What is a CERT-In empanelled auditor and do I need one?
Key takeaways
- CERT-In empanelment is category-specific, so an organisation empanelled for vulnerability assessment is not automatically empanelled for incident response.
- You need a CERT-In empanelled auditor only when a regulation, tender or client contract names it as a requirement.
- Always verify any empanelment claim on CERT-In's own published list, because the label is easy to claim and easy to fake.
- CERT-In directions still apply to you in full, including six-hour incident reporting and 180-day log retention, whether or not you use an empanelled auditor.
- A CERT-In compliant incident report is produced as part of an incident response engagement, not as a separate certificate you can order afterwards.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does CERT-In empanelment actually mean?
It is a listing, issued by the Indian Computer Emergency Response Team, of organisations qualified to conduct a particular category of IT security audit under the categories defined in CERT-In's empanelment scheme. The categories include vulnerability assessment, system security audit, and incident handling and response support. Empanelment is granted to the organisation for a specific category and for a validity period, and it is not a general endorsement of everything the organisation does. A firm empanelled for vulnerability assessment is not thereby empanelled for incident response, and a claim that a firm is CERT-In certified for everything is a red flag worth checking on the list itself.
When do you actually need one?
Only when a specific instrument names it. Section 70 of the Information Technology Act, 2000 gives CERT-In the power to require information and to issue directions to authorised agencies andCERT-In empanelled auditors in the exercise of its functions. In practice the requirement arrives in three forms. A regulatory or sectoral instruction that names a CERT-In empanelled auditor. A government or public-sector tender with the requirement written into the tender document. Or a customer contract, most often in banking, healthcare or BFSI, where the buyer wants evidence produced by an accredited body. If nobody in writing has required it, a normal VAPT from a competent firm is sufficient and cheaper, and you should not pay a premium for a label you do not need.
How do I verify a vendor's empanelment claim?
Go to CERT-In's published empanelment list yourself and search the organisation's legal name, not the brand name. Check three things. That the category on the list matches the category of work you are buying, because a mismatch voids the requirement. That the entry is current and inside its validity period. And that the legal name matches the name on the invoice and the GST registration. If a vendor resists you doing this check, or offers to confirm it by email instead, treat that as the answer. An empanelment claim is verifiable in minutes, so a vendor who makes it hard to check is telling you something.
Does using a CERT-In empanelled auditor change your compliance obligations?
No. Your obligations under the CERT-In directions apply to your organisation regardless of who does the work, including reporting listed incidents within six hours of noticing them or being brought to notice of them, maintaining logs for 180 days, and enabling anonymisation of user information for network subscribers. Choosing an empanelled auditor affects the acceptability of the audit deliverable to a third party, not your duties. The practical advice is to keep the two separate in your planning: the CERT-In six-hour clock and 180-day log retention are operational commitments you own, while empanelment is a procurement attribute of the firm you hire.
| Audit type | Does empanelment help? | Why |
|---|---|---|
| CERT-In empanelment audit | Yes, it is the point of the empanelment | Only an empanelled auditor can issue a valid empanelment certificate |
| Internal VAPT and security testing | Not required | A signed scope and rules-of-engagement document is what makes the test lawful |
| DPDP readiness review | Useful but not mandatory | The client usually needs a readiness position, not a statutory certificate |
| ISO 27001 certification audit | No, a different body certifies this | ISO certification is run by an accredited certification body |
| SOC 2 Type II | No | SOC 2 is an attestation, issued by a CPA firm |
What are the frequently asked questions?
Get a straight answer on this
Tell us which audit category your tender or client contract actually names, and we will confirm in writing whether empanelment is required and what evidence to ask any vendor for.
Send us the details See pricing