What is a CERT-In empanelled auditor and why does it matter?
Key takeaways
- CERT-In empanels auditors against specific service categories, so the empanelment must match the audit type you are buying.
- Empanelment is a procurement and contractual requirement, not a statutory licence to perform penetration testing in India.
- Always verify a claimed empanelment on CERT-In's own published list rather than trusting a logo in a proposal.
- The same minimum standards apply regardless: a signed authorisation, a rules-of-engagement document and a retest after remediation.
- CERT-In requires listed incidents to be reported within six hours, on incident@cert-in.org.in or 1800-11-4949, regardless of who performed the audit.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does CERT-In empanelment actually certify?
It is a quality and capability assurance applied to audit service providers. The process covers the organisation's technical competence, its testing methodology and infrastructure, its personnel and their background verification, its quality processes and its independence and reporting arrangements. The outcome is published as a list of empanelled entities against defined service categories, such as vulnerability assessment of web applications, network and system security assessment, mobile application security assessment, and related audit services. This is why one badge is not enough: an entity may be empanelled for network security assessment and not for mobile application testing. Always check the category, the validity dates and the exact name of the legal entity that will sign your report.
Where is empanelment legally required, and where is it just expected?
There is no general Indian law requiring a penetration test to be performed by an empanelled body. The requirement arrives through three other routes. First, government and public-sector tenders, which specify empanelment as a bidder qualification. Second, enterprise customer contracts, where an Indian buyer's vendor onboarding pack requires it, especially in banking, financial services, telecom and government-adjacent supply chains. Third, some regulator-driven audit programmes, where the requesting body specifies the certification route. In all three cases the empanelment belongs to the contracting requirement, not to a statute. For an Indian SME with no such customer requirement, the practical value of empanelment is a second pair of eyes on the vendor's capability, which is useful but not mandatory.
What still applies if your vendor is not empanelled?
The legal and professional obligations are identical. Testing a system you do not own or have written permission to test can attract liability under sections 43 and 66 of the Information Technology Act, 2000. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including an act of ethical hacking, undertaken with the permission or consent of the owner attracts no liability under the Act, which is why written authorisation and a signed rules-of-engagement document are the foundation of the engagement, not empanelment. The CERT-In reporting duty also does not depend on who did the audit: listed incidents must be reported within six hours of notice, on incident@cert-in.org.in or 1800-11-4949.
How do you check a claim of empanelment properly?
Three checks, in this order. First, the published CERT-In list: find the entity by name and confirm the exact legal entity name matches the one on your quotation and your GST registration, since a franchise or a subcontractor can borrow a parent's credentials. Second, the service category: confirm the specific audit type you need is covered and the validity dates have not lapsed. Third, the engagement itself: ask which named individuals will perform the work and whether the report will be signed by the empanelled entity, because empanelment attaches to the organisation and the people on its rolls, not to a marketing page. AAVETech publishes its credentials and engagement model openly on its certifications page, and we will always tell you plainly whether a requirement calls for empanelment or whether an unpanelled firm can do the work competently.
| Aspect | What it is | What it is not |
|---|---|---|
| Certification | A capability and quality assurance granted by CERT-In | A general licence to test any system |
| Legal requirement | Required in tenders and some customer contracts | Not a legal requirement for most penetration tests |
| Scope of grant | Defined audit service categories | A blanket badge for all security work |
| Verification | CERT-In's published list, by entity name and category | Trusting a logo in a proposal |
| Basis for testing | Written authorisation from the owner | Verbal or implied permission |
| Reporting duty | Listed incidents to CERT-In within 6 hours | Waiting for certainty before reporting |
What are the frequently asked questions?
Get a straight answer on this
Tell us whether your tender or customer contract requires CERT-In empanelment and in which service category, and we will confirm what you actually need before you spend anything.
Send us the details See pricing