CHECK penetration testing

If your company has extensive experience in penetration testing, you can apply to join the CHECK scheme. We set high standards for our Service Providers, against which all new applicants are assessed.

At the NCSC, we are taking action to remove artificial barriers to entry to all of our Schemes. So, if you spot something which you think unfairly prevents you from applying, please let us know.

All CHECK companies must meet the following criteria:

• Maintain an in-date Cyber Essentials Plus certification for all the systems on which information related to customers’ engagements is stored and processed.
• Must be able to supply a minimum of two penetration test reports conducted under their company name and written by (at least) one of the proposed CHECK Team Leader(s).
• All proposed CHECK team members must be eligible to hold SC clearance.
• At least one proposed CHECK Team Leader must hold a UK Cyber Security Council (UK CSC) Professional Title in Security Testing at Principal or above.

The CHECK scheme is now open for Expressions of Interest from companies wanting to join the scheme.

Before you apply, please ensure you have read and understood the CHECK Scheme Standard, Working Practices Document and Buyers Guide, available from the Scheme documents page or the Downloads section on this page. You must also ensure you meet the ‘Minimum Requirements to join CHECK’ section on this page.

If you can confirm you do meet the minimum requirements, please email [email protected].  Please put ‘CHECK – EOI to apply’ in the subject line. 

You will then be added to an Expression of Interest list. Please note we will be accepting and processing applications in a phased way. This means you will be invited to apply when an application window becomes available, and then you will have 4 weeks to apply.  It is therefore important you ensure your application documents are ready to submit, UK CSC Professional Titles are maintained, Cyber Essentials Plus certifications are maintained, and you make every effort to have minimum of SC clearance in place before applying.

At least one member of your team will be required to qualify as a CHECK Team Leader before the team will be eligible to work under the CHECK Scheme.

The NCSC will now use the UK CSC ‘Security Testing’ specialism framework for all new applications.

The UK CSC is the self-regulatory body for the UK’s cyber security profession. It develops, promotes and stewards nationally recognised standards for cyber security in support of the UK government’s National Cyber Strategy. Applicants will need to ensure that members of the proposed CHECK team hold a UK CSC Security Testing title at the appropriate level. The UK CSC webpages contain further information.

Only the NCSC can confirm CHECK Team Leader/Member status.

An NCSC technical panel will review all submissions. We will check the candidates to confirm their suitability and their current security clearance level, initiating clearance procedures where necessary.

If your application is not successful, we will advise you on next steps, which may include a bar on re-submitting for 12 months from the date of notification.

Membership of the CHECK scheme is free, but there are costs associated with gaining and maintaining a Cyber Essentials Plus certificate and with gaining and maintaining a UK CSC Title.