Service
Expert-led penetration testing that goes beyond automated scanning to identify, validate and demonstrate the vulnerabilities and attack paths that could put your organisation, data and services at risk.
Understanding NCSC CHECK penetration testing
CHECK penetration testing provides controlled, expert-led testing against the NCSC CHECK scheme, which sets standards for penetration testing trusted by government, public sector and UK critical national infrastructure organisations.
We combine automated tooling, manual investigation and real-world attack techniques to validate vulnerabilities, assess their impact and identify attack paths. CHECK provides additional assurance through NCSC-assessed methodologies and defined professional and security clearance requirements for CHECK personnel.
Learn more about CHECK for buyersBenefits of NCSC CHECK penetration testing
When the security of critical systems, sensitive information or important services is at stake, the quality and independence of your penetration testing matter. NCSC CHECK provides assurance that the provider, its methodology and the personnel delivering CHECK services meet defined requirements set by the NCSC.
01
CHECK is an NCSC assurance scheme for authorised penetration testing of public sector and UK critical national infrastructure systems and networks. The NCSC assesses companies providing CHECK services to ensure their methodology meets the scheme standard.
See the NCSC guidance for buyers02
CHECK providers operate against defined NCSC requirements covering the delivery of penetration testing. The scheme includes requirements around methodology, testing, evidence and reporting, giving customers a defined standard against which CHECK engagements are delivered.
View the CHECK scheme documents03
Effective penetration testing is about more than identifying potential vulnerabilities. We combine automated tooling with manual investigation, exploitation and experienced security judgement to establish whether weaknesses are genuinely exploitable and what an attacker could achieve.
Read how the NCSC defines penetration testing04
CHECK has defined requirements for the personnel delivering CHECK engagements. Team Leaders must hold the required professional qualification and CHECK team members must meet the scheme's competency and security clearance requirements. The NCSC also provides a facility for buyers to verify CHECK professionals.
View CHECK personnel requirements05
CHECK reporting requirements are designed to give customers a clear record of the assessment, its scope, findings and supporting evidence. Our reports explain what was tested, what was identified, what could be exploited and why it matters, giving technical teams evidence they can use to plan remediation.
Review the CHECK scheme standard06
Once vulnerabilities have been addressed, focused or full retesting can independently verify the changes. This provides evidence that identified weaknesses have been remediated and helps maintain confidence in the security of your systems over time.
Who needs NCSC CHECK testing?
NCSC CHECK is particularly relevant when penetration testing forms part of the assurance requirements for government, public sector or UK critical national infrastructure. If you are a supplier to government or CNI, or your contract specifically requires testing by an NCSC CHECK provider, we can help you determine what testing is required and deliver the appropriate assessment.
Not sure whether CHECK applies to your requirement? We can help you understand the scope, identify whether infrastructure or web application testing is appropriate, and define an assessment that meets the relevant requirement.
When NCSC CHECK scheme applies
NCSC CHECK is an assurance scheme for penetration testing, particularly relevant to UK government, public sector and critical national infrastructure environments. If your organisation, customer or contract requires testing by an NCSC CHECK provider, we can help define and deliver the appropriate assessment.
Government and public sector contracts can include specific penetration testing and assurance requirements. If your procurement or security requirements call for NCSC CHECK, we can scope the appropriate infrastructure or web application assessment and deliver it within the requirements of the scheme.
Organisations supporting UK critical national infrastructure may have heightened security and assurance requirements. Where a requirement specifies NCSC CHECK, testing can provide the appropriate scheme-based assurance for in-scope infrastructure or web applications.
Some organisations require their suppliers and third parties to use an NCSC CHECK provider for defined penetration testing activities. If CHECK is written into your contract, procurement documentation or security requirements, we can help establish exactly what needs to be tested and what assurance is required. NCSC guidance for buyers.
CHECK infrastructure testing is appropriate where the requirement concerns systems and network infrastructure within the scope of the scheme. Testing examines the security of the infrastructure from an attacker's perspective, using the defined CHECK methodology and requirements.
