Why CREST Certification Matters for Penetration Testing Procurement
CREST is an international not-for-profit accreditation body that sets the standard for cyber security service providers. For organizations subject to regulatory requirements—PCI DSS, SOC 2, ISO 27001, or sector-specific frameworks like CBEST and TIBER-EU—engaging a CREST-accredited firm is often a prerequisite, not a preference.
CREST accreditation verifies that a firm’s testers hold validated qualifications (CRT, CCT, or CCSAS), follow standardized methodologies, and operate under strict data handling and legal protocols. This removes guesswork from vendor evaluation.
How CREST Accreditation Works
Firms undergo a rigorous assessment covering testing methodologies, data protection, legal compliance, and quality assurance. Individual testers must pass technical examinations and demonstrate between 6,000 and 10,000 hours of professional penetration testing experience, depending on certification level. Re-assessment occurs every three years.
Certification Tiers to Know
- CREST Pen Test
- Core accreditation for infrastructure and application penetration testing.
- CREST STAR
- Simulated Targeted Attack & Response—intelligence-led red team engagements aligned with frameworks like CBEST and TIBER-EU.
- CREST VA
- Vulnerability assessment services, often a precursor to full pen testing engagements.
- CREST IR
- Incident response capability, relevant for firms offering end-to-end security testing and response.
Market Landscape
Approximately 300 firms worldwide hold CREST accreditation for cybersecurity services, though the number specifically accredited for penetration testing is a subset. The market spans from global consultancies like NCC Group and Trustwave with thousands of employees, to specialist boutiques with deep expertise in niche areas such as IoT security, SCADA/ICS testing, or financial sector red teaming.
Key Selection Criteria Beyond CREST
| Factor | Why It Matters |
|---|---|
| Industry experience | Regulated sectors (finance, healthcare, government) have domain-specific requirements |
| Geographic coverage | On-site testing may require local presence; data sovereignty rules vary by jurisdiction |
| Complementary certifications | CHECK (UK government), OSCP/OSCE (offensive skills), ISO 27001 (management systems) |
| Reporting quality | Executive summaries, remediation guidance, and re-testing policies differ significantly |