What CREST accreditation means when you buy a penetration test
CREST accreditation is a check on the testing company, not just the people it employs. Before CREST accredits a company, it assesses its governance and security controls, the competence of its testers, the methodology it follows, and how it protects client data. Accreditation is granted per discipline, such as penetration testing or vulnerability assessment, and companies are reassessed periodically to keep it. You can confirm any provider’s status yourself on CREST’s supplier directory.
That is the short answer. The longer one matters because “CREST” gets used loosely. A firm can employ one tester who passed a CREST exam and put the logo on its homepage. A procurement team can ask for “CREST testing” without saying which kind. This guide covers what the accreditation actually covers, what it doesn’t, and what to check before you sign.
Layer 7 became CREST accredited for penetration testing and vulnerability assessment in November 2026, so we have just been through the process. Everything below about what CREST assesses comes from CREST’s own published description of accreditation. If you’re choosing a provider now, our CREST penetration testing page covers what we test, how we work and what it costs.
Company accreditation and individual qualifications are different things
There are two separate things that both get called “CREST”:
- Company accreditation. CREST assesses the business: its processes, its methodology, its data security and the competence of its staff. If it passes, the company becomes an accredited member for the disciplines it applied for.
- Individual qualifications. Testers sit CREST exams in their own right. A qualified tester can work for a company that holds no accreditation at all.
Both are worth having. But they answer different questions. An individual qualification tells you a person passed an exam. Company accreditation tells you the organisation around that person has been checked: how it scopes, how it handles your data, how it reports and how it makes sure the next tester it sends is as competent as the last one.
When a contract or questionnaire asks for a “CREST-accredited provider”, it means company accreditation. A firm with qualified staff but no company accreditation doesn’t meet that requirement, however good its people are.
What CREST assesses
CREST describes accreditation as assurance that a company:
- operates with robust governance and security controls
- employs highly skilled and technically competent professionals
- follows proven methodologies and best practices
- upholds high standards of data security and client protection
To get there, an applicant submits evidence of its company processes, its service methodologies and its data security practices. Accredited companies then have to keep meeting those standards and go through periodic reassessment.
In practice, for a buyer, that means a few concrete things are already checked before you start. The company has a documented testing methodology rather than a tester’s personal habits. It has controls over how your findings, credentials and reports are stored and destroyed. And it has had to show how it keeps its testers’ skills current.
Accreditation is per discipline
This is the point most buyers miss. CREST doesn’t accredit a company for “security”. It accredits it for specific disciplines:
| Discipline | What it covers |
|---|---|
| Penetration Testing | Testing applications, infrastructure and cloud to find and exploit weaknesses |
| Vulnerability Assessment | Identifying and assessing known vulnerabilities across your systems |
| STAR: Intelligence Led Penetration Testing | Testing driven by threat intelligence about your organisation |
| STAR: Threat Intelligence for Simulated Attack | The intelligence that feeds intelligence-led testing |
| Incident Response | Responding to and recovering from security incidents |
| Security Operations Centres | Monitoring and detection services |
A company accredited for penetration testing is not, by that fact, accredited for incident response or for a SOC. So the right question isn’t “are you CREST accredited?” It’s “are you CREST accredited for the service I’m buying?”
Layer 7 holds CREST accreditation for Penetration Testing and Vulnerability Assessment. You can see this on our CREST Marketplace listing.
CREST, CHECK and The Cyber Scheme
Three names come up in UK testing procurement:
- CREST accredits testing companies, discipline by discipline, as above. Its members are listed on the CREST supplier directory.
- CHECK is the NCSC’s scheme under which NCSC-assured companies carry out authorised penetration tests. The NCSC says it was developed specifically for central government departments, public sector bodies and organisations forming the UK’s critical national infrastructure. See the NCSC’s CHECK page.
- The Cyber Scheme also accredits UK testing companies and qualifies individual testers. See cyberscheme.org.uk.
They aren’t interchangeable. If a contract names CHECK, a CREST accreditation doesn’t satisfy it, and the reverse is also true. Layer 7 is CREST accredited and a Cyber Scheme Accredited Company.
How to check a provider in two minutes
- Search the CREST supplier directory for the company’s exact name. Several firms have similar names, so match the registered company name and country rather than a single word in it.
- Check the discipline matches the work. If you are buying a penetration test, the listing should show Penetration Testing.
- Ask who will test. Company accreditation covers the organisation. You still want to know the qualifications of the people on your engagement.
- Ask whether testing is in-house. Some firms subcontract. That isn’t automatically a problem, but you should know who is touching your systems.
- Ask what happens after the report. Is a retest of fixed findings included, and at what cost?
None of these takes long, and the directory check removes any doubt about a logo on a website.
What accreditation doesn’t tell you
Accreditation is a floor, not a ranking. It doesn’t tell you:
- The price. CREST doesn’t set or publish prices.
- Whether the scope is right. A well-run test of the wrong systems is still the wrong test. Scoping is where most of the value is won or lost.
- Whether the report will be useful to you. Ask for a sample. You want findings ranked by real risk, with evidence and fixes your team can act on.
- Whether issues get fixed. That’s on you and your provider’s retest arrangements.
So use accreditation to build the shortlist, then choose on scope, people and reporting.
How we work
Layer 7 is CREST accredited for penetration testing and vulnerability assessment, and a Cyber Scheme Accredited Company. All testing is done by our own in-house testers, and a retest of remediated findings is included as standard.
We’re based in Northumberland and test for organisations across the North East and the UK. We’re also an IASME Cyber Essentials Certification Body, so if you need Cyber Essentials Plus as well as a test, both can come from one team. For the difference between a test and a scan, read penetration testing vs vulnerability scanning.