By EJN Labs · 3 Nov 2026 · 7 min read
The NCSC Cloud Security Principles do not mandate a penetration test. Principle 3, covering separation between customers, tells buyers to look for externally audited evidence of regular penetration tests when assessing your service. If a questionnaire cites the principles, a CREST-accredited test report is the evidence buyers commonly accept, alongside independent reviews of your service design.
Why do cloud procurement questionnaires cite the NCSC Cloud Security Principles?
Questionnaires cite the principles because UK buyers, especially in the public sector, use them as the reference framework for assessing a cloud service before contract. Naming a specific principle signals the buyer expects your answer to map onto it directly, not a generic security page.
In our experience, procurement teams rarely quote all 14 principles at once. They pull the two or three that matter for the service being bought: Principle 3 on separation between tenants for a multi-tenant SaaS platform, Principle 4 on governance for anything touching regulated data, Principle 7 on secure development for anything you built yourselves. A vendor who can answer by principle number, rather than attaching a generic security policy PDF, moves through the review faster.
What do the NCSC Cloud Security Principles actually require from a cloud vendor?
Nothing is mandatory under the principles themselves. NCSC publishes them as guidance to help a buyer choose a cloud provider, not as a certification scheme with pass or fail criteria. There is no clause obliging a vendor to hold any particular accreditation.
What the principles do instead is set the questions a diligent buyer will ask, describing a security goal and differentiators to look for under each of the 14 principles. Under Principle 3, the guidance is explicit: to gain confidence in how a service separates one customer’s data from another’s, a buyer should look for externally audited evidence of regular penetration tests, including red-team and blue-team exercises, plus independent reviews of the service design. That single line is why so many cloud vendor questionnaires now carry a pen test evidence field.
How do cloud vendors satisfy third-party assurance requirements under Principle 3?
Third-party assurance requirements under Principle 3 are met with an externally produced, dated penetration test report covering tenant separation and access controls, carried out by a firm independent of your development team, not a summary of your own internal testing.
Using a CREST-accredited firm answers the externally audited evidence the principle names, without extra justification in your response. Buyers vary in how much detail they want back. Some questionnaires accept a summary letter confirming scope, methodology and date; others want the full report, or at minimum the executive summary and the findings table with severities. We provide both a technical report for your security team and a short, buyer-facing summary you can attach directly to a questionnaire response without redacting the whole document. Our cloud penetration testing service is built around exactly this handoff.
How does a pen test fit around a cloud vendor’s tender or renewal deadline?
Fitting a pen test around a tender deadline means scoping it the moment the questionnaire lands, not after your sales team has already promised a date. A CREST-accredited engagement for a typical multi-tenant SaaS platform runs testing across one to two weeks.
A draft report follows a few working days after testing, then a final report once any retest is complete. Scope comes first: which environments, which tenants, and whether the test covers the application, the underlying cloud configuration, or both. We agree scope and rules of engagement with you, test to a documented methodology, and hold a findings call before the report ships so nothing in the write-up surprises you when the buyer reads it. Building in two to three weeks before your questionnaire deadline covers testing, remediation of anything critical, and a retest.
What does cloud vendor penetration testing cost in the UK?
Cloud vendor penetration testing for a multi-tenant SaaS platform typically costs £5,500 to £11,200 in the UK market, based on 5 to 8 days at £1,100 to £1,400 a day. A single-tenant service scopes lower; several integrated APIs or a wider cloud footprint scope higher.
The exact price depends on your architecture and comes from the quote form. The table below shows typical UK ranges by scope. These are market figures, not a quote: your actual price depends on the number of tenants, APIs and cloud services in play, confirmed after a short scoping call. For a broader view of how UK pen test pricing is built up across engagement types, see our penetration testing cost guide.
| Scope | Typical effort | Typical UK cost |
|---|---|---|
| Single-tenant cloud application | 4 to 6 days | £4,400 to £8,400 |
| Multi-tenant SaaS platform (Principle 3 scope) | 5 to 8 days | £5,500 to £11,200 |
| Multi-tenant platform plus API and cloud configuration review | 8 to 12 days | £8,800 to £16,800 |
| Retest after remediation | 1 to 2 days | £1,100 to £2,800 |
How EJN Labs approaches cloud vendor questionnaire evidence
EJN Labs is a UK CREST-accredited penetration testing firm, also certified to ISO 27001 and ISO 9001, with all testing carried out by UK-based testers. When a cloud vendor comes to us with a questionnaire in hand, we start from the specific principle or clause the buyer quoted.
From there we build the test plan back from what that clause actually asks a buyer to look for, rather than running a generic scope and hoping it lines up.
For questionnaires citing separation, governance or secure development, we map our test coverage to the wording of the principle itself, not a generic checklist, so the report answers the questionnaire clause for clause. Alongside the full technical report, we provide a short, buyer-facing evidence summary: scope, methodology, dates and a statement of findings by severity, formatted so it drops straight into a security questionnaire response. Our CREST-accredited testing capability sits behind every engagement we scope this way.
Frequently Asked Questions
Do the NCSC Cloud Security Principles require cloud vendors to get a penetration test?
No. The principles are NCSC guidance for choosing a cloud provider, not a certification scheme, so there is no clause requiring a test. Principle 3 asks buyers assessing separation between customers to look for externally audited evidence of regular penetration tests.
Which NCSC principle is most relevant to cloud vendor penetration testing?
Principle 3, Separation between customers, is the principle that names penetration testing directly: it asks buyers to look for externally audited evidence of regular tests, including red-team and blue-team exercises. In our experience, Principle 5 and Principle 7 questionnaires raise similar evidence requests.
What should a cloud vendor include in a pen test evidence pack for a questionnaire?
Include the test scope and dates, the methodology used, the tester’s accreditation, an executive summary of findings by severity, and confirmation that anything critical or high has been remediated and retested. Keep the full technical report ready to send on request.
How much does cloud vendor penetration testing cost in the UK?
A multi-tenant SaaS platform typically costs £5,500 to £11,200 in the UK market, based on 5 to 8 days at £1,100 to £1,400 a day. A single-tenant service can run £4,400 to £8,400 for 4 to 6 days, confirmed exactly through the quote form.
How long before a tender deadline should a cloud vendor book a penetration test?
Book two to three weeks before the deadline. That covers one to two weeks of testing, a few working days for the draft report, time to fix anything critical the test finds, and a retest if needed. Leaving it until the week the questionnaire is due usually means submitting with an open finding rather than a closed one.
Get pen test evidence ready before your next questionnaire
If a cloud procurement questionnaire has landed and it cites the NCSC Cloud Security Principles, we can scope a CREST-accredited test around the exact clause the buyer asked about. Get a CREST pentesting quote and we will come back with a fixed scope, timeline and price for your platform.
Related research
For related buyer and supplier context, see our guide to whether the CSA STAR framework is worth pursuing alongside penetration testing for UK cloud providers, our piece on pairing penetration testing with ISO 29147 disclosure evidence when you supply cloud services, and our overview of Cyber Essentials requirements under G-Cloud 15 for public sector cloud vendors.
Leave a Reply