CREST is pleased to announce a number of strategic changes to the delivery of examinations that will take place throughout 2016. The changes will allow us to scale our examinations capability, providing access to assessment centres throughout the UK and a greater reach to our internationally based company members. The examinations will continue to support talented people in the Cyber Security industry, providing meaningful certifications for people that are starting or developing further in their careers. This delivery model allows us to facilitate sustained investment in new examination content and allows CREST to continue to deliver the highest quality of examinations to our industry.
CREST is acutely aware that there is a shortage of talented people entering the cyber security industry. As a consequence, we have restructured the CREST Practitioner Security Analyst (CPSA) exam to encourage new entrants to gain their first step on the pathway to a career in technical cyber security.
The international influence, and therefore the membership, of CREST has grown throughout 2015 and to support this, CREST has chosen Pearson Vue as its global partner for delivering written examinations. By working with Pearson Vue, CREST is able to deliver written examinations to candidates in more than 6,000 locations across the world. This will allow CREST to deliver examinations in significantly more locations in the UK, mainland Europe, Asia, Africa, Australasia and the Americas.
Working with Pearson Vue, CREST have made changes to the examination process. We have separated the written aspect of some key examinations from the practical components. In this process, the written elements are taken in Pearson Vue approved test centres and the practical elements of these examinations are delivered in regional CREST examination centres. In the UK, this will continue to be Slough. Additional examination centres are being created in Asia and work has started to work toward a centre in the Americas.
The separation of practical from written elements will be staged across all examinations. CREST Practitioner Security Analyst (CPSA), CREST Registered Penetration Tester (CRT), CREST Certified Web Applications Tester (CCT App) and CREST Certified Infrastructure Tester (CCT Inf) are the first examinations to undergo this change. Once these examinations have been successfully migrated to the new examination delivery platform, we intend to roll this out in a phased process across the wider examination programmes.
Changes to CPSA
The CREST Practitioner Security Analyst (CPSA) is an entry level certificate for people starting their career in technical cyber security. It is designed to test candidates’ ability to identify vulnerabilities in both infrastructure and web application resources. CREST has migrated this examination to a written only format that will be delivered through the Pearson Vue network. In addition to this, CREST has reduced the price of this examination from £350 to £250 to further stimulate the market.
Changes to CRT
The CREST Registered Tester (CRT) examination has long been regarded as a valuable measurement of capability within the Penetration Testing industry. Candidates sitting the examination have previously been expected to complete both written and practical multiple choice questions, a failure in either of these elements results in non-award of a CRT certificate. CREST has separated the written examination from the practical examination: the new CRT examination delivered in regional test centres (eg. Slough) is a practical only assessment; this allows CREST companies and new entrants to the industry to benchmark themselves against the CREST qualifications.
CREST will not be dropping the theory based components of this examination. Instead, the written elements have been migrated into the CPSA examination. As a consequence, for an individual to be awarded the CREST Registered Tester status, they will be expected to have passed both the new format CPSA multiple choice (written) and the CRT practical examinations.
An individual passing the written but failing the practical element of the CRT exam will be awarded a Practitioner certificate. This will allow those who are not sure of their current level of competence to take the examinations in a structured way and position themselves within the profession.
There is an interim waiver for candidates wishing to book a CRT exam between 6 June 2016 and 30 September 2016 whereby candidates will be allowed to book a CRT practical exam prior to taking and passing the CPSA theory exam but will not be awarded the CRT qualification until such times as they can produce a CPSA pass.
All CCT candidates must have a pass in the written examination in order to book to sit the CCT practical in that examination to enable the award of a CCT qualification.
Candidates should ensure that they allow sufficient time for the re-certification process to enable them to maintain their qualification.
CCT level certificates will be valid from the date of passing the practical elements of the examination. Renewals will be based on the certificate issue date.
During 2016 the written elements of all CREST examinations will be delivered at a Pearson Vue centre of choice. The practical elements of any CREST examinations will be delivered at an Examination Centre. The CREST Examination Centres will be located in a number of regions globally. In the UK, the centre will remain in Slough, Berkshire; in Singapore, the centre is in the Singapore Institute of Technology. Other centres will be listed on the CREST website in the near future.
CREST has briefed CESG about the changes to the CRT examination format.
Our Frequently Asked Questions, updated on 11.04.2016, contain additional information that Candidates may find helpful.
Flowchart of route to CREST Qualification