Do I Need CREST-Certified Penetration Testing?

CREST-certified penetration testing means your security assessment is carried out by a company that has been independently audited against defined standards for methodology, data handling, and staff qualifications. You don’t always need it. But if you operate in financial services, government, or any sector where regulators specify testing requirements, CREST accreditation is often the minimum threshold for an acceptable provider.

What CREST Certification Actually Means

CREST (the Council of Registered Ethical Security Testers) is an international not-for-profit accreditation body based in the UK. It was established in 2006 to set standards for the information security testing industry. CREST operates two distinct programmes: company accreditation and individual certification. Both matter, and they serve different purposes.

Company accreditation is an audit of the penetration testing firm itself. CREST assessors review the company’s testing methodologies, quality assurance processes, data handling procedures, and staff vetting. They check that consultants hold appropriate qualifications and that the company maintains professional indemnity insurance. This audit happens regularly – it is not a one-time badge.

Individual certification tests the skills of the actual people performing the work. CREST runs its own examinations, and these are notoriously difficult. The pass rates are low by design.

Company Accreditation vs Individual Certification

This distinction trips people up. A company can be CREST-accredited while employing a mix of CREST-certified and non-certified testers. What the accreditation requires is that qualified staff lead and review engagements – not that every person on the team holds an individual CREST exam pass.

The main CREST individual certifications are:

• CRT (CREST Registered Tester) – the baseline. Covers core penetration testing knowledge across infrastructure and web applications. This is broadly equivalent to an entry-to-mid-level professional qualification.
• CCT (CREST Certified Tester) – split into Infrastructure and Web Application tracks. The CCT is a significantly harder exam and represents a senior-level practitioner. Many regulated frameworks specifically reference CCT-level testers.
• CCSAS (CREST Certified Simulated Attack Specialist) – required for threat-led penetration testing under frameworks like CBEST and STAR-FS. This is the highest individual CREST qualification.

When CREST Is Required

Several regulatory frameworks either mandate or strongly recommend CREST accreditation. Here are the main ones.

CBEST (Bank of England)

CBEST is the Bank of England’s framework for intelligence-led penetration testing of UK financial institutions. It is mandatory for systemically important banks and financial market infrastructure providers. The Bank of England requires that CBEST tests are performed by CREST-accredited companies, and that the testers hold CCSAS certification. There is no workaround here – if you need a CBEST assessment, the provider must be CREST-accredited.

STAR-FS

STAR-FS (Simulated Targeted Attack and Response for Financial Services) builds on CBEST principles and extends threat-led testing to a broader range of financial services firms regulated by the FCA and PRA. Like CBEST, it requires CREST-accredited providers with appropriately certified testers.

PCI DSS

The PCI Security Standards Council does not technically mandate CREST. However, PCI DSS Requirement 11.4 (penetration testing) requires that tests are performed by qualified personnel. The PCI SSC’s guidance document on penetration testing specifically lists CREST as an example of an appropriate industry qualification for testers. In practice, many QSAs (Qualified Security Assessors) prefer or require a CREST-accredited provider when reviewing penetration test reports. If your QSA queries whether your testing firm meets the “qualified” standard, CREST accreditation answers that question immediately. See our full guide to penetration testing for PCI DSS 4.0.1 for more detail.

UK Government and MoD Contracts

Government procurement frameworks frequently specify that penetration testing suppliers must hold CREST accreditation or equivalent (CHECK, which is itself being consolidated with CREST – more on that below). Defence contracts, particularly those involving classified systems, often have even stricter requirements including security-cleared personnel.

Cyber Insurance Policies

Some cyber insurance providers now specify in their policy terms that penetration tests must be performed by a CREST-accredited company. This is not universal, but it is becoming more common. If your insurance policy has this requirement and you use a non-accredited provider, the insurer could dispute a claim. Worth checking the small print.

DORA (Digital Operational Resilience Act)

The EU’s DORA regulation, which applies to financial entities operating in the European Economic Area, requires threat-led penetration testing (TLPT) for significant financial institutions. DORA references the TIBER-EU framework for TLPT execution, which in turn recognises CREST accreditation as a qualifying standard for testing providers. For organisations subject to DORA’s TLPT requirements, using a CREST-accredited firm is one of the clearest paths to demonstrating provider competence. We cover DORA’s testing requirements in detail in our post on DORA implications for penetration testing.

When CREST Is Recommended but Not Mandatory

Outside of the specific frameworks above, CREST is a “nice to have” rather than a hard requirement. That said, there are situations where it still makes sense to choose a CREST-accredited provider even when nobody is forcing you to.

If your organisation handles sensitive customer data and you need to demonstrate due diligence – whether for board reporting, client assurance, or supply chain requirements – a penetration test from an accredited provider carries more weight than one from an unknown firm. This is particularly true if you expect to share the test report with third parties. A report from a CREST member company is instantly recognisable as meeting a baseline standard.

SOC 2, ISO 27001, and similar frameworks don’t mandate CREST specifically, but they do require evidence that security testing is performed competently. Using a CREST provider simplifies that evidence trail.

CREST vs CHECK vs Tiger Scheme vs OSCP

The UK penetration testing market has several overlapping accreditation and certification schemes. Here is what each one is and when it matters.

CREST

International scope. Accredits companies and certifies individuals. Recognised by regulators in the UK, EU, Middle East, Asia Pacific, and the Americas. The most widely accepted accreditation for commercial penetration testing globally.

