Cyber security in the UK now has chartered professional titles, but many practitioners still do not know which title fits them, which body to apply through or what evidence the assessors expect. The UK Cyber Security Council, established by Royal Charter, awards four professional registration titles against a single competence standard and keeps a public register of the people who hold them. This guide explains the titles, the specialisms, the evidence and assessment process, revalidation and how chartered status sits alongside certifications such as CISSP or CISM. It is written for practitioners deciding whether to apply, and for managers who want to use the titles in hiring and team development. Facts were checked against the Council's licensed bodies' published guidance on 27 October 2026; requirements change, so confirm current details with your chosen licensed body before you apply.
Key takeaways
- Four titles, one standard: Associate (ACSP), Practitioner (PraCSP), Principal (PCSP) and Chartered (ChCSP) are all assessed against the Council's Standard for Professional Competence and Commitment (SPCC).
- Specialism matters: Practitioner, Principal and Chartered are awarded in a named specialism such as Security Testing or Governance and Risk Management; Associate is not tied to one.
- You apply through a licensed body: bodies such as CIISec, CREST and The Cyber Scheme assess applications for the specialisms they are licensed for, and each has its own process and membership rules.
- Evidence is competence, not exam scores: applicants write scenario evidence against each SPCC competence, supply referees and, at higher levels with some bodies, take part in a professional discussion with two assessors.
- It is a commitment, not a one-off: registrants revalidate every three years with CPD evidence, an updated CV and references, and must keep membership of a licensed body.
What the role does
Chartered status is not a job; it is a public statement that an independent assessment found you competent and committed at a defined level in a defined specialism. The NCSC describes the UK Cyber Security Council as the UK's recognised professional body for the cyber security profession, established by Royal Charter to uphold standards, professionalism and public trust. The Council sets the standard for competence, helps employers identify trusted professionals and maintains a public register of registered practitioners. Where NCSC assurance schemes require professional recognition, the NCSC uses the Council's titles and specialism framework to define the competence expected of key practitioners.
The NCSC places Chartered at the top of the ladder and compares it with established professions such as engineering, law and accountancy. For employers and clients, a title answers three questions a certificate cannot: has a peer assessor examined real work, does the person hold to a code of ethics with sanctions behind it, and are they keeping current through recorded CPD.
The four titles compared
| Title | Post-nominal | What the SPCC expects (summary) | Specialism | Qualification alignment in SPCC v4 |
|---|---|---|---|---|
| Associate | ACSP | Practical experience in a cyber security role, reasonable communication skills, understands the need to develop management skills | Not tied to a specialism | RQF Level 3 |
| Practitioner | PraCSP | Practical experience in a specialism plus some supervisory experience (CREST guidance) | Required | Not stated in v4 (title added later) |
| Principal | PCSP (CREST uses PriCSP) | Expert practitioner in one specialism with experience in others; manages resources, people and budgets; communicates with non-specialists | Required | RQF Level 6 |
| Chartered | ChCSP | Significant practical knowledge across several specialisms and recognised expertise in one; leads and mentors; highest integrity; opinion sought to shape the profession | Required | RQF Level 7 |
The qualification column comes from SPCC Version 4, which predates the Practitioner title. Licensed bodies refer to a Minimum Qualification Level per specialism, and CREST notes that equivalent experience is considered. Check the current SPCC and the specialism contextualisation document before relying on any level.
Core skills and tools
The SPCC groups competence into five areas. Every application, at every level, is built around them, and evidence is cumulative: a Chartered applicant must also meet the Principal, Practitioner and Associate requirements.
| SPCC area | What assessors look for | Strong evidence looks like |
|---|---|---|
| A. Knowledge, Understanding and Experience | Depth in your specialism and breadth across others. CIISec guidance says A1 to A3 carry 60% of the available marks. | Specific engagements, the decision you made, the standard or technique you applied, the measurable result |
| B. Communications and Interpersonal Skills | Explaining risk to technical and non-technical audiences | A board paper, a client read-out, a disputed finding you resolved |
| C. Collaborative Management, Leadership and Mentoring | Supervision at Practitioner; leading teams and budgets at Principal; mentoring and shaping others at Chartered | Named outcomes for people you developed, a team or programme you ran |
| D. Integrity | Ethical judgement under pressure, handling of confidential information, conflicts of interest | A time you declined, escalated or disclosed, and why |
| E. Personal Commitment | CPD, contribution to the profession | A CPD record, talks, standards work, volunteering, mentoring schemes |
The SPCC points to the Cyber Security Body of Knowledge (CyBOK) as its underpinning knowledge reference. If you cannot say which CyBOK knowledge areas your specialism draws on, start there: it gives you vocabulary that assessors recognise and exposes gaps before they do.
Specialisms
The Council's framework defines a set of specialisms, and each licensed body is licensed for some of them. Examples confirmed from published sources on 27 October 2026:
- Security Testing: assessed by The Cyber Scheme and CREST.
- Incident Response: assessed by The Cyber Scheme and CREST.
- Cyber Security Governance and Risk Management: named by the NCSC; assessed by CIISec.
- Cyber Security Audit and Assurance: named by the NCSC; assessed by CIISec.
- Secure System Architecture and Design: assessed by CIISec.
The Cyber Scheme stated in 2023 that the scheme will offer titles across sixteen specialisms when complete. The list grows over time, so check the Council and licensed body sites for the specialism you want. A separate application is needed for each specialism.
