CHECK vs CREST in 2026: Which Scheme Your Firm Needs

CHECK is the NCSC's scheme for testing UK government, public sector and critical national infrastructure systems, and it now asks a lot: every Team Leader and Team Member needs a UK Cyber Security Council Security Testing title and SC clearance, and the firm needs Cyber Essentials Plus on every system holding engagement information. CREST is an international accreditation of how a firm runs its testing, and in our experience it is the one private sector and regulated buyers ask for. Unless public sector work is in your plan, pursue CREST first.

Two schemes built for different buyers

CHECK is run by the National Cyber Security Centre, part of GCHQ. It assures companies to carry out authorised penetration tests of public sector and national infrastructure systems, checks that they follow its methodology, and audits CHECK reports. The customer it protects is government.

CREST is a not-for-profit membership body that accredits firms in penetration testing and other disciplines, with members worldwide. Its customer is any buyer who wants assurance about a supplier. Put simply, CHECK assures a team for a government customer, and CREST assures a firm's process for the market.

Who must use CHECK

The NCSC's buyer guidance is specific. For central government, "all systems processing data protectively marked OFFICIAL and above (up to Top Secret but excluding STRAP systems) should be assessed by companies assured under CHECK". For other public sector bodies it strongly recommends CHECK "unless the system's risk owner explicitly advises otherwise".

Critical national infrastructure is named as an audience, but the NCSC is equally clear about everyone outside the public sector: "If your organisation is not public sector, penetration testing does not need to be conducted by a CHECK service provider."

In our experience public sector buyers treat "should" and "strongly recommend" as procurement rules, because departing from them needs a risk owner to put their name to the decision. Few will do that to save a day rate.

What CHECK asks of a company now

The NCSC's provider page sets four minimum requirements:

• Cyber Essentials Plus, in date, "for all the systems on which information related to customers' engagements is stored and processed".
• At least two sample reports, conducted under the company's name and written by at least one of the proposed Team Leaders.
• Clearance eligibility: every proposed team member must be eligible to hold SC clearance.
• A Principal title: at least one proposed Team Leader must hold a UK Cyber Security Council title in Security Testing at Principal or above.

Once admitted, the CHECK Scheme Standard (version 1.1, November 2024) adds running obligations. A named Service Owner, Technical Lead and Team Leaders answer to the NCSC. The firm must perform CHECK tests regularly, give the NCSC its Cyber Essentials Plus certificate number each year, submit an annual management information report, and secure in each customer contract its right to pass the report to the NCSC.

Reports carry the CHECK logo, name the author and the Primary Team Leader, who signs them off, and leave out sensitive data, passwords and personal data. Every issue is rated high, medium, low or informational, with CVSS allowed only alongside. There is no critical level, so a firm with a five-level scale needs a CHECK variant of its template and a written rule for mapping onto it; our guide to penetration testing severity levels covers the mapping.

Entry is by expression of interest. Applications open in phases, invited firms have four weeks to apply, a technical panel reviews them, and an unsuccessful firm may be barred from reapplying for 12 months. Membership is free; the costs are Cyber Essentials Plus and the titles.

Titles, clearance and the exams behind them

A Team Leader must hold at least a Principal Cyber Security Professional (Security Testing) title from the UK Cyber Security Council, and a Team Member at least a Practitioner title. Both must hold valid SC clearance. Team Leaders had until 31 March 2025 and Team Members until 31 March 2026, so both deadlines have passed, and a new Team Member must hold the title when applying.

The exams still matter. A title rests on a valid technical examination plus an assessment of non-technical competence, kept current through continuing professional development. CREST maps its CRT to the Team Member role and CCT INF or CCT APP to the Team Leader role, and says the Primary Team Leader must be qualified in the discipline of the test, web applications or infrastructure. The Cyber Scheme's CSTM and CSTL are the equivalents, and both bodies handle Security Testing title applications.

To apply, every proposed team member must be eligible for SC, and the NCSC asks firms to make every effort to have clearance in place first; to work as a Team Leader or Team Member, it must be held. Clearance is the item a small firm cannot hurry, so build the proposed team around people who already hold SC or plainly can.

What CREST covers

CREST accredits firms discipline by discipline: penetration testing, vulnerability assessment, incident response, security operations, threat intelligence, threat-led and intelligence-led testing, and security architecture, with supplements for AI-enabled testing and for testing AI systems. Every accredited firm also meets the Company General Requirements, which gained a domain on responsible AI use on 28 July 2026.

The penetration testing standard covers preparation, scoping, execution, reporting and QA, people and tools. CREST does not require individuals to hold CREST qualifications for the firm to be accredited; it assesses whether the team is competent. Membership renews every year. Our post on CREST accreditation for a small firm covers the evidence and the published fees.

CREST also sits under UK financial sector testing. The Bank of England requires CBEST threat intelligence and penetration testing providers to be CBEST accredited and CREST members, and to employ certified individuals.

Choosing for your market

CHECK is a commitment rather than a badge. The NCSC expects regular CHECK work, audits your reports and dictates how you handle data, so apply when you have a public sector pipeline, not in the hope of one. CREST is the general-purpose credential, and for most firms it is the right place to start.

Where engagement data must live

CHECK is explicit. Testing follows the data handling rules agreed at scoping, and sensitive client data leaves the customer's network only as part of the report. Once the customer confirms receipt, the firm erases the test data or moves it to a secure internal repository, keeping it only as long as legal, regulatory and data protection requirements need.

The Cyber Essentials Plus requirement then reaches every system on which engagement information is stored and processed, and the current Cyber Essentials requirements (version 3.3, April 2026) state: "If your organisation's data or services are hosted on cloud services, these services must be in scope." Your reporting platform, file storage and testing laptops sit inside that boundary, wherever they are hosted.

CREST asks the same question through its data domains, so do the work once: list every place engagement data can land, including laptops, email, file shares, AI tools and backups, reduce it to as few as you can, and be able to show deletion happening on schedule. A system you administer is far easier to put in scope than a shared service you cannot inspect. Our posts on how long to keep client findings and handling evidence and credentials go further.