A number of strategic changes to the delivery of examinations took place throughout 2016. The changes have allowed us to scale our examinations capability, providing access to assessment centres throughout the UK and a greater reach to our internationally based company members. The examinations continue to support talented people in the Cyber Security industry, providing meaningful certifications for people that are starting or developing further in their careers. This delivery model has allowed us to facilitate sustained investment in new examination content and to continue to deliver the highest quality of examinations to our industry.
CREST is acutely aware that there is a shortage of talented people entering the cyber security industry. As a consequence, the CREST Practitioner Security Analyst (CPSA) exam has been restructured to encourage new entrants to gain their first step on the pathway to a career in technical cyber security.
The international influence, and therefore the membership, of CREST has grown in recent years and to support this, CREST selected Pearson Vue to be its global partner for delivering written examinations. By working with Pearson Vue, CREST is now able to deliver written examinations to candidates in more than 6,000 locations across the world. This allows CREST to deliver examinations in significantly more locations in the UK, mainland Europe, Asia, Africa, Australasia and the Americas.
Working with Pearson Vue, CREST have made changes to the examination process. We have separated the written aspect of some key examinations from the practical components. In this process, the written elements are taken in Pearson Vue approved test centres and the practical elements of these examinations are delivered in regional CREST examination centres. In the UK, this will continue to be Slough. Additional examination centres are being created in Asia and work has started to work toward a centre in the Americas.
The separation of practical from written elements will be staged across all examinations. CREST Practitioner Security Analyst (CPSA), CREST Registered Penetration Tester (CRT), CREST Certified Web Applications Tester (CCT App), CREST Certified Infrastructure Tester (CCT Inf) and CREST Certified Simulated Attack Specialist (CC SAS) have all undergone this change. Further phased migrations across the wider examination programmes will continue to take place.
Changes to CPSA
The CREST Practitioner Security Analyst (CPSA) is an entry level certificate for people starting their career in technical cyber security. It is designed to test candidates’ ability to identify vulnerabilities in both infrastructure and web application resources. CREST has migrated this examination to a written only format that will be delivered through the Pearson Vue network. In addition to this, CREST has reduced the price of this examination from £350 to £250 to further stimulate the market.
Changes to CRT
The CREST Registered Tester (CRT) examination has long been regarded as a valuable measurement of capability within the Penetration Testing industry. Candidates sitting the examination have previously been expected to complete both written and practical multiple choice questions, a failure in either of these elements results in non-award of a CRT certificate.
CREST has separated the written examination from the practical examination: the new CRT examination delivered in regional test centres (eg. Slough) is a practical only assessment; this allows CREST companies and new entrants to the industry to benchmark themselves against the CREST qualifications.
CREST will not be dropping the theory based components of this examination. Instead, the written elements have been migrated into the CPSA examination. As a consequence, for an individual to be awarded the CREST Registered Tester status, they will be expected to have passed both the new format CPSA multiple choice (written) and the CRT practical examinations. An individual passing the written but failing the practical element of the CRT exam will be awarded a Practitioner certificate. This will allow those who are not sure of their current level of competence to take the examinations in a structured way and position themselves within the profession.
All CRT candidates must have a CPSA pass in order to book to sit the CRT practical to enable the award of a CRT qualification.
Individuals that are being granted CRT through OSCP equivalency will be required to take the CPSA examination to be awarded CREST Registered Tester status. This has been previously referred to in literature as the CRT Top-up examination.
Further phased migrations across the wider examination programmes will continue to take place whereby the written elements of CREST examinations will be delivered at a Pearson Vue centre of choice and the practical elements at an Examination Centre.
The CREST Examination Centers will be located in a number of regions globally. In Singapore, the center is in the Singapore Institute of Technology; in the UK, the center is in Slough, Berkshire; in the USA, the center is in New York City. Other centres will be listed on the CREST website in the near future.
NCSC notification: CREST has advised the NCSC of the changes to the CRT examination format.
Our Frequently Asked Questions, updated on 11.04.2016, contain additional information that Candidates may find helpful.