CERT-In empanelled VAPT: who needs it, and how to check one

A CERT-In empanelled VAPT is a vulnerability assessment and penetration test run by a firm on the official list of auditing organisations empanelled by CERT-In, India's national cyber security agency. You need one when a regulator, a government buyer or a signed contract asks for it by name. The 2022 CERT-In directions do not, on their own, require one.

Below: what empanelment is, who asks for it (each claim sourced), how to check an auditor, and what CERT-In's July 2025 audit guidelines expect from both sides. It ends with how an empanelled audit fits the rest of your VAPT work. Still choosing a provider? Read how to choose a penetration testing company. This is not legal advice.

What is a CERT-In empanelled VAPT?

It is a penetration test plus a vulnerability assessment, done by an organisation that CERT-In has evaluated and listed. CERT-In (the Indian Computer Emergency Response Team) empanels Information Security Auditing Organisations. They audit the systems, networks and applications of government bodies and other sectors, including through vulnerability assessments and penetration testing (CERT-In audit guidelines, 2025). The guidelines define penetration testing as testing in which components or the whole application are "actively tested to identify and exploit potential vulnerabilities".

Empanelled, not certified

CERT-In empanels organisations. It does not certify your application, and it does not stamp a report as "CERT-In approved". If someone asks for a "CERT-In certificate", what you can actually get is a report, often with an audit certificate, signed by an empanelled auditor. Its weight comes from who signed it.

The guidelines set a signature chain. The auditors who did the work sign first, and they must be people the firm declared to CERT-In. A separate reviewer signs next, and the head of the auditing organisation signs last. CERT-In must not be made or projected to be a party to your contract with the auditor. You hire and pay the firm directly (CERT-In, 2025).

Buyers also search for a "safe to host certificate". The guidelines use the term audit certificate, and we found no "safe to host" wording in them. Ask the party that wants one which exact document they will accept.

How big is the panel, and how much work does it do?

A 26 July 2025 release from the Ministry of Electronics and IT said CERT-In had empanelled 200 cybersecurity organisations. It also said CERT-In security audits in FY 2024-25 totalled 9,708 across power, transport and banking, financial services and insurance (PIB, 2025). The official list we opened on 7 October 2026 had 236 numbered entries, so the panel has grown past the 200 in that release.

Who needs a CERT-In empanelled VAPT auditor?

Only organisations whose regulator, buyer or contract names empanelled auditors. The duty comes from that document, not from CERT-In's own directions. The table lists the sources we opened and read on 7 October 2026. Rules change, so confirm the current text before you sign a statement of work.

Where empanelled auditors are named in official text

Capital markets and SEBI

SEBI is the clearest case we found. The CSCRF circular is SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 of 20 August 2024. Answer 53 in the FAQs sends the DAST or SAST of in-house or off-the-shelf software to a CERT-In empanelled organisation. The FAQs also set timing. Qualified Stock Brokers run VAPT and cyber audit half-yearly, and must close vulnerabilities found in a VAPT within three months of submitting the VAPT report (SEBI CSCRF FAQs).

What the SEBI FAQs do not say

For forensic audits, the same FAQs say regulated entities select auditors "after due diligence"; they are not told to use only empanelled firms. Empanelment is not a blanket rule even inside one regulator's document, so read each clause.

Payments, banking and insurance

RBI has named CERT-In empanelled auditors before, as the 2016 notification shows. Newer RBI, IRDAI and payment-system directions may repeat or change that wording. We could not open every current text, so we do not list them as fact. Ask your compliance lead for the clause number.

Data protection law

The DPDP Act and its 2025 Rules ask Data Fiduciaries for reasonable security safeguards. The government's explainer says the highest penalty tier applies to failing to maintain them. It also says Significant Data Fiduciaries must conduct independent audits (PIB: DPDP Rules, 2025). It does not say those audits must come from a CERT-In empanelled firm. An empanelled report can still be good evidence. See our DPDP Act security guide.

If your buyers are global

SOC 2 and ISO 27001 buyers usually ask for an independent tester with a clear method and a retest, not an empanelled one. See SOC 2 penetration testing and ISO 27001 penetration testing. If you serve both kinds of buyer, run one empanelled audit for the regulated deals and test between audits for everyone.

