PPN 014 (published February 2025) makes CREST accreditation mandatory for suppliers providing penetration testing to the UK government. DORA mandates CREST or CHECK-level testing for EU financial entity threat-led penetration testing. Without CREST-aligned methodology, penetration testers are excluded from UK government contracts and DORA TLPT engagements. XCREST is built to close this gap.
Across six instructor-led days, XCREST covers the technical and methodological content underpinning CREST CRT and CCT-level capability: the CREST Penetration Testing Standard updated February 2025 across six domains, infrastructure and web application testing at CREST scope, NCSC CHECK Technical Guidance for Testers methodology, CREST-standard report writing with evidence capture, and DORA TLPT engagement requirements. Participants who hold XEHP or equivalent find XCREST the direct pathway to understanding CREST methodology before pursuing formal CREST examination.
On Day 6, participants conduct a supervised penetration test against a government-representative environment using documented CREST-aligned methodology. The senior practitioner assesses methodology quality, scope management, evidence capture, and report structure against CREST standards. XCREST certificate and Practitioner Assessment Report issued. Aligned with CREST PTS February 2025, NCSC CHECK TGT, NCSC CHECK June 2025 update, PTES, OWASP Testing Guide v4, PPN 014, and DORA TLPT requirements.
