By EJN Labs · 21 Aug 2026 · 9 min read
PSN mobile ITHC penetration testing is the independent IT Health Check the Cabinet Office requires before a PSN compliance certificate is granted or renewed. If your mobile app backend connects to or supports a PSN-connected service, assessors will test its APIs, authentication, hosting and network boundaries. A typical mobile backend scope runs 5 to 8 days, roughly £5,500 to £11,200 at UK day rates of £1,100 to £1,400.
Why PSN mobile ITHC penetration testing matters for your app backend
PSN mobile ITHC penetration testing matters because the IT Health Check is the central piece of technical evidence for a PSN compliance certificate. Cabinet Office guidance on applying for a PSN connection compliance certificate puts the ITHC report at step 3 of the five-step application, and states that if you want to connect to the PSN you need to renew or get your first PSN connection compliance certificate.
The Public Services Network is the UK government network that lets public sector organisations share services and data. Certificates are issued under the Cabinet Office and Government Digital Service (GDS) compliance regime, and the ITHC itself is an independent penetration test of the systems that connect to or support the PSN.
Mobile apps complicate this picture. The app on a citizen’s or officer’s phone is rarely connected to PSN itself, but the backend it talks to often is, or sits one hop away from systems that are. If your APIs, admin consoles or databases support a PSN-connected service, the ITHC assessor will expect them in scope. For a founder, CTO or product owner selling into local government, policing, health or central government, that means the annual ITHC is not an abstract compliance exercise. It is a penetration test of your production estate, with a certificate riding on the result.
The regulatory driver: what the Cabinet Office actually requires
PSN compliance is mandatory for any organisation or service seeking or retaining a PSN connection. The ITHC is explicitly required as part of the compliance submission: the Cabinet Office expects an independent, appropriately accredited testing provider, such as a CREST-accredited firm, to test the in-scope estate and produce a report, and expects the connecting organisation to remediate or risk-manage the findings before the certificate is issued.
Two honest caveats matter here. First, the penetration test is explicit only for systems inside the agreed ITHC scope. Whether your mobile backend is inside that scope is a judgement made during scoping, based on its connectivity to and trust relationships with PSN services. It is conditional, not automatic. Second, the ITHC framework does not publish a clause-by-clause test list for mobile backends. What it does define is the outcome: an assessor must be able to state that the in-scope systems do not present an unacceptable risk to the PSN. Everything below flows from how experienced assessors interpret that outcome for a mobile estate.
What assessors check on a mobile app backend
APIs and authentication
The API layer is where most ITHC findings against mobile backends land. Assessors probe authentication and session handling, token issuance and expiry, authorisation between user roles, and the classic broken object level authorisation flaws where one user’s ID can be swapped for another’s. They also hunt for undocumented or legacy endpoints the server still answers. Our API penetration testing methodology covers the same ground.
The mobile app itself
Where the app handles PSN-derived data, assessors look at what it stores on the device, whether certificate pinning and transport security are enforced, how credentials and tokens are cached, and whether hardcoded secrets sit in the binary. A decompiled APK that reveals a backend admin key is an ITHC finding regardless of how secure the server is.
Hosting, cloud configuration and network boundaries
Most mobile backends now live in AWS, Azure or GCP, and the ITHC treats the cloud estate as part of the system. Assessors review exposed management interfaces, storage buckets and databases, security group rules, and the segregation between the environment that touches PSN data and everything else you run, along with patch levels and TLS configuration across the external perimeter.
Build, admin and supporting systems
Assessors increasingly follow the trust chain: CI/CD pipelines that can push code to the backend, admin panels used by your support team, and third-party SDKs or services with credentials into your environment. If compromising your build server would let an attacker reach PSN-connected systems, expect it to be raised, even if it was not on your original scope sketch. A structured penetration testing checklist before the ITHC helps you find these paths before the assessor does.
How a PSN ITHC engagement runs
- Scoping. The testing firm, your team and often the PSN compliance contact agree which systems connect to or support the PSN service. This stage decides whether your mobile backend is in or out.
- Testing. Testers work through the external perimeter, APIs, mobile app, cloud configuration and any agreed internal segments. For a mobile backend this is typically five to eight testing days.
- Reporting. You receive a report with findings graded by severity, written so the compliance authority can read it. Critical and high findings usually need remediation or a documented risk decision before the certificate is granted.
- Remediation and retest. Fixes are verified and the report updated, giving the compliance submission a clean evidence trail.
The whole cycle repeats annually, because PSN compliance certificates are reissued each year against a fresh ITHC.
