{"id":23645,"date":"2022-11-23T17:24:36","date_gmt":"2022-11-23T11:54:36","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=23645"},"modified":"2026-03-31T17:27:22","modified_gmt":"2026-03-31T11:57:22","slug":"check","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/penetration-testing\/check\/","title":{"rendered":"CHECK Penetration Testing Guide"},"content":{"rendered":"\n

CHECK penetration testing is a specialized form of cybersecurity audit<\/a> or assessment designed explicitly by the NCSC for government departments, public sector bodies, and critical national infrastructure (CNI) in the UK. <\/p>\n\n\n\n

Unlike traditional pentests focusing on a broad range of vulnerabilities, CHECK prioritizes threats relevant to government systems using government-approved tools and methodologies. This targeted approach helps identify weaknesses that are most likely to be exploited by adversaries targeting government entities.<\/p>\n\n\n\n

<\/span>What is CHECK?<\/span><\/h2>\n\n\n\n

Better known as \u2018IT Health Check Service\u2019, CHECK is an accreditation scheme operated by the UK’s National Cyber Security Centre (NCSC)<\/a> that certifies companies to conduct authorized penetration tests on public sector and Critical National Infrastructure (CNI) systems and networks. <\/p>\n\n\n\n

It provides a framework for ensuring that penetration testing is conducted to a high standard with qualified personnel according to recognized methodologies.<\/p>\n\n\n\n

<\/span>Who Needs CHECK Penetration Testing?<\/span><\/h2>\n\n\n\n

CHECK penetration testing certification is primarily mandated for:<\/p>\n\n\n\n

    \n
  • Government departments:<\/strong> All systems handling data classified as OFFICIAL or above must undergo CHECK-approved penetration testing.<\/li>\n\n\n\n
  • Public sector bodies:<\/strong> While not strictly mandated, the NCSC strongly recommends it for all public sector organizations, especially those handling sensitive data or operating critical infrastructure.<\/li>\n<\/ul>\n\n\n\n

    Please note that for systems handling data marked SECRET or TOP SECRET, two CHECK team leaders<\/strong> with appropriate clearances and access must be involved.<\/p>\n\n\n