Penva Security operates as a CREST-aligned penetration testing firm in Australia, with individual testers holding CREST credentials including CRT (Registered Penetration Tester), CPSA (Practitioner Security Analyst), and CCT (Certified Tester) at App and Infrastructure levels. CREST credentials are issued to individuals, not firms – so the relevant question for procurement is whether the testers on your engagement hold them, and which ones. We can disclose specific credentials per engagement under NDA.

CREST International is the global accreditation body for cybersecurity service providers and individuals, headquartered in the UK. CREST Australia New Zealand (CREST ANZ) is the regional body that operates within CREST’s framework specifically for Australia and New Zealand. Both bodies recognise the same credentials – CRT, CPSA, CCT – and both can verify Penva Security tester credentials. For Australian procurement, CREST ANZ is typically the more relevant reference point.

Three paths: (1) Request a credential verification packet from Penva Security under NDA – we provide certificate numbers and verification codes. (2) Contact CREST International directly at crest-approved.org with the certificate numbers. (3) Verify OSCP/OSCE3 credentials through Offensive Security’s online verification system. For Australian-specific verification, CREST ANZ at crest-approved.org/anz is the regional reference.

Named penetration testers face real targeting risks – named credentials can be used to research detection patterns or for social-engineering against the tester. Some clients (financial services, government, sensitive HealthTech) prefer anonymous engagement teams for confidentiality. Our policy is to disclose individual tester credentials under NDA during procurement, not publicly. See our team page for the full rationale.

Penva Security operates to ISO 27001-aligned information security practices but is not currently ISO 27001-certified at the corporate level. For clients where corporate-level ISO certification is a procurement requirement, this is a fair question to raise during scoping – we’ll be honest about where we are and what we can demonstrate via SOC 2-aligned controls and ASD Essential Eight maturity.

Penva Security’s tester credentials satisfy the ‘qualified personnel’ or ‘appropriately skilled’ criteria of every major framework relevant to Australian pentest buyers: APRA CPS 234 (paragraphs 27-28), ISO 27001 (Annex A.8.8 and A.8.29), SOC 2 (Trust Services CC7.1), PCI DSS v4.0.1 (Requirement 11.4), IRAP/ISM, HIPAA Security Rule, Essential Eight maturity validation, and Privacy Act ‘reasonable steps’ under APP 11.

Yes – every Penva Security engagement produces a Letter of Attestation suitable for auditor evidence. The letter explicitly references: the methodology used (OWASP WSTG v4.2, PTES), the testers’ CREST/OSCP credentials, the scope tested, the date range of testing, the retest status, and Penva Security’s corporate registration. Format adapts to specific audit needs (APRA tripartite, SOC 2, PCI DSS QSA, ISO 27001 surveillance audit).

CREST credentials require ongoing CPD (continuing professional development) and periodic re-examination – typically every 3 years. Offensive Security credentials require renewal via re-examination. Penva Security tracks individual credential currency and removes engagement assignments where credentials lapse. We can confirm currency dates during procurement verification.

CREST has both individual credentials (held by testers) and corporate membership (held by firms). The question of which corporate-level membership status Penva Security operates under is best discussed during procurement under NDA, as it affects pricing tiers and contract structures. The credential currency of the testers performing your engagement is the more important verification for most audit purposes.

Strictly required for most Australian compliance work: CREST CRT minimum, plus OSCP or equivalent practical-skill credential. Strongly preferred: CREST CCT (App or Inf) for senior-tester roles, OSCE3 for the most advanced exploitation work. Nice-to-have but not strictly required: CRTO for red-team-specific engagements, GPEN for US-recognised engagements, AWS Certified Security for cloud-specific work. Penva Security tester teams cover all of these.