run by the National Cyber Security Centre. It lets approved companies carry out penetration tests of systems belonging to government departments, the wider public sector and critical national infrastructure, using NCSC-defined standards. CHECK has two parts:
- CHECK companies: organisations approved by the NCSC to deliver CHECK engagements.
- CHECK individuals: testers who hold CHECK Team Member or Team Leader status. This depends on passing recognised exams and meeting NCSC requirements, including UK security clearance.
Because of these clearance and approval requirements, CHECK is designed around UK-based teams. If you are a government body or operate critical national infrastructure and the systems in scope fall under CHECK, you should use a CHECK company for that work.
What is CREST?
CREST is a not-for-profit accreditation and certification body for the technical security industry. It operates internationally, including in the UK, Europe, Asia-Pacific and the Americas, and works at two levels:
- Company accreditation for services such as penetration testing, which assesses a company's methodology, data handling, quality processes and staff.
- Individual qualifications such as CREST Registered Penetration Tester (CRT) and the more advanced CREST Certified Tester (CCT) exams for applications and infrastructure.
CREST also runs schemes linked to UK financial-sector testing, such as STAR and support for CBEST.
When accreditation genuinely matters
| Situation | What to ask for |
|---|---|
| Testing UK government or public-sector systems in scope for CHECK | A CHECK company and CHECK Team Leader |
| Critical national infrastructure where your regulator or contract specifies CHECK | A CHECK company |
| CBEST or similar intelligence-led testing for financial firms | Providers meeting that scheme's requirements |
| Procurement rules or a framework agreement that name CREST | CREST-accredited company |
| ISO 27001, PCI DSS, SOC 2, Cyber Essentials, customer due diligence | Usually no specific accreditation; ask your assessor |
PCI DSS, for example, requires testing by a "qualified internal resource or qualified external third party" with organisational independence. ISO 27001 auditors look for competent testing and evidence of remediation. Neither names CREST or CHECK.
How to judge any provider on the evidence
Accreditation tells you a company has passed an assessment at a point in time. It doesn't guarantee that the individual testing your systems is skilled at the technology you use. Whether or not a provider is accredited, ask for:
- Named testers and their qualifications, such as OSCP, OSWE, CRT/CCT or cloud and mobile specialisms.
- A redacted sample report with reproducible steps, business impact and practical fixes, not scanner output.
- A written methodology that references recognised standards such as OWASP WSTG, PTES or NIST SP 800-115.
- Clear data handling covering where your data is processed, how it is encrypted, who can access it, when it is deleted and which safeguards apply to international transfers under UK GDPR.
- Insurance, including professional indemnity and cyber cover appropriate to the engagement.
- Proper authorisation, with a signed scope and rules of engagement that satisfy the Computer Misuse Act 1990.
- Retest terms, ideally a free retest of fixed findings within an agreed window.
- References from organisations of a similar size and sector.
Where we stand
To be transparent: BestPentesting is operated by BugFoe Private Limited from India, and we don't claim CREST accreditation or CHECK status on this site. We support UK organisations whose testing doesn't require an accredited provider, which covers most private-sector work for ISO 27001, PCI DSS, SOC 2 and customer assurance. If your contract or a regulator requires CHECK or CREST, tell us at scoping and we'll tell you plainly whether we can meet it, so you can choose the right route without wasted time.
Frequently asked questions
Is CREST accreditation a legal requirement?
No. CREST is an industry accreditation and is not required by UK law. Some buyers, frameworks and regulators ask for it in their procurement requirements.
When do I need a CHECK provider?
CHECK is the NCSC's scheme for testing UK government departments, the wider public sector and critical national infrastructure. If you are one of those organisations, or your contract says so, use a CHECK company for in-scope systems. Most private-sector work doesn't need it.
What if a provider isn't accredited?
Judge them on the evidence: named testers and their practical certifications, a sample report, a clear methodology, references, insurance and how they handle your data. Accreditation is one useful signal among several.
Want to see how we work? Request a sample report and a fixed-price proposal in GBP, or read our methodology.