A tender document asks for a "CERT-In audit certificate". A bank's onboarding form wants a "CERT-In compliant VAPT report". A client's security questionnaire asks whether your last test was done by an empanelled auditor. These sound like the same request. They are not, and choosing wrongly costs you either money or a rejected report.
This guide explains what CERT-In empanelment actually means, when you need an empanelled auditor, when a VAPT that follows CERT-In guidelines is enough, how to get the requirement in writing, and how a pre-audit VAPT can make the formal audit easier. One fact up front: EthicsComputer is not a CERT-In empanelled auditor. We explain below where that matters and where it does not.
Quick answer: A CERT-In empanelled audit is a security audit, often a VAPT, signed by an organisation on CERT-In's panel of information security auditing organisations. A VAPT from any competent tester can use the same methods, but it will not satisfy a regulator, government department or tender that names an empanelled auditor. Read the exact requirement, get it in writing, then choose.
What "CERT-In empanelled" actually means
CERT-In, the Indian Computer Emergency Response Team under the Ministry of Electronics and Information Technology, maintains a panel of information security auditing organisations. An organisation on that panel can carry out and sign security audits where an empanelled auditor is required. Three points follow from this.
- Empanelment belongs to the auditor, not to you: CERT-In does not certify your company, website or app. There is no "CERT-In certificate" for the organisation being audited, only an audit report or audit certificate signed by an empanelled firm.
- It is not a different kind of test: an empanelled audit of a web application still involves vulnerability assessment and penetration testing. What changes is who signs it and, often, the report format the requester expects.
- Empanelment is time-bound: it is granted to a named legal entity for a period. A firm that was empanelled earlier may not be now, so check the current list on the CERT-In website.
The CERT-In Directions of 28 April 2022 are a separate matter. They require covered organisations to report specified cyber incidents within six hours of noticing them, keep ICT system logs for a rolling 180 days within India, synchronise clocks with approved time sources and name a point of contact. They do not, on their own, require you to hire an empanelled auditor. Our CERT-In compliance service covers that readiness work.
When you need an empanelled auditor, and when you do not
The requirement always comes from someone outside the test: a department, a regulator, a tender or a client. This table maps the common situations.
| Situation | What is usually asked for | What to do |
|---|---|---|
| Government website or app going live on government infrastructure | A security audit clearance, often called a safe-to-host certificate, from an auditor the department accepts, which commonly includes CERT-In empanelled organisations | Ask the department which auditor lists and which certificate format it accepts |
| Tender or PSU contract that names a CERT-In empanelled auditor | A report or certificate signed by an empanelled organisation | Treat the clause as binding; a non-empanelled report will not meet it |
| Bank, NBFC, payment, insurance or securities entity | Depends on the regulator's direction, the entity's category and its own policy | Ask your compliance officer for the exact circular clause before booking |
| Enterprise client's vendor security review | Often a recent independent VAPT report with evidence of fixes; some clients ask for empanelment | Ask the client's security team and keep the answer by email |
| ISO 27001, SOC 2 or investor due diligence | Evidence that you test regularly and fix what you find | A competent independent VAPT is usually accepted; confirm with the auditor or investor |
| Internal assurance before a major release | A test that finds real issues before attackers do | Choose on testing quality, not on empanelment |
The Digital Personal Data Protection Act, 2023 asks organisations to take reasonable security safeguards to protect personal data. It does not name CERT-In empanelment. If nobody has told you that an empanelled auditor is required, ask before you assume either way.
How to get the requirement in writing
Much of the confusion comes from loose wording such as "CERT-In compliant" or "CERT-In certified report". Do not guess. Ask the person who will accept or reject the report.
- Find the exact clause. Ask for the tender section, circular reference or questionnaire question that sets the requirement.
- Ask who must sign. Does the auditor have to be on CERT-In's empanelled list, or is any qualified independent auditor acceptable?
- Ask what document they need. A full VAPT report, a short audit certificate, a closure report after re-test, or all three.
- Confirm scope and dates. Which URLs, applications, IP ranges and environments, and how recent the report must be on the date you submit it.
- Keep the reply. File the email or letter with the audit, so the next renewal does not start from zero.
A short email is enough: "For the security audit required under clause [number], please confirm whether the report must be issued by a CERT-In empanelled auditor, which assets are in scope, and whether you need a certificate, a full report or both." If the answer is "empanelled", verify any firm you shortlist against the official list and check that the company signing the report is the same legal entity that appears on it.
How a pre-audit VAPT reduces findings in the formal audit
When an empanelled audit is required, you do not have to walk into it blind. A practical approach is to run a CERT-In guideline-aligned VAPT first, fix what it finds, and only then book the formal audit. The aim is a first report from the empanelled auditor with fewer findings, so there are fewer rounds of fixes and re-audit before you get the document your client or department needs.
- Test the same scope: the URLs, APIs and IP ranges the formal audit will cover, with the same user roles.
- Fix and re-test: close critical and high-severity issues and confirm the fixes before the formal audit starts.
- Prepare evidence: an asset list, patch records, access reviews, backup logs and, where the CERT-In Directions apply, log retention and time synchronisation settings.
- Clear the basics: default credentials, exposed admin panels, outdated plugins and missing security headers are cheap to fix and add avoidable findings if left in place.
- Brief your team: decide who answers the auditor's questions and who can approve fixes quickly.
Keep the two roles separate. The pre-audit tester helps you prepare; the empanelled auditor tests independently and signs the report.
What to budget for
When empanelment is required, budget for two pieces of work: the pre-audit VAPT with fixes, then the empanelled audit itself. Ask empanelled firms to quote against the same written scope so their numbers are comparable. For the pre-audit, EthicsComputer's published VAPT packages are Starter at ₹25,000 for one website or web app and its core server, Professional Growth at ₹60,000 for a web app, APIs, a mobile app, a cloud review and a compliance gap assessment, and Enterprise Full-Spectrum from ₹1.2 lakh for external and internal networks and social engineering. Each includes a free re-test after fixes, and the VAPT cost guide explains what each covers.
When the requirement does not name empanelment, a single guideline-aligned VAPT with a re-test may be all you need. Plan it early, because renewals, tenders and onboarding deadlines tend to arrive together.
How EthicsComputer can help
EthicsComputer is not a CERT-In empanelled auditor, and we say so before any engagement. What we do is the work around the audit: CERT-In guideline-aligned VAPT before your formal audit, readiness for the CERT-In Directions (180-day log retention in India, NTP time synchronisation, a six-hour incident reporting process and a named point of contact), and evidence preparation so the empanelled auditor has what it needs. See the CERT-In compliance and readiness service for the full scope.
Not sure if your requirement needs an empanelled auditor?
Share the clause or email you received, and we will help you work out what is being asked and what to prepare.
About the author
Vinay Grover founded EthicsComputer in Rohtak, Haryana in 2018 and leads its cybersecurity, software and AI work for clients across India and abroad. EthicsComputer is ISO 9001, ISO/IEC 27001 and ISO 20000-1 certified.