CHECK

Run by the NCSC (National Cyber Security Centre, part of GCHQ). CHECK was specifically designed for testing UK government systems and CNI (Critical National Infrastructure). In 2024, the NCSC announced that CHECK is transitioning to align with CREST, reflecting the overlap between the two schemes. If you are testing government systems, CHECK approval is what procurement teams look for – but CREST is increasingly accepted as equivalent.

Tiger Scheme

A UK-based individual certification scheme. Tiger Scheme certifies people, not companies. It was created to provide an alternative to CREST individual exams. Tiger Scheme qualifications are recognised in some government and commercial contexts, but they don’t carry the same international weight as CREST. For UK-focused work, Tiger Scheme-qualified testers are generally considered competent. For international engagements or regulated sectors, CREST is the stronger credential.

OSCP / OSWE (Offensive Security)

OSCP (Offensive Security Certified Professional) and OSWE (Offensive Security Web Expert) are individual certifications from OffSec. They are practical, hands-on exams – you pass by hacking machines in a timed lab environment. Many hiring managers consider OSCP one of the best indicators of actual testing ability. However, OSCP and OSWE are individual certifications only. They say nothing about the company’s processes, insurance, data handling, or quality assurance. Regulators and procurement frameworks almost never accept OSCP as a substitute for CREST company accreditation. An excellent pentester might hold OSCP, CCT, both, or neither. But when a contract requires a CREST-accredited firm, an individual OSCP does not satisfy that requirement.

Benefits of Using a CREST-Accredited Provider

Beyond ticking regulatory boxes, there are practical reasons to work with a CREST-accredited firm.

• Vetted methodology – CREST assessors review the company’s testing approach. This doesn’t guarantee perfect testing, but it does mean someone independent has checked that the methodology is structured, documented, and follows recognised standards.
• Qualified staff – the accreditation requires that senior testers hold relevant qualifications. You can verify a company’s accreditation status on the CREST website.
• Professional indemnity insurance – CREST-accredited companies must carry appropriate PI insurance. If something goes wrong during a test (and on rare occasions it does), there is a safety net.
• Complaints process – CREST operates a formal complaints procedure. If you’re unhappy with the quality of work, you have a route to escalation beyond just arguing with the vendor.
• Data handling standards – CREST audits how member companies store, transmit, and dispose of client data. Penetration test reports contain some of the most sensitive information about your organisation’s security posture. You want confidence that this data is handled properly.

The Honest Take

CREST accreditation does not automatically mean you will get a better penetration test. We’ve seen CREST-accredited firms produce mediocre reports, and we’ve seen independent consultants without CREST do exceptional work. Accreditation is a floor, not a ceiling.

What CREST does well is filter out the worst providers. Companies that cannot meet basic standards for methodology, staffing, and data handling will not pass the CREST audit. That filtering is useful when you don’t have deep technical knowledge yourself and need a reliable way to shortlist providers.

Some genuinely excellent penetration testers and small firms choose not to pursue CREST accreditation. The cost and administrative overhead of maintaining accreditation can be significant for smaller companies. The absence of CREST doesn’t mean a firm is bad. But in regulated industries – financial services, government, critical infrastructure – CREST is often non-negotiable regardless of how skilled an unaccredited provider might be.

The practical advice: if your sector or a specific contract requires CREST, get a CREST provider. If it doesn’t, use CREST accreditation as one input alongside references, sample reports, and the firm’s track record – not as the sole deciding factor.

How FORTBRIDGE Can Help

FORTBRIDGE is a CREST-accredited penetration testing company with operations across the UK and the EMEA region. We also hold DESC accreditation for work in the UAE and Dubai. Our testers hold CREST individual certifications including CRT and CCT, alongside OffSec certifications (OSCP, OSWE, OSEP) and other industry qualifications.

Whether you need penetration testing for regulatory compliance, client assurance, or simply to find and fix vulnerabilities before an attacker does, we can help. Get in touch to discuss your requirements.

Frequently Asked Questions

Is CREST penetration testing mandatory?

Not universally. CREST is mandatory for specific frameworks like CBEST and STAR-FS in UK financial services. It is strongly recommended for PCI DSS compliance and is often required in government procurement. For most commercial organisations outside regulated sectors, it is recommended but not legally required.

What is the difference between CREST accreditation and CREST certification?

Accreditation applies to the company – it means the firm has been audited for its processes, methodology, staff qualifications, and data handling. Certification applies to individual testers who have passed CREST examinations (CRT, CCT, or CCSAS).

Is OSCP equivalent to CREST?

No. OSCP is an individual certification that tests hands-on hacking skills. CREST includes both company accreditation and individual certification. They measure different things. An OSCP holder working at a non-CREST firm does not satisfy a requirement for CREST-accredited testing.

Does CREST accreditation guarantee quality?

It guarantees a baseline. CREST accreditation means the company has passed an independent audit of its processes and employs qualified testers. It does not guarantee that every individual engagement will be excellent. Always check references and request sample (redacted) reports alongside verifying accreditation.

What is happening with CHECK and CREST?

The NCSC announced in 2024 that CHECK is being transitioned to align with CREST. The aim is to reduce duplication between the two schemes. Government procurement is increasingly accepting CREST accreditation where CHECK was previously required, though the transition is still in progress.

About Post Author