CHECK Penetration Testing

CHECK is the NCSC scheme under which assured providers carry out authorised penetration testing of public sector and Critical National Infrastructure (CNI) systems. Penetration testing itself is a controlled, authorised attempt to find and exploit security weaknesses before a real attacker does. Under CHECK, that testing is delivered by an NCSC-assured provider working within a defined authorisation framework, which is what sets it apart.

CHECK is not simply “higher-quality” penetration testing. The defining feature is that it is authorised testing tied specifically to a public sector or CNI context, not just testing carried out to a higher standard. This means the engagement is intended for systems where the NCSC scheme, not simply a high-quality commercial test, is the accepted standard.

You typically need CHECK if you are:

• a public sector body
• an organisation handling public sector data
• a CNI operator
• a supplier bound by a procurement, tender, or compliance requirement that names the scheme

If none of those apply, a CREST-accredited or standard commercial test may be the right fit instead. Our UK team, based in London, delivers CHECK-relevant engagements for public sector and regulated clients. For current engagement types and configurations, see the live service listings.

CHECK vs CREST vs Standard Testing — Which Do You Need?

The most common confusion is treating CHECK and CREST as competing quality tiers. They are not. They are different assurance schemes built for different contexts, so the right choice usually follows from your mandate rather than a judgement about which is highest grade. Both rely on qualified, assessed testers; the difference is the context each scheme is recognised for, not the calibre of the testing.

Use this to decide quickly:

• You likely need CHECK if a public sector body, CNI role, or a procurement or contract clause explicitly requires it.
• CREST or standard testing may suffice if you are private-sector, have no CHECK mandate, and need assurance or risk discovery rather than public sector authorisation.

If you are worried about over-specifying, check the exact wording of your mandate or contract. That wording, not a preference for the most formal-sounding scheme, is what determines the requirement.

Asking for CHECK when it is not mandated can add cost and lead time without adding value, so where the requirement is unclear it is worth confirming with the body or client setting it before you specify.

What a CHECK Engagement Covers and How It's Delivered

A CHECK engagement can cover the systems most relevant to public sector and CNI risk, so matching your in-scope assets to the right test type is the key suitability decision before you enquire. Common test types include:

• External / public-facing infrastructure testing of internet-exposed systems such as gateways, remote-access services, and hosted applications
• Internal network testing, including environments handling public sector data, to assess what an attacker could reach after gaining a foothold
• Web application testing for flaws such as SQL injection and cross-site scripting
• Network layer testing of services, protocols, and configurations
• Segmentation testing to confirm sensitive environments are properly isolated from less trusted networks

Delivery follows a consistent lifecycle with CHECK-specific elements: scoping and authorisation, reconnaissance, exploitation, and reporting to expected standards, with an assured Team Leader accountable for the engagement.

You will sometimes see this described as five steps and elsewhere as seven stages. Both describe the same lifecycle at different levels of detail: the five-step view groups scoping and reporting into single phases, while the seven-stage view separates preparation, information gathering, and post-engagement reporting more finely. Neither means you are getting a different test, and neither framing is more complete than the other.

What Affects Scope, Timing and Complexity

CHECK engagements are scoped around your in-scope assets and environment complexity rather than a fixed package size, which is why a scoping conversation comes before any figure. The main drivers are:

• Number and type of assets in scope
• Overall system and estate size
• Environment complexity, including hybrid, cloud, or segmented networks
• Which testing types are required
• Access and authorisation arrangements for testers

Before a test, clients typically prepare an asset list, network and access details, points of contact, and confirmation of authorisation for the systems in scope. Having these ready shortens scoping and produces a more accurate quote.

Two engagements of the same headline size can differ significantly in effort once access arrangements and environment complexity are known, so treat cost and timing references as factors that shape the engagement rather than fixed figures, and use a scoping enquiry to get a tailored quote.

Why Choose an Authorised Provider and How to Verify CHECK Status

Because CHECK is a trust-led purchase, the credential is effectively part of the product, and genuine authorisation can and should be verified before you commit. A qualified CHECK provider works through assured Team Leaders and Team Members, with the Team Leader accountable for the conduct and quality of the engagement and for the standard of the final report.

CHECK authorisation is verifiable, so you do not need to take any provider's word for it, including ours.

How to verify CHECK status:

• Confirm the provider's listing through NCSC and CREST-recognised sources.
• Match the named individuals to their assured roles rather than relying on a badge or a general security-assured claim.
• Remember that authorisation attaches to specific assessed people and the provider, so a genuine provider can point you to a verifiable listing rather than a logo alone.

After testing, expect a report that prioritises findings, includes exploit evidence, explains business impact, and gives clear remediation guidance, with retesting available to confirm fixes.

To discuss whether CHECK applies to your systems and to arrange a scoping conversation, contact our team, and see the live service listings for current engagement details.

Frequently Asked Questions