Do the 2022 CERT-In directions require a VAPT?

No. CERT-In is the national agency under Section 70B of the Information Technology Act, 2000. Its six directions of 28 April 2022 were issued under Section 70B(6). They cover clock synchronisation, six-hour incident reporting, a point of contact and log retention. They also cover subscriber records for data centres, VPS, cloud and VPN providers, and records for virtual asset service providers (CERT-In Directions, 2022). None is a penetration-testing duty, and none mentions empanelled auditors. The mistake is quoting "CERT-In compliance" as if it meant "buy an empanelled VAPT".

What the 2022 directions actually ask for

The directions say non-compliance may invite punitive action under Section 70B(7). CERT-In's FAQs on the directions quote that provision as imprisonment of up to one year, a fine, or both. That sits on reporting and records, not on whether you ran a VAPT.

What do CERT-In's 2025 audit guidelines expect?

CERT-In published its Comprehensive Cyber Security Audit Policy Guidelines, version 1.0, on 25 July 2025. They call themselves binding on empanelled auditing organisations and on auditee entities "covered under the relevant provisions". They are written for public and private organisations that are required to evaluate their security, or want to (CERT-In, 2025).

Rules for the organisation being audited

Auditee expectations in the guidelines

Rules for the auditor

Independence and payment

Payments must not depend on the audit outcome or on approval of closure reports. A firm that both implements controls and audits them has a conflict of interest, and it must disclose it. If a quote ties fees to a clean report, it breaks the guidelines.

Method and tooling

The guidelines discourage solely tool-based testing, because tools may miss manual components. They also say short lists such as the OWASP Top 10 and SANS Top 25 should not be the audit standard. They point to fuller references such as OWASP's Web Security Testing Guide and the Application Security Verification Standard. A report that only says "tested against OWASP Top 10" is thin by CERT-In's own measure.

Scoring, evidence and the report

Auditors grade findings with CVSS, add the Exploit Prediction Scoring System (EPSS), and map each finding to a CWE and, where one exists, a CVE. The report lists every in-scope asset, the duration, methods, tools, sampling decisions, manpower and limitations. It carries an executive summary that turns findings into business risk, and it states closure timelines by severity. Evidence must be accurate, relevant, sufficient and appended. The lead auditor and the head of the firm sign the audit certificate.

Findings during the test

The auditor tells you about critical and high findings as they turn up, not in the final report. High-risk items, such as a discovered breach or a flaw with a known high exploitation rate, need an immediate report with a practical fix.

People and process

Auditors use only staff declared to CERT-In. Freelancers, trainees, moonlighters, outside consultants and anyone serving notice are out. A separate checker reviews the work. Audit metadata goes to CERT-In within five days of completion, and the auditor must tell you this before work starts. CERT-In says the data submitted is kept confidential.

How do you verify a CERT-In empanelled auditor?

Check the firm against CERT-In's own list, never its website badge. The list calls itself the "up-to-date valid list" and says it is updated "as soon as there is any change" (CERT-In list, linked from the empanelment page).

1. Find the firm on the official list. Open the list yourself, not through a link the vendor sends. Match the exact legal name and address, not the brand, and note the date you checked.
2. Check how it describes itself. The guidelines allow one sentence: "This Organization is empaneled by CERT-In for providing information Security Auditing Service". Firms may not use other wording or the CERT-In logo without written permission. A logo on a sales deck is already outside the rules.
3. Confirm the signing entity. A group company, reseller or partner may not be the empanelled entity. The contract and report must name the one on the list.
4. Ask for the named testers. The firm may deploy only people declared in its snapshot information. The guidelines invite you to interview the proposed testers and check their credentials and identity cards.
5. Match domain experience. The snapshot shows skills, audit categories, sector-wise audits in the last 12 months, tools and manpower. Each profile also says whether the firm outsources work. Match it to your web, mobile, cloud or network scope.
6. Read a sample report. Look for CVSS and EPSS, CWE and CVE mapping, the environment tested, attached evidence and the signature chain. See how to read a penetration test report.
7. Keep an exit. If the auditor's credibility is unclear, the guidelines say the contract should let you stop and move to another organisation. Add "no subcontracting without written consent" too.