CHECK web application testing is appropriate where the requirement concerns an application exposed through the web. The assessment examines application functionality and security controls, including relevant APIs and endpoints forming part of the application, in accordance with the applicable CHECK requirements. View the NCSC CHECK scheme documents.
CHECK is not automatically required simply because an organisation works with government or critical infrastructure. The requirement usually comes from the specific system, service, contract or assurance requirement. If you are unsure, we can review what you have been asked to provide and help establish the appropriate testing scope and approach. NCSC information for buyers.
What NCSC CHECK tests cover
Our NCSC CHECK penetration testing covers the two core testing areas of the scheme: infrastructure and web applications. We combine automated tooling, manual techniques and experienced security testing to identify vulnerabilities, validate their impact and understand how they could be exploited.
Infrastructure testing assesses the systems and services that form part of your network and external attack surface. We identify exposed hosts, services and technologies, assess them for vulnerabilities and investigate whether weaknesses could be exploited to gain access, escalate privileges or compromise further systems.
Testing can cover both internet-facing and internal infrastructure, with the assessment tailored to the agreed scope and objectives. We combine reconnaissance, enumeration, vulnerability assessment, manual testing and controlled exploitation to establish what an attacker could realistically achieve.
Where required, infrastructure testing can be delivered as an NCSC CHECK assessment, providing the additional assurance of testing delivered against the requirements of the scheme.
Web application testing examines the application from an attacker's perspective, looking for vulnerabilities across authentication, authorisation, session management, input handling, business logic and other application-layer controls. We go beyond automated scanning to manually investigate functionality and validate whether identified weaknesses can be exploited.
APIs and application endpoints form an important part of modern web applications and are assessed as part of the web application test where they are within scope. We examine API functionality, authentication and authorisation, access controls, input validation, data exposure and business logic to determine whether an attacker could access or manipulate functionality or information they should not be able to.
We also consider how the application's different components interact. Weaknesses that appear limited when viewed individually can become significant when combined, so we investigate attack paths across the application, its APIs and supporting functionality where appropriate.
Where required, web application testing can be delivered as an NCSC CHECK assessment, providing the additional assurance of testing delivered against the requirements of the scheme.
How we test
Our CHECK penetration tests use the same expert-led approach as our wider penetration testing, combining established methodologies, automated tooling and manual investigation, with testing aligned to the applicable NCSC CHECK requirements.
We agree the scope, objectives and boundaries before testing begins, ensuring the assessment meets both your requirements and applicable CHECK scope requirements.
We identify the systems, technologies, functionality and attack surface within scope, building a clear understanding of the environment before deeper testing begins.
We combine automated tooling with manual investigation, using expert judgement to identify weaknesses and attack paths that automated testing alone cannot reliably uncover.
We validate vulnerabilities and, where appropriate, demonstrate their impact through controlled exploitation, following the applicable CHECK testing requirements without unnecessary disruption.
We investigate how weaknesses can be combined to determine whether apparently minor issues create a meaningful route to compromise.
We maintain communication throughout the engagement, promptly escalating serious findings, unexpected access and scope issues rather than waiting for the final report.
Findings are supported by clear evidence, technical detail, risk and practical context, with reporting aligned to the applicable NCSC CHECK requirements.
Our deliverables
CHECK reporting follows the NCSC's defined requirements, providing clear evidence of the assessment, findings, risk and recommendations. CHECK reports are also subject to specific NCSC reporting and information-sharing requirements.
01
The formal CHECK report documents the scope, methodology, testing and limitations, with detailed findings, risk, evidence, impact, attack-path context and remediation recommendations. For systems below SECRET, CHECK reports are submitted to the NCSC through its secure portal. For SECRET and above, the customer retains the report for NCSC inspection on request.
NCSC CHECK requirements02
A concise summary of the assessment, overall security posture, highest-risk findings, key impacts and recommendations. We can also provide a separate customer-facing executive summary where required.
03
Where required, findings can also be supplied in your own spreadsheet or structured format, with fields such as affected assets, finding references, risk and remediation status. This can support internal vulnerability management or customer reporting processes alongside the formal CHECK report.
Related reading
Loading articles…
Tell us what you need to test and we’ll help define the right CHECK assessment for your environment, requirements and scope.