CREST Accredited Business Teams

Whether you are an internal red team at a major bank, a security operations team or in-house incident response capability within a critical national infrastructure operator, CREST accreditation provides independent assurance that your team meets a rigorous and consistent standard.

Who is this for?

This accreditation route is intended for any team, department, function, centre of excellence or shared service that delivers cybersecurity services within a business or corporate group – and that is not a commercial cybersecurity service provider.

Examples include:

Why become a CREST Accredited Business Team

Accreditation signals to your clients, regulators, auditors, boards and oversight bodies that your internal capability meets a benchmark equivalent to the best in the industry. It also demonstrates:

The guidance may be applied to service areas including, but not limited to:

• penetration testing;
• security operations centre services;
• cyber threat intelligence;
• incident response;
• vulnerability assessment;
• security architecture;
• incident exercising;
• other CREST-accredited services where the service is delivered internally.

The standard does not change, only how some evidence is provided. For example, corporate insurance arrangements satisfy commercial insurance requirements.

Internal governance, corporate policies, internal customers and shared functions are all valid evidence. CREST guidance explains how each requirement translates to an internal context.