In short. CREST and The Cyber Scheme are the two UK exam bodies whose penetration testing qualifications are recognised by the NCSC; CHECK is not a qualification but the NCSC scheme under which approved companies test government systems. The individual exams lead to UK Cyber Security Council professional titles, and since 2025 those titles underpin CHECK Team Member and Team Leader status.
CREST and The Cyber Scheme are the two UK examination bodies whose penetration testing qualifications are recognised by the National Cyber Security Centre (NCSC). CHECK is not a qualification. It is the NCSC scheme under which approved companies test government and critical national infrastructure systems. The individual exams (CRT and CCT from CREST; CSTM and CSTL from The Cyber Scheme) lead to professional titles issued by the UK Cyber Security Council, and since 2025 those titles are what CHECK Team Member and CHECK Team Leader status is built on.
This guide explains what each body does, what the Cyber Scheme Team Member and Cyber Scheme Team Leader exams involve, how they compare with the CREST equivalents, and what a buyer should actually check when a supplier quotes any of these acronyms.
The short version
| Term | What it is | Who runs it |
|---|---|---|
| CREST | International membership body. Certifies individual testers (CPSA, CRT, CCT) and accredits companies. | CREST (not-for-profit) |
| The Cyber Scheme | UK assessment body. Certifies individual testers (CSFL, CSTM, CSTL) and accredits companies. | The Cyber Scheme |
| CHECK | NCSC scheme for penetration testing of UK government and CNI systems. Companies join the scheme; individuals qualify as CHECK Team Members or Team Leaders. | NCSC |
| UK Cyber Security Council titles | Professional registration for individuals: Associate, Practitioner, Principal and Chartered. Awarded through licensed bodies including CREST and The Cyber Scheme. | UK Cyber Security Council |
Who are CREST?
CREST is a not-for-profit membership body with an international reach. It does two separate things, and buyers often conflate them. It runs examinations for individual testers, and it accredits companies. A company that is a CREST member has had its service delivery, methodology and policies assessed. An individual with a CREST certification has passed an exam. One does not imply the other.
The three penetration testing certifications that matter most are:
- CREST Practitioner Security Analyst (CPSA). A 120-question multiple-choice theory exam, closed book, sat at a Pearson VUE test centre. No prerequisites. It is valid for three years and is the entry requirement for the CRT.
- CREST Registered Penetration Tester (CRT). A practical exam of two and a half hours, sat at a Pearson VUE centre on a provided Kali Linux environment. It has an infrastructure section and a web application section and candidates must pass both. CREST describes it as indicative of three or more years of hands-on testing experience. A valid CPSA is required to book it.
- CREST Certified Tester (CCT). The senior certification, in two specialisms: Infrastructure (CCT INF) and Web Application (CCT APP). Each has a written exam (multiple choice plus a long-form scenario) and a separate three-hour practical. Since 2024 both parts are sat at Pearson VUE centres rather than in hotel exam rooms, and candidates use provided tooling rather than their own laptops.
Who are The Cyber Scheme?
The Cyber Scheme is a UK assessment body. Like CREST it certifies individuals and accredits companies, and its examinations are recognised by the NCSC as equivalent to the CREST exams for CHECK purposes. Its assessments are run at its own assessment centre rather than through Pearson VUE, and each one includes a face-to-face technical interview with an assessor, which is the main practical difference from the CREST route.
The current assessment pathway is:
- Cyber Scheme Foundation Level (CSFL). An entry-level assessment for students and career changers, mapped to the Associate professional title.
- Cyber Scheme Team Member (CSTM). The practitioner-level exam, covered in detail below.
- Cyber Scheme Team Leader (CSTL). The senior exam, in Infrastructure (CSTL-INF) and Web Application (CSTL-APP) variants, covered below.
- Vulnerability Assessment Plus (VA+). A shorter assessment for Cyber Essentials Plus assessors who do not hold a lead assessor qualification, developed with the NCSC and IASME.
A Cyber Scheme Accredited Company is a company, not an individual, that The Cyber Scheme has assessed against its professional benchmark, which is aligned with the UK Cyber Security Council framework. Incursion Cyber Security holds this accreditation.
Cyber Scheme Team Member (CSTM)
The CSTM is The Cyber Scheme’s practitioner-level penetration testing exam. It is the equivalent of the CREST CRT and the NCSC accepts either for CHECK Team Member status.
The exam has three parts. A practical assessment of two and a half hours, open book, covering infrastructure and web application tasks and including a short written reporting element. Fifteen minutes of preparation. Then a fifteen-minute technical interview, closed book since 1 March 2026, in which the assessor checks that the candidate understands what the commands they ran actually do, what the risks were and how the issues would be fixed. Marks are set per question and cannot be carried between questions: at the time of writing a candidate needs six of seven practical and viva questions, two of three report-writing questions and five of six interview questions, each at 60 marks or more.
There are no formal prerequisites, but the syllabus assumes working knowledge of networking and enumeration, common web application vulnerabilities such as SQL injection, cross-site scripting and file inclusion, and host exploitation and privilege escalation. The listed fee is £600 plus VAT. A CSTM pass is a mandatory requirement for the Practitioner professional title with the UK Cyber Security Council in the Security Testing specialism, and IASME accepts it as meeting the competency requirement for Cyber Essentials Plus assessors.
Cyber Scheme Team Leader (CSTL)
The CSTL is The Cyber Scheme’s senior penetration testing exam and the equivalent of the CREST CCT. It comes in two disciplines, Infrastructure (CSTL-INF) and Web Application (CSTL-APP), and the NCSC accepts either CSTL or CCT for CHECK Team Leader status.
