Why Regulators and Enterprises Are Embedding CREST Into Procurement

For a financial institution, a penetration test isn't a box to check. It's evidence. The findings go before auditors, regulators, and the board, and they have to hold up under scrutiny.

That puts real weight on a single decision: which provider to trust with the work.

The difficulty is that penetration testing providers are hard to tell apart from the outside. Proposals, certifications, references, and case studies tend to look similar across firms of very different caliber. A strong pitch shows effort. It doesn't reveal the depth of methodology, the rigor of process, or the consistency that a regulated organization depends on.

This is why organizations in highly regulated industries look for more than a capable vendor. They look for an independently verified quality standard, and in penetration testing, that standard is CREST.

Why CREST Accreditation Actually Matters

Established in 2006, CREST is an international, not-for-profit body that accredits cybersecurity testing providers and certifies the practitioners who work for them.

What sets its accreditation apart is what it examines. A list of individual certifications tells you that specific people passed specific exams. CREST accreditation goes further. It assesses the organization itself: its testing methodologies, governance, data handling, quality controls, and the repeatability of its work across engagements.

That focus on the organization, not just its people, is what makes the accreditation meaningful. A provider can employ talented testers and still produce inconsistent results when its processes are weak, its scoping is undisciplined, or its reporting changes from one engagement to the next. Individual skill does not guarantee organizational reliability, and in a regulated environment, where a single test has to withstand audit, reliability is exactly what's being bought.

Earning accreditation is deliberately demanding. Providers are assessed against defined standards through a rigorous, time-intensive process rather than a one-time checkbox. That difficulty is the point. A standard that's easy to earn tells a buyer very little. Because CREST is hard to achieve, the fact that a provider holds it carries real information.

Why CREST is Becoming a Compliance Benchmark

While CREST originated as an industry-led initiative, its influence now extends into regulatory and procurement frameworks.

In the United Kingdom, CREST-recognized organizations play an important role in government and financial-sector testing initiatives, including schemes such as CBEST and NCSC CHECK. Within the European Union, the Digital Operational Resilience Act (DORA) elevates expectations surrounding threat-led testing programs and the competence of providers conducting those exercises.

Even in markets where CREST isn’t explicitly mandated, procurement teams view accreditation as a practical benchmark. The reason is straightforward: frameworks differ, auditor expectations vary, and geographic requirements evolve. An independently recognized standard can simplify conversations that otherwise become fragmented across jurisdictions and regulatory regimes.

In that sense, CREST increasingly functions as a form of compliance passport—providing assurance that a provider has aligned with recognized industry standards.

The Business Value of an Accredited Provider

For a regulated buyer, the question is no longer simply whether a provider can perform a penetration test. It's whether the organization can demonstrate that they selected a provider against defensible, independently validated criteria. Procurement teams, compliance leaders, and security executives have to justify those choices internally and to external auditors, and "they had a good proposal" is not a defensible answer.

Accreditation gives procurement teams, compliance leaders, and security executives the defensible answer they need. It shortens vendor reviews and simplifies due diligence because an independent body has already assessed what a buyer would otherwise have to investigate on their own. It strengthens confidence among boards and executives accountable for risk. And it gives the organization a clear rationale for its choice, one that holds up when a regulator or auditor asks how the provider was selected.

Understanding the CREST Accreditation Pathway

Transparency is part of the standard. CREST's Accreditation Pathway is designed to support organizations as they mature against its requirements, moving from Pathway participation through Pathway+ toward full accreditation and CREST Membership. Those stages are distinct, and they should be represented accurately. Pathway participation is a first step, Pathway+ is a secondary stepping stone toward accreditation with individual and organizational prerequisites, and neither is equivalent to independently verified full CREST membership. Any organization evaluating a provider should understand precisely where that provider sits on the path.

VikingCloud holds itself to that same standard of clarity. VikingCloud currently participates in the CREST Accreditation Pathway and is actively progressing toward Pathway+ and, ultimately, full CREST Membership. That progression reflects a deliberate commitment to internationally recognized standards and independent assurance, with a clear view of the stages that commitment involves.

How Confident Are You in the Providers You Trust Most?

Whether you’re preparing for an audit, evaluating testing providers, or strengthening vendor risk processes, an independently accredited partner can help reduce uncertainty and provide a defensible foundation for your selection.

VikingCloud delivers penetration testing, managed security services, and compliance support that help organizations manage complex regulatory and operational environments. As a participant in the CREST Accreditation Pathway, VikingCloud is actively progressing toward internationally recognized assurance standards while helping customers align security testing with broader business and compliance objectives.

Learn how VikingCloud can support your organization’s security testing, vendor assurance, and compliance readiness efforts.

Penetration Testing Services