CREST Penetration Testing Accreditation for Small Firms

CREST penetration testing accreditation assesses your company, not your testers: CREST states there is no mandatory requirement for individuals to be CREST qualified for a firm to be accredited. What it checks is that every engagement runs the same documented way, against published standards covering preparation, scoping, execution, reporting and QA, people and tools, and that you can prove it. On CREST's published fees a small firm's first year costs about £10,500 before tax, and in our experience preparation takes around three months if the habits already exist.

Certifications and accreditation answer different questions

An individual certification such as CRT or CCT says one person passed an examination on a particular day. Company accreditation says the firm has a process, follows it on every engagement, and has shown an independent reviewer the evidence. Buyers blur the two, and so do firms: a team of certified testers can still fall short because nobody wrote down how scoping works or who reviews a report before it leaves.

CREST's wording is plain. Individuals are assessed "based on their skills and experience or any qualifications they may hold", and the aim is a team "sufficiently staffed with people with suitable levels of knowledge and competence". Certificates make that easier to show. They do not replace it, and accreditation does not make a junior tester senior.

Accreditation assesses the firm you are in the week your best tester is on leave.

What the standard is made of

Accreditation rests on two layers. The Company General Requirements apply to every accredited provider, whatever it sells, and since 28 July 2026 they include a domain on responsible AI use, covering "the governance, oversight, transparency and responsible organisational use of AI by the service provider". The Penetration Testing Accreditation Standard then covers the discipline in six domains.

The standards are publicly available, but CREST emails them after you complete a short form. Read the current versions rather than any summary, this one included, because they change: firms that use AI inside their testing can now also apply for an AI-Enabled Penetration Testing annex, with its own £500 application fee.

A methodology you can show

The execution domain asks for a clearly defined methodology in line with industry practice, and clear exploitation procedures. In practice that means four things written down:

• The public frameworks you build on. The OWASP Web Security Testing Guide for web applications and MASVS for mobile are easier to defend than a method you invented.
• How coverage is decided and recorded. A checklist per type of test, completed during the engagement, is the simplest proof that the method was followed rather than remembered.
• When a tester stops and asks. Exploitation procedures are about decisions, not techniques: what needs the client's agreement before it is attempted, who gives it, and where that is logged.
• How deviations are handled. Scope changes, blocked access and shortened windows, agreed in writing and reflected in the report.

In our experience the commonest weakness is a methodology written for the assessor: forty pages describing a process nobody follows. An assessor who reads it and then three of your reports sees the gap quickly. Write the method you actually run, at a length you will maintain.

Reporting, QA and a severity system

The reporting domain expects quality assurance before delivery and a defined system for rating the severity of findings. Both need a record, not a reputation.

For QA, the evidence is who reviewed each report, what they queried or changed, and when they approved it. A sole practitioner cannot peer review their own work, so either arrange review by a trusted associate under a confidentiality agreement, or document a structured self-review done a day after writing, and tell the assessor which you do. Our QA process for a busy month lists what a reviewer should check.

For severity, CVSS on its own is a scoring method, not a system. The system is your levels, how scores map onto them, when a tester may move a rating and how the reason is recorded in the finding, and what informational is for. Its test is consistency: two testers should rate the same issue the same way. Our guide to penetration testing severity levels has a table you can adopt.

Protecting client data

Client data runs through three domains: information security controls in preparation, data transmission in scoping, and the security of client information and the test environment in execution. Expect questions like these:

• Where do findings, evidence and reports live, and who can read them?
• Is multi-factor authentication enforced on every system that holds them?
• How do reports reach the client, and does anything travel as an email attachment?
• How are client credentials stored during the test, and when are they revoked?
• What is deleted when an engagement ends, and how do you know it happened?
• If testers use AI tools, what client data reaches them, and under whose terms?

Answer with mechanisms rather than intentions. "Only authorised staff have access" gives an assessor nothing to verify; "access is restricted by role, enforced by the system that stores the data, with multi-factor authentication for everyone" can be checked. Our posts on handling evidence and client credentials and how long to keep client findings cover the detail.

Evidence an assessor asks for

CREST describes the application as detailed evidence of company processes, service methodologies and data security practices, with everyone who delivers the service registered. Build the pack around that:

• The methodology, versioned, with an owner and a review date.
• Two or three recent engagements traced end to end: scope, authorisation, report, QA trail and delivery.
• Written severity definitions, including how CVSS maps onto them.
• The QA procedure: who may approve a report and what they check.
• An information security policy and proof it operates: access lists, multi-factor enforcement, device controls.
• A retention and deletion policy, with an example of deletion carried out.
• A tool list showing how tools are vetted and kept up to date.
• Training records for each tester, and an AI use policy.

Choose engagements that show the process working, including one where something went wrong and the process caught it. A scope change handled properly tells an assessor more than a test where nothing happened.

What it costs and how renewal works

CREST publishes its fees. These are in pounds, before tax:

For a firm with revenue under £1m going straight to membership on the Access tier, the first year is £10,500, then £7,500 a year. Membership renews annually with a form, supporting documents and a fresh signature on the Code of Conduct. CREST may audit on site, and accredited companies "undergo periodic reassessments", at an interval it does not publish. Each Pathway stage allows up to two years before you must move on.

Is it worth it? If your buyers ask, yes, and for intelligence-led work in UK finance it is a precondition: the Bank of England requires CBEST providers to be CREST members. If you sell to small businesses who never ask, the money mostly buys the discipline of a process you should have anyway, and that you can build without the badge.

A realistic preparation plan

Three months assumes the habits exist and the work is writing them down and proving them. If you have no QA step today, add a month, because you need engagements that went through it before you can show it.

1. Weeks 1 to 2: read and score. Request the current standards, read the general requirements and the penetration testing standard, and rate yourself domain by domain. The Pathway+ self-assessment is a useful structure even if you never enrol.
2. Weeks 3 to 6: write the documents that carry the weight. Methodology, severity definitions, QA procedure, and information security with retention and AI use. Short and true beats long and aspirational.
3. Weeks 7 to 10: run real engagements under them. Keep everything: scope, authorisation, checklists, QA comments, delivery record. Where reality disagrees with a document, fix the document or the habit.
4. Weeks 11 to 12: assemble and submit. Register everyone who delivers the service, build the evidence pack, and budget for one resubmission, which the application fee already covers.

If public sector work is also in your plans, read CHECK or CREST first, because CHECK's requirements fall on your people rather than your paperwork.