What it costs and how scope drives the price
ITHC-supporting penetration testing in the UK is priced by testing days. Typical UK day rates run £1,100 to £1,400, and the day count is driven almost entirely by scope: how many APIs, apps, hosts and cloud accounts sit inside the agreed boundary.
| Scope | Typical days | Typical UK cost |
|---|---|---|
| Backend API only | 3 to 5 days | £3,300 to £7,000 |
| Mobile app plus backend API | 5 to 8 days | £5,500 to £11,200 |
| Full ITHC-supporting scope: app, APIs, cloud and external infrastructure | 8 to 12 days | £8,800 to £16,800 |
These are typical UK ranges rather than a quote; the exact figure depends on your architecture and comes out of scoping. For a broader view of how UK testing is priced, see our guide to penetration testing cost in the UK.
Where PSN is heading: FN4G and GovAssure
PSN is a legacy network. The Cabinet Office’s Future Networks for Government programme, run through the Central Digital and Data Office, has been moving public bodies off it since 2018 towards internet-first, cloud-centric networking, on the grounds that a bespoke shared network is expensive and increasingly hard to secure. For a mobile product team this matters in one practical way: designing the backend around internet-first assumptions now avoids rework when the connectivity model your customer relies on changes underneath you.
Assurance has moved the same way. GovAssure, launched in April 2023, replaced the cyber elements of the Departmental Security Health Check and assesses government critical systems against the NCSC Cyber Assessment Framework through annual Independent Assurance Reviews, and from April 2026 only companies in the NCSC Cyber Resilience Audit scheme may deliver those reviews. The ITHC obligation stands while a PSN connection remains in place, but the direction of travel is CAF-aligned assurance, so a mobile backend that can evidence vulnerability management continuously will age better than one tested once a year to clear a certificate.
How to choose a provider for backend testing
Match the scheme to the organisation being assessed first: a central government department needs a CHECK-accredited provider, while the wider public sector can use a CREST-accredited firm or the Cyber Scheme. If you are the software supplier rather than the connected body, confirm which of you is commissioning the ITHC and against which scheme, because that decision belongs to the connecting organisation and it changes who can hold the pen. Then check the practical points: that the quote covers the APIs and cloud accounts behind the app rather than the mobile builds alone, that a retest is included so fixes can be evidenced rather than promised, and that findings are written in severity and remediation language a reviewer can use without translation.
EJN Labs is a CREST-accredited UK penetration testing firm, certified to ISO 27001 and Cyber Essentials Plus, with UK-based testers.
Frequently Asked Questions
Is penetration testing mandatory for PSN compliance?
Yes, in effect. The Cabinet Office requires an IT Health Check as part of the PSN compliance submission, and the ITHC is an independent penetration test of the in-scope systems. Testing is explicit for anything inside the agreed ITHC scope.
Whether a specific system such as a mobile backend falls inside that scope is decided during scoping, based on its connection to PSN services.
Is my mobile app backend in ITHC scope?
Your backend is in ITHC scope if it connects to, supports or shares trust with a PSN-connected service. The app on the handset is usually outside the network scope, but the APIs, databases, cloud environment and admin systems behind it are commonly included.
Those backend components matter because compromising them could put PSN data or connectivity at risk. The scoping call with your testing firm and compliance contact settles the boundary.
What does PSN mobile ITHC penetration testing cost?
Expect around £3,300 to £7,000 for a backend API alone, around £5,500 to £11,200 for a mobile app plus its backend API, and around £8,800 to £16,800 for a full ITHC-supporting scope, at typical UK day rates of £1,100 to £1,400. Exact pricing comes from scoping.
In day terms those tiers usually take 3 to 5 days, 5 to 8 days and 8 to 12 days respectively, with the largest covering app, APIs, cloud and external infrastructure.
Who can carry out a PSN ITHC?
An independent, appropriately accredited testing provider carries out a PSN ITHC, rather than your own team, under Cabinet Office expectations. In practice that means a recognised UK firm, such as a CREST-accredited penetration testing company, whose reports the PSN compliance authority will accept as evidence.
Independence matters because the assessor must have no role in building or operating the systems under test.
How often does a PSN ITHC need repeating?
Repeat the ITHC annually as standard. Cabinet Office guidance states that a PSN connection compliance certificate is normally valid for 12 months, and that the ITHC report you submit must not be older than 12 months and must not have been used for your previous Code of Connection submission. Most connected organisations therefore run the test every twelve months so a current certificate is always in place.
If your mobile backend changes significantly mid-cycle, for example a re-platform to a new cloud environment or a major new API surface, it is sensible to retest the changed components rather than wait for the next annual cycle.
Get your mobile backend ITHC-ready
If your app or backend supports a PSN-connected service, the cheapest ITHC is the one you prepare for. Testing the APIs, cloud accounts and builds behind the app before an ITHC is scoped is what keeps findings out of the submission window. Get a CREST penetration testing quote for a scoped day count and a fixed price.
Leave a Reply