What sets the CSTL apart is that it assesses the whole job, not just the exploitation. The infrastructure exam runs in three phases. First, a ten-minute scoping session in which the assessor plays the commissioning client and the candidate has to ask the right questions. Second, a practical penetration test of four and a half hours against the assessment infrastructure, with the last half hour reserved for preparation. Third, an assessed interview in which the candidate draws the network they have just tested (hosts, subnets, firewalls and routes) and briefs the assessor on the significant findings, as they would a client.
To pass, a candidate has to show appropriate interaction with the client, knowledge of the testing process and its legal and ethical constraints, core exploitation capability on both Windows and Unix, core network mapping, and advanced exploitation of at least one of Windows, Unix or network devices. The listed fee is £1,600 plus VAT. A CSTL pass is one of the mandatory requirements for both the Principal and the Chartered professional titles in Security Testing.
How the CREST and Cyber Scheme exams map to each other
| Level | CREST | The Cyber Scheme | CHECK role it supports |
|---|---|---|---|
| Entry / theory | CPSA | CSFL | None |
| Practitioner | CRT | CSTM | CHECK Team Member |
| Senior | CCT INF / CCT APP | CSTL-INF / CSTL-APP | CHECK Team Leader |
The NCSC treats the two routes as equivalent at each level. The exam formats differ: CREST exams are sat at Pearson VUE centres and are marked without an interview; Cyber Scheme exams are sat at its assessment centre and always include a viva. Neither is easier. Testers tend to choose based on which format suits them and which their employer already uses.
Where the UK Cyber Security Council titles fit
The UK Cyber Security Council is the professional body for the sector, established by government. It awards four professional titles in the Security Testing specialism: Associate (ACSP), Practitioner (PraCSP), Principal (PriCSP) and Chartered (ChCSP). The titles are awarded through licensed bodies, and both CREST and The Cyber Scheme are licensed for Security Testing. Passing the relevant exam is a condition of the title, not the whole of it: the applicant is also assessed against the Council’s standard of competence and commitment, and titles must be maintained.
This matters because the CHECK scheme now hangs off these titles. A CHECK Team Member must hold at least the Practitioner title; a CHECK Team Leader must hold at least the Principal title. Both must also hold SC security clearance. The exam gets you to the title; the title gets you to CHECK.
Titled professionals who consent to being listed appear on the Council’s public register, which is the simplest way for a buyer to verify a claim. Our own consultants hold Chartered and Practitioner titles in Security Testing and are listed on the team page.
What CHECK is, and what it is not
CHECK is not the same as CREST, and it is not a certification a company can simply buy. It is the NCSC’s scheme for penetration testing of systems handling UK government information at OFFICIAL and above, and it is used by central government, the wider public sector and operators of critical national infrastructure. Central government departments are expected to use CHECK companies for those systems; the rest of the public sector is strongly recommended to. Commercial organisations do not need a CHECK company for a penetration test.
To join the scheme a company is assessed by the NCSC against a company standard, a technical testing methodology standard and a report-writing standard. It must hold and maintain Cyber Essentials Plus, employ CHECK Team Leaders and Team Members who meet the title and clearance requirements above, submit annual management information to the NCSC, and provide the NCSC with a copy of every CHECK report. The industry shorthand for a company that has completed this process is “CHECK Green Light”.
What to ask a penetration testing supplier
The acronyms only tell you something if you know which question each one answers.
- “Are you CREST accredited?” Ask whether they mean the company or the individuals. A company can employ CREST-certified testers without being a CREST member company, and the reverse is also possible.
- “Who will actually test my systems, and what do they hold?” The answer should be a named person with a UK Cyber Security Council title, or at least a CRT, CSTM, CCT or CSTL, and you should be able to verify it on the public register.
- “Do we need CHECK?” Only if you are a public body testing systems that hold government information. If a supplier tells a commercial client they need CHECK, ask why.
- “Who scopes the work?” The person scoping should be an active tester with the relevant skill set, so that the scope is accurate and nothing is oversold. At Incursion every engagement is scoped by an active penetration tester and delivered by a named consultant; you can read how that works on our how we test page.
Frequently asked questions
Is CHECK the same as CREST?
No. CREST is a membership and examination body. CHECK is an NCSC scheme for testing government systems. CREST exams (and Cyber Scheme exams) are one of the routes to the professional titles that CHECK testers must hold, which is where the confusion comes from.
Is CSTM equivalent to CRT?
Yes. The NCSC accepts both the Cyber Scheme Team Member and the CREST Registered Penetration Tester for CHECK Team Member status, and both are mandatory-requirement exams for the Practitioner professional title. The formats differ; the competency level is aligned.
Is CSTL equivalent to CCT?
Yes. The NCSC accepts both the Cyber Scheme Team Leader and the CREST Certified Tester for CHECK Team Leader status, and both support the Principal and Chartered professional titles.
Do I need a CHECK company for a commercial penetration test?
No. CHECK is for UK government and critical national infrastructure systems. A commercial organisation needs a competent, verifiable tester and a properly scoped engagement, not CHECK status.
How do I verify a tester’s qualifications?
Ask for the tester’s name and check the UK Cyber Security Council public register for their professional title. CREST also operates a public register of certified individuals. If a supplier will not name the person who will do the work before you sign, treat that as the answer.
Where does Incursion sit?
Incursion Cyber Security is a Cyber Scheme Accredited Company and an IASME certification body. Our consultants hold UK Cyber Security Council professional titles in Security Testing, along with CREST and Cyber Scheme qualifications, and every test is scoped and delivered by a named consultant. Our current accreditations are listed, with verification links, on the accreditations page. If you want to talk through a test, get in touch.