How do I verify a CERT-In empanelled auditor claim in India?
Key takeaways
- CERT-In empanellment is category-specific, so an organisation empanelled for vulnerability assessment is not automatically empanelled for incident response or for a security audit.
- The requirement usually comes from a tender or a client contract rather than from the IT Act, so read the specific clause before you buy anything.
- CERT-In Directions 20(3)/2022-CERT-In require logs to be retained on a rolling 180-day basis within Indian jurisdiction, and that is a common audit requirement.
- Non-compliance with CERT-In directions can attract action under section 70B(7) of the IT Act, 2000, including imprisonment up to 1 year and a fine up to Rs 1 lakh.
- Under the IT Act 2021, section 70B empowers CERT-In to require regular reports, and its 6-hour incident reporting window is the clearest example of that power in practice.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does CERT-In empanelment actually certify?
That an organisation is listed by CERT-In for a named category of IT security work, under a scheme that sets minimum capability, staffing and quality requirements. Three things to understand. It is category-specific: vulnerability assessment, incident handling, and security audit services are separate listings, so an organisation on one list is not on the others. It is granted to the organisation, not to an individual, so a large consultancy's name on a list does not make a junior engineer's individual report compliant. And it is a floor, not a ceiling: empanelment means the organisation is auditable to a standard, and the specific engagement still needs scope, a methodology and a named tester. Any vendor claiming empanelment should produce the exact list entry, the category and the validity dates without hesitating.
When do you actually need a CERT-In empanelled auditor?
Three triggers, and they are the only three that matter. A regulatory or sectoral instruction naming empanelled auditors for a specific purpose, most often in government and public-sector tender documents. A customer contract that names it, which is increasingly common among banks, fintechs and large enterprises, and which is a commercial requirement rather than a legal one. And a bid requirement, where a tender says the audit report must come from an empanelled organisation and a non-empanelled report disqualifies the bid, regardless of quality. If none of those three applies, you are not required to buy an empanelled auditor, and you should be honest with yourself about that before spending the money. You can still use a good firm, but you should know which requirement you are actually satisfying.
How do you verify an empanelled auditor claim?
Four checks, in this order. First, ask for the list entry itself, with the organisation's exact registered name, the category, the reference number and the validity dates, and ask for it in writing rather than in a slide. Second, verify that name on CERT-In's own published empanelment list, not on the vendor's website, because a vendor site is not evidence. Third, check that the category matches your engagement, because a vulnerability assessment listing does not cover incident response or a compliance audit. Fourth, confirm the individuals doing the work are the organisation's own or contracted under its empanelment, and get the engagement letter to carry the empanelment reference. A genuine empanelled firm will never object to any of that, and resistance to any step is itself the finding.
What does an empanelled engagement typically cost, and what should you get?
A CERT-In aligned VAPT in India runs Rs 60,000 to Rs 3,00,000 excluding 18% GST, depending on whether it is an external perimeter test, a web application test, or an internal network and Active Directory assessment at Rs 1,50,000 to Rs 6,00,000. For the money you should get a defined scope, a named methodology, a report with CVSS scoring and step-by-step reproduction, a 180-day log retention statement, a retest, and a document that ties the engagement to the empanelment reference. You should also get the point of contact requirement out of Annexure II, because CERT-In expects a designated point of contact for incident reporting, and if the auditor does not mention it, they have not read the directions closely enough.
| Trigger | Source of the requirement | What it obliges you to buy |
|---|---|---|
| Government or public-sector tender | Tender document naming empanelled auditors | A report from an organisation on CERT-In's list for that category |
| Client contract requirement | Contract clause, usually in a bank's vendor framework | An empanelled report for the named scope, on a fixed schedule |
| Bid qualification | Tender qualification criteria | Empanelment evidence submitted with the bid, not after it |
| No named requirement | Nothing | No empanelled auditor needed; any competent firm will do |
What are the frequently asked questions?
Get a straight answer on this
Send us the tender clause or the client requirement that names an empanelled auditor, and we will return the scope, the category and a fixed price.
Send us the details See pricing