United Kingdom · NCSC CHECK · CREST · PSN ITHC · CBEST
CHECK and CREST penetration testing in the UK, run end to end by Sumrite.
UK public sector bodies, PSN-connected organisations and regulated finance often need a CHECK or CREST accredited tester. Sumrite runs the engagement and routes the accredited work through its UK partners.
CHECK is the National Cyber Security Centre scheme that allows approved companies to carry out penetration tests of UK public sector and critical national infrastructure systems. CREST accredits penetration testing companies more broadly, and either route can be used for a Public Services Network (PSN) IT Health Check. Sumrite runs the engagement end to end and routes the accredited work through its CHECK and CREST partners.
Who needs it
| Who | When it applies |
|---|---|
| Central and local government | IT Health Checks and system testing by CHECK companies |
| PSN-connected organisations | An annual IT Health Check by a CHECK, CREST or Tigerscheme approved tester |
| Critical national infrastructure | Testing against NCSC guidance and sector regulator expectations |
| Banks and insurers | CBEST and STAR-FS intelligence-led testing for firms the Bank of England selects |
How Sumrite delivers it
Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.
- Confirm the scheme. CHECK, CREST, PSN ITHC or CBEST style testing, and the evidence your assessor expects.
- Scope and NDA. Systems, networks and test windows agreed in writing.
- Accredited testing. Carried out by the CHECK or CREST partner with Sumrite coordinating.
- Remediation plan and retest. Findings prioritised for your remediation action plan, then retested.
Frequently asked questions
What is a CHECK penetration test?
A test carried out by an NCSC approved CHECK company and CHECK qualified staff, used for UK public sector and CNI systems.
Who can do a PSN IT Health Check?
A tester approved under CHECK, CREST or Tigerscheme.
Can Sumrite deliver CHECK or CREST testing?
Yes, through its UK partner companies that hold the accreditation, with Sumrite running the engagement end to end.
Accredited testing
Need a test a regulator or buyer will accept?
Send the requirement and the deadline. NDA first, fixed-scope quote, one team end to end.