Red flags worth walking away from

Claims that do not check out

"CERT-In certified" or "approved by CERT-In" wording. A firm missing from the list, or a different legal entity from the one quoting. A logo but no name on the list.

Terms that break the guidelines

Fees tied to passing. A promise to "clear" a report. No named testers until after signing. A raw scanner export as the report. A staging-only test sold as a production certificate.

How does CERT-In empanel an auditor?

CERT-In runs a four-stage evaluation: documentation review, an offline practical skill test, a practical skill test in vulnerability assessment and penetration testing, and a personal interaction session at CERT-In (CERT-In empanelment page). New applications were open from 1 July 2026 until 5:30 PM on 30 September 2026, so the list can change. Check the current version every time.

Passing is a filter on who may do the work, not a rating of any single test.

What happens to auditors who break the rules?

For poor audits or breaches of the terms, the guidelines list graded actions: a watch list with a written warning, suspension, debarment, de-empanelment, and penal and legal action. Triggers include inadequate closure of non-compliances and repeated gaps in audit coverage. Sub-letting or outsourcing an assignment is a named breach.

What does CERT-In empanelment not guarantee?

It does not guarantee a secure application or a deep test. Treat it as one signal among several.

What empanelment tells you, and what it does not

A test is a snapshot. The pentest report describes the build tested, which is why the guidelines want hashes and versions in it. An annual audit says nothing about next week's release, which is why they also ask for audits after every major change.

How do you prepare for an empanelled audit?

Prepare scope, environment, accounts and an owner for fixes before day one. The guidelines expect a pre-audit discussion on scope and a technical point of contact on your side. Our VAPT checklist has the long form.

Preparation checklist

Compare quotes on these items; our penetration testing cost guide explains what drives differences.

What mistakes do teams make with CERT-In empanelled VAPT?

1. Buying it because a vendor said it was mandatory. Ask for the clause first.
2. Testing staging only. If staging differs from production, the certificate is weaker, and the report must say so.
3. Treating the certificate as the end. Code shipped later is not covered.
4. Skipping the follow-up audit. A report with open high findings is a to-do list, not evidence. Run a remediation process with owners and dates.
5. Giving the tester one account. Authorisation flaws such as broken object level authorization need several accounts of different types to find.

Why does an annual audit still leave a gap?

Attackers do not follow your audit calendar. Verizon's 2026 Data Breach Investigations Report says 31% of breaches now start with software vulnerabilities, beating stolen passwords as the top way in (Verizon DBIR, 2026). IBM's 2026 Cost of a Data Breach report calls the global average cost a record, up 12% on last year (IBM, 2026). IBM India reports a 15.9% rise in India, with financial services and technology the two costliest sectors (IBM India, 2026). The lesson is to fix flaws between audits as well. It does not argue against the yearly audit.

How do you run an empanelled audit alongside continuous testing?

Use the empanelled audit for the signed, regulator-facing report, and continuous testing to keep the application clean between audits. The audit shows that an empanelled outside party looked; continuous testing catches what each release introduces. Our guide to continuous penetration testing covers the split.

Where Cyberlop fits

Cyberlop finds vulnerabilities in web apps and their APIs with black-box, grey-box and white-box pentesting. It reports what it actually exploited, with the request, the response, a screenshot where a person can see it, and, in white-box mode, the line of code. A fix is proven by re-running the exact exploit against the new code, the closed-loop retest. It can run on a schedule or in CI/CD, or inside your own network with private scanning.

Run it before an audit and the auditor spends time on harder issues. Run it after, and each fix is proven before the follow-up audit. It does not replace the signed report a regulator names. See regulated teams, our evidence page and where we draw our own limits.

A simple yearly rhythm

1. Quarter 1: confirm the requirement, fix last year's backlog and prove each fix with a retest.
2. Quarters 2 and 3: run scheduled tests on each release and gate builds on critical findings.
3. Quarter 4: freeze scope, brief the empanelled auditor and audit a stable build.
4. After the audit: close findings, complete the follow-up audit and archive the signed report with the build hash and version.