Discipline requirements

The general company application is split into some key areas:

•       General company details
•       Human Resource management, including vetting
•       Use of contractors
•       Quality policies and procedures
•       Information Security policies and procedures
•       Contract management
•       Complaint handling

This application is only completed once and will copy across to all disciplines applied for.

Each discipline has its own separate application form and we look for your specific methodologies for delivering the service you are applying for.  The areas we review for each discipline include:

Penetration Testing: (learn more)
•       Certified individuals
•       Language capability
•       Preparation & scope
•       Assignment execution
•       Post technical delivery
•       Asset/Information/Document Storage, Retention and Destruction

STAR Intelligence-Led Penetration Testing:  (learn more)
•       Certified individuals
•       Organisational structure for service delivery
•       Language capability
•       Methodology
•       Data Storage and Transmission Controls
•       Threat intelligence
•       Reporting
•       Data Retention / Destruction

Cyber Security Incident Response:  (learn more)
•       Certified individuals
•       Language capability
•       Assignment
•       Presentation
•       Identification
•       Containment
•       Eradication
•       Asset/Information/Document Storage, Retention and Destruction
•       Reporting

STAR Threat Intelligence:  (learn more)
•       Certified individuals
•       Language capability
•       Quality
•       Intelligence Collection, Processing, Delivery and Management
•       Information sharing
•       Deliverables
•       Data Retention / Destruction

Security Operation Centre:  (learn more)
•       Certified individuals
•       Language capability
•       Organisational environment
•       Customer requirements
•       Technology & tools
•       Event analysis & response
•       Threat Intelligence & Situational Awareness
•       Protect the SOC

Vulnerability Assessment:  (learn more)
•       Certified individuals
•       Preparation, planning & scoping
•       Tools & resources
•       Scan execution
•       Reporting

Some of the CREST disciplines and schemes have additional steps.
•       VA Accreditation – technical assessment that will test your capability and use of tools.
•       SOC Accreditation – onsite audit which is a verification step to ensure all methodologies, procedures and policies submitted are in use within the SOC.  This is conducted by an appropriate auditor with CREST.
•       Schemes – some have interview stages and others may require you to register onto procurement frameworks with your CREST details.