CREST Certified Companies in Singapore: How to Verify a Provider

Search "CREST certified companies in Singapore" and you get a wall of provider blogs, each one arranged so its own name sits conveniently at the top. That is a pitch dressed up as a list. CREST publishes no Singapore leaderboard and no rankings. What it does publish is better: a public register of every accredited member company, with certification scope and dates. Below is what that register tells you, what organisational certification verifies, why it matters for procurement in Singapore, and how to check any provider, including us, in about five minutes.

What the CREST register actually lists

CREST accredits at two levels, and they get confused constantly. Individual certifications (CRT, CCT, and others) belong to named consultants who passed practical, timed lab exams. Organisational accreditation belongs to the company: CREST has assessed its methodology, quality assurance, and business practices, and admitted it as a member company. Both appear on the same register at crest-approved.org.

There is no official "CREST certified companies Singapore" list, so do not go looking for one. You search the register by company name and read the entry: membership type, certification scope, and dates. If a firm is missing, it does not hold organisational accreditation, whatever its proposal deck says.

If you want the full story on what CREST certification involves and how it compares to CISSP or CEH, our guide to CREST certification in Singapore covers that separately.

What organisational certification verifies

Company-level accreditation is not a badge bought with a membership fee. The assessment covers:

• Testing methodology: how engagements are scoped, executed, and documented
• Quality assurance: who reviews findings and reports before they reach you
• Consultant competence: the qualifications and ongoing professional development of testing staff
• Ethics and conduct: a binding code of conduct with real consequences
• Data handling: confidentiality practices and complaint and dispute resolution procedures

Individual certifications test whether a consultant can break systems under time pressure. Organisational accreditation tests whether the company around them runs a consistent, reviewed process. Recertification applies to both, so a certificate earned years ago and never renewed says little about current capability. The combination, an accredited company staffed by certified testers, is the strongest position a buyer can check for.

Why it matters for Singapore buyers

Singapore procurement has converged on CREST as a competence signal. MAS does not prescribe CREST by name in the TRM Guidelines, but examiners do ask who performed your penetration testing and what qualifies them. A CREST-accredited provider answers that question with documentation regulators already recognise. Government procurement and CSA frameworks reference CREST as a quality benchmark, and CCoP 2026 pushes accountability for testing evidence up to senior management.

For regulated buyers, the effect shows up in vendor assessments and examinations: evidence packets assemble faster and follow-up questions shrink. For everyone else, accreditation raises the floor. An accredited provider has been through an independent audit of methodology and QA, which filters out the resume-inflation end of the market.

Singapore adds its own layer: penetration testing vendors here are licensed by CSA under the CSRO scheme. A provider that is both CREST-accredited and CSRO-licensed has cleared the international bar and the local one. It is worth asking any shortlisted firm which of the two it holds, because plenty of pitch decks blur them together.

How to verify a provider's CREST status

Verification takes five minutes and catches the most common exaggeration in this market: a provider claiming CREST certification without specifying what, exactly, is certified.

1. Search the company name at crest-approved.org, the official register. Accredited members appear with membership type, scope, and dates. Not listed means not accredited.
2. Check the people. Individual certifications belong to named consultants, not the company. Ask which consultants are assigned to your engagement and confirm each one on the register.
3. Read what is certified. Organisational accreditation has a scope. Make sure it covers the service you are buying, not an adjacent one.
4. Distinguish trained from certified. Anyone can sit a course. "CREST-trained" is not "CREST-certified", and the register settles the difference in one search.

What to ask a provider

If you are evaluating providers, five questions sort the field quickly:

• Which legal entity holds the CREST organisational accreditation, and under what scope? Group bids sometimes borrow the accreditation of a foreign subsidiary.
• Which named consultants are on the engagement, and which CREST levels do they hold? CRT is the baseline. CCT-level testers should lead work a MAS examiner will review.
• Does the certification scope match the service you are actually buying?
• What does your quality assurance process look like before a report reaches us?
• Do you hold a CSRO licence for penetration testing services in Singapore?

A provider that answers all five without hesitating usually has nothing to hide. Evasion about the register is the tell.

Where Bravix fits

Full disclosure, since this is our blog: Bravix Infosecurity is a CREST member company, our consultants hold CREST individual certifications, and we are licensed under the CSRO scheme for penetration testing services in Singapore. Every engagement runs on the CREST methodology with documented quality assurance. If you are shortlisting accredited providers, our penetration testing services in Singapore page lists what we test and how engagements are structured. Then run the five checks above on us, same as anyone else.

CREST certified companies in Singapore: FAQ

Which companies in Singapore are CREST certified?

CREST does not publish a Singapore-only list. The authoritative source is the register at crest-approved.org, which lists every accredited member company worldwide with its membership type, certification scope, and dates. Search the company name, confirm the entry, and check the individual consultants assigned to your engagement on the same register. If a firm is not listed, it does not hold organisational accreditation.

What does CREST organisational certification verify?

It verifies the company, not just its people: the testing methodology, the quality assurance that reviews findings before delivery, consultant qualifications and ongoing development, a binding code of conduct, data handling and confidentiality practices, and complaint and dispute resolution procedures. Individual CREST certifications (CRT, CCT) separately prove hands-on exam skills. Recertification keeps both current.

Does MAS require a CREST-certified penetration testing provider?

MAS does not prescribe CREST by name in the TRM Guidelines. In practice, examiners ask who performed penetration testing and what qualifies the provider, and CREST accreditation is widely accepted as evidence of competence. Government procurement and CSA frameworks also reference CREST. Verified certification status shortens that conversation; unverified claims lengthen it.

Is Bravix Infosecurity a CREST-certified company?

Yes. Bravix Infosecurity is a CREST member company, its consultants hold CREST individual certifications, and it is licensed under the CSRO scheme for penetration testing services in Singapore. Engagements follow the CREST methodology with documented quality assurance. Verify all of it on crest-approved.org the same way you would check any other provider.