If you’ve ever issued a tender for penetration testing, you’ve probably seen the requirement: “Supplier must be CREST accredited.” But what does that actually mean, and why does it matter?
What is CREST?
CREST is an international, not-for-profit accreditation and certification body for the technical information security industry. It accredits companies that provide services such as penetration testing, and certifies the individuals who carry out the work.
For a company to become CREST accredited, its policies, processes and procedures are assessed, including how it runs tests, protects client data and manages the quality of its work. Individual testers can also hold CREST certifications that demonstrate their technical skills.
What accreditation tells you
- The provider follows a defined, repeatable testing methodology
- Client data is handled under documented security controls
- Testers are qualified, and the company invests in their skills
- There’s a complaints and quality process if something goes wrong
In short, accreditation gives you confidence that a test will be thorough, consistent and professionally reported, rather than dependent on one person’s approach.
Why buyers ask for it
Procurement teams use CREST as a quick, independent way to filter suppliers. Insurers and auditors recognise it. And for regulated organisations, being able to show that testing was carried out by an accredited provider makes the evidence more robust.
How to check a provider
CREST publishes a directory of its member companies, so you can confirm a provider’s accreditation directly rather than relying on a logo on their website. It’s also worth asking which services the accreditation covers and who will carry out your test.
What a CREST-accredited test looks like
A good test starts with scoping: understanding your systems, your risks and what you want to learn. It’s followed by controlled testing under agreed rules of engagement, and a report that explains what was found, how it could be exploited and what to fix first, in language both your technical team and your board can use.
CyberQ Group is CREST accredited. Our penetration testing service covers web applications, APIs, mobile apps, cloud, wireless and infrastructure. If you’re wondering what a test might involve for you, our guide to what drives the cost of a penetration test explains the scoping factors.
CREST and other schemes
CREST isn’t the only scheme you may come across. The National Cyber Security Centre runs its own schemes for testing certain government and public sector systems, and some sectors have their own testing frameworks. If you’re buying for a specific regulatory or government purpose, check which scheme the requirement actually refers to. For most commercial organisations, CREST accreditation is the recognised benchmark.
Questions to ask any testing provider
- Is your accreditation current, and does it cover the type of testing I need?
- Who will carry out the test, and what are their qualifications?
- What methodology do you follow?
- How do you store and protect our data during and after the test?
- Can we see an example report?
- How will you communicate if you find something critical during testing?
- What support do you offer after the report?
A good provider will be happy to answer all of these before you sign anything.
Looking for a CREST-accredited partner?
Talk to our team about your testing needs, or scope your test online with AskQ.
