CHECK (NCSC Penetration Testing)

How CHECK works

CHECK operates at two levels — the company and the individual tester.

Company approval: A CHECK-approved company must employ a minimum number of CHECK Team Leaders and Team Members, maintain documented testing methodologies, operate quality assurance processes for deliverables, and hold appropriate insurance and security clearances. The NCSC assesses companies through application, interview, and ongoing compliance monitoring.

Individual tester approval: CHECK recognises two roles. A CHECK Team Member has demonstrated competence in penetration testing through a combination of qualifications (typically CREST certifications) and practical experience. A CHECK Team Leader has additional experience and the authority to lead engagements and sign off reports. Both roles require security clearance to the level appropriate for the systems being tested — typically Security Check (SC) or Developed Vetting (DV).

Every CHECK engagement must be led by an approved CHECK Team Leader, who takes responsibility for the scope, methodology, and quality of the final report. This individual accountability is a distinguishing feature of the scheme.

CHECK vs CREST

CHECK and CREST are related but distinct:

	CHECK	CREST
Governed by	NCSC (UK government)	CREST (industry body)
Scope	UK government and public sector systems only	Any organisation, any sector, internationally
Vetting	Government security clearance required	No government vetting
Mandatory	Required for testing HMG systems	Voluntary (but widely expected by procurement)
Qualification	Uses CREST exams as part of the pathway	Independent certification scheme

CREST certifications form part of the pathway to CHECK approval — a tester typically holds CREST CRT or CCT before applying for CHECK status. However, holding a CREST certification alone does not make a tester CHECK-approved. The additional requirements are government security vetting and NCSC assessment.

Many penetration testing firms hold both CHECK approval and CREST membership. CHECK is required for government work; CREST is expected across private sector procurement, particularly in financial services and critical infrastructure.

When CHECK is required

CHECK penetration testing is required or expected in several contexts:

• Government departments — all central government departments must use CHECK-approved companies for penetration testing of systems that process OFFICIAL, SECRET, or TOP SECRET data
• Public sector procurement — the G-Cloud framework and other Crown Commercial Service procurement routes reference CHECK as a requirement for security testing services
• Critical national infrastructure — organisations assessed under the NCSC CAF may need CHECK-level testing for their systems, particularly where they interface with government networks
• Defence supply chain — MOD suppliers and defence contractors are typically required to use CHECK-approved testers for systems handling defence data
• NHS and health — NHS Digital and health sector bodies increasingly require CHECK-approved testing for systems handling patient data connected to government networks

For private sector organisations with no government connection, CHECK is not required. CREST-certified penetration testing is the recognised standard for commercial environments.

Cyberfort and CHECK

We provide CHECK-approved penetration testing for government departments, public sector organisations, and critical national infrastructure operators. Our CHECK Team Leaders hold the security clearances and NCSC approval required to test systems processing HMG data. We deliver infrastructure, application, and network penetration testing through our penetration testing service, covering both CHECK-mandated government work and CREST-certified commercial engagements. For organisations on the G-Cloud framework, our services are available through Crown Commercial Service procurement routes.

Related glossary terms

• CREST Certification — the industry certification scheme for penetration testers, which forms part of the CHECK qualification pathway
• Red Teaming — adversarial testing that goes beyond standard penetration testing to simulate real-world attack scenarios
• G-Cloud — the UK government procurement framework that references CHECK as a requirement for security testing services
• CBEST — the Bank of England’s threat intelligence-led penetration testing framework for UK financial services

External references

• NCSC CHECK scheme — official NCSC guidance on the CHECK scheme
• NCSC: Penetration testing guidance — NCSC advice on commissioning and managing penetration tests
• CREST: CHECK and CREST — how CREST certifications relate to CHECK approval

Frequently asked questions