CREST
CREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres. It is not part of the Cyber Essentials scheme: certificates come from Certification Bodies licensed by IASME. Some Certification Bodies also hold CREST accreditation, but a CREST badge alone does not mean a firm can certify you.
- Term
- CREST
- Also known as
- CREST accreditation, CREST accredited
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term CREST mean in Cyber Essentials?
CREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres.
How does CREST apply to Cyber Essentials?
In plain terms
CREST is like a trade body that vets specialist security firms. When a company is CREST accredited for penetration testing, CREST has checked how it works and who does the testing. It is a mark of the supplier, not of your organisation.
How it relates to Cyber Essentials
Neither the NCSC requirements nor the Danzell question set mention CREST. The scheme runs through IASME, which licenses Certification Bodies to mark self-assessments and carry out Cyber Essentials Plus audits. You cannot get a Cyber Essentials certificate from CREST. Where CREST matters is choosing a provider: a Certification Body that is also CREST accredited has had its technical testing checked independently, which is relevant because Cyber Essentials Plus includes vulnerability scanning and hands-on tests.
Common mistakes
Confusing a penetration test with Cyber Essentials Plus. A penetration test is a tailored attempt to break in, scoped with the client. Cyber Essentials Plus is five fixed test cases from the NCSC test specification. One does not replace the other.
Precursor Security, which runs this site, is an IASME Cyber Essentials Certification Body and is CREST accredited for Security Testing (penetration testing) and SOC.
See how to choose a Cyber Essentials provider and Cyber Essentials Plus.
Related terms
- IASMEIASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.
- Certification BodyA Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
- Penetration testA penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
- Cyber Essentials PlusCyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.
- Cyber AdvisorA Cyber Advisor is a person assured by the NCSC to advise organisations on how to implement the Cyber Essentials controls.
- Cyber EssentialsCyber Essentials is a UK government-backed certification that shows an organisation has five basic technical security controls in place to stop common internet attacks.
Frequently asked questions
CREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.