Routes into the role
There is one register but several doors. Choosing the right licensed body is the first real decision.
| Licensed body (examples) | Specialisms confirmed | Process notes from the body's own guidance |
|---|---|---|
| CIISec | Audit and Assurance; Governance and Risk Management; Secure System Architecture and Design | Membership required (Full member for Chartered, Associate member for Principal and Practitioner, Affiliate or Student for Associate). Application form, CV, two referees, STAR scenarios per competence, documentary review, professional discussion (Chartered 2 hours, Principal 1.5 hours, Practitioner 1 hour), Accreditation Committee, then Council decision |
| CREST | Security Testing; Incident Response | Licensed in 2023. Registration form plus employer testimonial; CREST states no formal interview is required. ACSP is applied for directly with the Council, not through CREST |
| The Cyber Scheme | Security Testing; Incident Response | Assesses against the Council standard using a published contextualisation of the SPCC for the specialism |
- Pick the specialism first: choose the one where your strongest evidence of the last few years sits, not the one you aspire to.
- Pick the licensed body second: the body must be licensed for that specialism. Weigh its membership cost and the assessment format (interview or not) against your preference.
- Pick the title third: read the SPCC descriptors honestly. Assessors can recommend a lower title or a different specialism, so overreaching costs time rather than ending your application, but it is better to apply at the right level.
- Collect evidence: write one short STAR scenario per competence (CIISec asks for about half a page each), use "I" not "we", explain acronyms, and keep client details anonymised.
- Brief your referees: CIISec contacts two referees and notes delays when referees are unreachable or unsupportive. Tell them which competences they can speak to.
- Prepare for the discussion: where a professional discussion applies, expect two assessors, at least one from your specialism, probing your scenarios.
Existing CCP holders
The legacy NCSC Certified Cyber Professional (CCP) scheme has closed and CCP certifications cannot be renewed. The Cyber Scheme stated that CCP certifications awarded from 2021 remain valid for three years from their latest validation, and that holders can use a top-up process to apply for Principal or Chartered registration. If you hold CCP, ask your licensed body about the top-up route before starting a fresh application.
Certifications that help
Chartered status does not replace certifications, and certifications do not grant chartered status. They answer different questions: a certification tests knowledge against a syllabus; registration assesses applied competence, conduct and commitment. In practice certifications help in three ways.
- Minimum qualification level: licensed bodies refer to a Minimum Qualification Level per specialism. A degree or a recognised certification can meet it, and CREST notes experience may be accepted in place of qualifications. Confirm what your body accepts.
- Specialism evidence: a technical certification in your field supports competence area A, but assessors still want to see the work. A CREST or OSCP style practical exam supports Security Testing; see the Penetration Tester Career Guide.
- Breadth for Chartered: Chartered expects knowledge across several specialisms. Broad certifications such as the CISSP Certification Guide or the CISM Certification Guide show breadth; audit and risk specialists often hold CISA or CRISC (see the CISA Certification Guide and CRISC Certification Guide).
| Specialism | Certifications often used as supporting evidence | Related NHIMG career guide |
|---|---|---|
| Security Testing | CREST practical exams, OSCP, CEH | Penetration Tester Career Guide |
| Governance and Risk Management | CISM, CRISC, ISC2 CGRC | Cybersecurity Risk Manager Career Guide |
| Audit and Assurance | CISA, ISO/IEC 27001 lead auditor | Cybersecurity Auditor Career Guide |
| Secure System Architecture and Design | CISSP, CCSP | Security Architect Career Guide |
The certification column is common practice, not an official list: no source we checked states that any certification is required or sufficient for a title.
Progression
Registration is designed as a ladder you climb, then hold.
- Associate to Practitioner: the step is ownership of work in a specialism plus some supervision of others.
- Practitioner to Principal: the SPCC asks for expert-level practice in one specialism, experience in others, and management of resources, people and budgets.
- Principal to Chartered: the jump is breadth and influence. You need recognised expertise in one specialism, significant knowledge across several, and evidence that you mentor others and shape the wider profession.
- Revalidation: SPCC v4 requires revalidation every three years. Within one year after the third anniversary of registration or last revalidation, registrants submit an updated CV, CPD evidence and references. Missing that window leads to removal from the register.
- Membership and conduct: registrants must keep membership of a licensed body. An Ethics Committee reviews breaches of the codes and can apply sanctions. Temporary exemption from CPD reporting may be granted to people not in active practice.
Using the titles as a manager
- Hiring: treat a title as evidence of assessed competence in the named specialism only. A Chartered Security Testing professional is not automatically the right hire for an architecture role.
- Development plans: map your career framework levels to SPCC descriptors so that promotion evidence doubles as registration evidence.
- Assurance work: where NCSC schemes require professional recognition they use the Council's titles and specialisms, so check scheme requirements before bidding.
- Verification: check the Council's public register rather than relying on a CV post-nominal.
For the wider picture of roles, entry routes and specialisation, see the Cybersecurity Careers Guide. If your path leads to security leadership, the Path to CISO Career Guide covers the jump from expert to executive.
Practitioner checklist
- Read the current SPCC and the contextualisation document for your specialism, and note the version.
- Choose the specialism where your best evidence from the last few years sits.
- Confirm which licensed bodies assess that specialism and compare membership, fees and assessment format.
- Draft one STAR scenario per competence, written in the first person, about half a page each.
- Check your evidence is cumulative: higher titles must also meet the lower title requirements.
- Agree two referees in advance and tell them which competences to cover.
- If you hold CCP, ask about the top-up route before starting a fresh application.
- Set up a CPD log now, so revalidation in three years is routine rather than a scramble.
Standards and references
- UK Cyber Security Council: Standard for Professional Competence and Commitment (SPCC)
- NCSC: About the UK Cyber Security Council
- CIISec: Candidate Guidance, UKCSC All Specialisms, Process A
- CREST: Cyber Security Professional Titles
- The Cyber Scheme: Professional Registration
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · CISSP Certification Guide · Security Architect Career Guide · Career Change into Cyber Security Guide