CERT-In · CREST · NCA · DESC · CHECK · TLPT · IRAP · CSA · PCI
Accredited penetration testing from Sumrite, for every regulator and region.
When a regulator, tender or buyer names a scheme, the test has to come from a firm that holds it. Sumrite runs the whole engagement and issues the formal step through accredited partner firms across India, the Gulf, the UK, Europe, Australia and Asia.
Accredited penetration testing is testing carried out by a firm that a national authority or industry body has empanelled, accredited, licensed or registered, such as CERT-In in India, CREST internationally, the NCA in Saudi Arabia or the CSA in Singapore. Sumrite runs the engagement end to end and, where a scheme requires a specific firm, issues the formal report or attestation through a Sumrite partner firm that holds it.
Schemes Sumrite delivers, by region
| Scheme | Region | Who requires it |
|---|---|---|
| CERT-In empanelled audit | India | Government systems and websites, SEBI regulated entities, tenders that name CERT-In |
| CREST accredited testing | Global | Banks, regulators, enterprise buyers and tenders that ask for CREST |
| NCA licensed testing | Saudi Arabia | Government entities, critical national infrastructure and their suppliers |
| Dubai Cyber Force testing | UAE | Dubai government entities and their suppliers |
| CHECK and CREST testing | United Kingdom | UK public sector, PSN-connected bodies, CNI and regulated finance |
| TLPT, PASSI and BSI testing | Europe | EU financial entities, French public bodies and operators, German public sector |
| IRAP and CREST ANZ testing | Australia | Australian government agencies, their cloud and service providers, APRA regulated entities |
| CSA licensed testing | Singapore | Any organisation buying penetration testing in Singapore |
| PCI ASV and QSA | Global | Merchants and service providers that store, process or transmit card data |
How accredited testing works with Sumrite
Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.
- Tell us the requirement. Send the circular, tender clause or questionnaire that names the scheme.
- One scope, one NDA. Sumrite scopes the work and signs the NDA; you never manage two vendors.
- Testing. Expert-led testing by Sumrite and, where the scheme requires it, by the accredited partner’s certified staff.
- Fix and retest. Remediation support and retest from Sumrite.
- Formal report or attestation. Issued by the accredited partner in the format the scheme requires.
When you do not need an accredited scheme
SOC 2, ISO 27001 and most enterprise vendor reviews ask for an independent, expert-led penetration test, not a specific scheme. For those, a standard Sumrite VAPT report is the evidence, delivered within 48 hours of testing starting for a scoped web application or API.
Frequently asked questions
What is accredited penetration testing?
Testing by a firm that a national authority or industry body has empanelled, accredited, licensed or registered, such as CERT-In, CREST, the NCA, DESC, NCSC CHECK, ANSSI PASSI, the BSI, ASD IRAP, the CSA or the PCI SSC.
Does Sumrite hold these accreditations itself?
Sumrite delivers accredited testing through partner firms that hold each scheme. Sumrite runs the engagement end to end, and the partner issues the formal report or attestation where the scheme requires it.
Which scheme do I need?
The one named in your regulation, tender or contract. Send us the wording and we will confirm it before quoting.
Can one engagement cover several schemes?
Often yes. One round of testing can be mapped to several frameworks, with separate formal reports where each scheme requires its own.
Related
Which scheme does your regulator name?
Send the requirement. NDA first, fixed-scope quote, one team end to end.