Short answer: CHECK is the NCSC’s scheme for penetration testing of government, public sector and critical national infrastructure (CNI) systems. CREST is an industry accreditation body whose members are audited and listed on the public CREST Marketplace, and it is the usual benchmark for everyone else. If you are not public sector or CNI, and no contract requires CHECK, a CREST-accredited provider is normally the right choice. Some firms hold both.
Checked 28 October 2026.
What is CHECK?
The NCSC describes CHECK as “the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and CNI systems and networks” (NCSC). It “sets standards for penetration testing that government departments, public sector bodies and the UK’s critical national infrastructure (CNI) organisations can trust”.
CHECK was developed specifically for:
- central government departments
- public sector bodies
- organisations forming the UK’s critical national infrastructure
The NCSC also says CHECK reports must rate risk as HIGH, MEDIUM, LOW or INFORMATIONAL (NCSC guidance).
What is CREST?
CREST is an international accreditation body for cyber security companies. It says it has “over 500 Member companies worldwide”, that members “undergo rigorous audit and accreditation processes” and “sign enforceable Codes of Conduct and Ethics”, and that “All members feature on the CREST Marketplace” (CREST).
CREST accredits companies for specific services, such as Penetration Testing, and also offers qualifications for individual testers, such as CREST Registered Penetration Tester (CRT) and CREST Practitioner Security Analyst (CPSA).
What is the difference between CREST and CHECK?
| CHECK | CREST | |
|---|---|---|
| Run by | NCSC (UK government) | CREST (industry body) |
| Who it is for | Government, public sector and CNI | Any organisation |
| What it covers | Authorised penetration testing of public sector and CNI systems | Company accreditation for penetration testing and other services |
| How to check a firm | CHECK shows on many firms’ CREST Marketplace listings | CREST Marketplace |
Sources: NCSC CHECK, CREST.
Do I need a CHECK penetration test?
You probably need CHECK if:
- you are a central government department or public sector body
- you are part of the UK’s critical national infrastructure
- a contract, framework or regulator asks for CHECK
The NCSC says “penetration testing can be undertaken by any organisation”, and that if you are not public sector or CNI you can follow its guidance on commissioning a penetration test (NCSC).
How do I check whether a firm holds CREST or CHECK?
Look the firm up on the CREST Marketplace. Its listing shows the services it is CREST accredited for and, where it applies, UK NCSC CHECK Provider status. For a full buying checklist, see how to choose a penetration testing company in the UK.
What accreditations does Samurai Security hold?
Samurai Security is CREST accredited for Penetration Testing (CREST Marketplace) and is an NCSC Assured Cyber Security Consultancy for Risk Management. We also offer specialist AI capability: Katana, our own AI testing platform, combined with consultant-led testing to replicate how AI-driven attackers operate. See our penetration testing services, or estimate what a test with us is likely to cost with our penetration testing cost calculator.
Frequently asked questions
What is the difference between CREST and CHECK? CHECK is the NCSC scheme for penetration testing of government, public sector and critical national infrastructure systems. CREST is an industry accreditation body whose audited members are listed on the CREST Marketplace and is the usual benchmark for other organisations.
Is CHECK better than CREST? Neither is better in general. CHECK is required or recommended for government, public sector and CNI work. For most private sector organisations, a CREST-accredited firm is the normal standard.
Can a company be both CREST and CHECK? Yes. Some UK firms hold both. A firm’s CREST Marketplace listing shows its CREST accreditations and, where it applies, CHECK provider status.
What accreditations does Samurai Security hold? Samurai Security is CREST accredited for penetration testing and is an NCSC Assured Cyber Security Consultancy for Risk Management. It also offers specialist AI capability: Katana, its own AI testing platform, combined with consultant-led testing to replicate how AI-driven attackers operate.
Sources
All checked 28 October 2026.