CREST
Definition
A UK-based not-for-profit professional body that publishes practitioner-focused incident response guidelines and operates accreditation schemes for IR service providers. CREST guidance emphasises technical response activities such as live forensics and threat intelligence integration.
- Type
- UK-based not-for-profit professional body
- Function
- Publishes IR guidelines, runs accreditation schemes
- Focus
- Technical response, live forensics, threat intelligence
- Compared to
- Other national incident response frameworks
Common questions
How does CREST accreditation differ from a certification for an individual analyst?+
CREST accredits service provider organisations against defined technical and quality standards, in addition to running individual examinations, so accreditation signals that a firm's processes meet a baseline, not just that a specific person passed a test.
Why would an organisation compare CREST guidance against other incident response frameworks?+
Different frameworks emphasise different priorities, and CREST's technical, hands-on-the-keyboard focus is often compared against more governance-oriented frameworks to decide which best fits an organisation's response maturity and regulatory obligations.
Related terms
- Framework Blending
- The practice of combining elements of multiple IR frameworks: for example, using NIST as the strategic backbone, SANS phase names in operational...
- ISO/IEC 27035
- An international standard for information security incident management. Part 1 covers principles and concepts; Part 2 covers planning and preparation. It defines...
- NIST SP 800-61
- The US National Institute of Standards and Technology's Computer Security Incident Handling Guide. It defines a four-phase IR lifecycle: Preparation; Detection and...
- Phase Granularity
- The number and specificity of discrete steps a framework defines within the IR lifecycle. Higher granularity, as in SANS PICERL's six steps...
- SANS PICERL
- A six-step incident response model developed through SANS Institute training: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. PICERL breaks NIST's combined response...