Talk to any Indian bank, stock broker, PSU or government supplier about security audits and the same two words appear within minutes: CERT-In empanelled. Since 25 July 2025 there is a second reference point as well, CERT-In's Comprehensive Cyber Security Audit Policy Guidelines. This article explains what empanelment means for a buyer, what the 2025 guidelines ask of the organisation being audited, and the preparation that keeps a formal audit from turning into a long list of avoidable findings.
CERT-In in one paragraph
The Indian Computer Emergency Response Team is the national agency for responding to cyber incidents. Most security teams first met it through its Directions of 28 April 2022. Those Directions require specified incidents to be reported to CERT-In within six hours of being noticed, ICT system logs to be kept for a rolling 180 days within India, and system clocks to be synchronised with the NTP servers of NIC or NPL. CERT-In also runs the empanelment of security auditors and, since July 2025, publishes guidance on how comprehensive audits should be carried out.
What empanelment means for a buyer
Empanelment is CERT-In's approval of an auditing organisation. It is useful to keep three points in mind when a proposal mentions it.
- It belongs to the organisation. A tester can hold excellent personal certifications and still work for a firm that is not empanelled. What counts is the legal entity.
- It is not needed for every VAPT. It matters when the 2025 guidelines, a regulator, a government buyer or a contract says the audit must be done by an empanelled auditor. A VAPT for ISO 27001, SOC 2, PCI DSS or an overseas customer's due diligence usually has no such condition.
- It can be checked. CERT-In publishes its list. Compare the company name on the proposal and the contract with that list before you sign.
The 2025 audit policy guidelines
CERT-In issued the Comprehensive Cyber Security Audit Policy Guidelines on 25 July 2025. Their aim is to make audits across India more consistent and more complete, and they speak to both sides of the table.
Who is covered
- Empanelled auditing organisations, which plan and perform the audits.
- Auditee organisations in government and the private sector, including those audited because a sectoral regulator such as RBI or SEBI requires it.
How often
The guidelines expect a comprehensive audit at least once a year, with additional audits when risk calls for them. Sensible triggers for an extra round include a major platform change, a new internet-facing service, a serious incident or a request from your regulator.
Who may audit
Only CERT-In empanelled auditors should conduct these audits, and the auditee is expected to verify the auditor's identity and qualifications. In practice that means checking the published list, confirming the contracting entity, and asking who will actually carry out the fieldwork.
Audit types the guidelines describe
The scope reaches well beyond a classic network and web VAPT. The guidelines list the following audit types.
| Audit type | What it usually looks at |
|---|---|
| Risk and vulnerability assessment | Testing of in-scope infrastructure, applications and configuration |
| Source code review | Security flaws in application code, found by reading it with tool support |
| Cloud, IoT and OT | Cloud accounts, connected devices and operational technology |
| Red teaming and forensic readiness | Simulated attacks, and whether you could investigate an incident afterwards |
| AI system audits | Models, AI-powered applications and the data that flows through them |
| SBOM, QBOM and AIBOM | Inventories of components: software (SBOM), quantum (QBOM) and AI (AIBOM) |
| Vendor risk | Suppliers and service providers that touch in-scope systems |
| Blockchain | Blockchain-based systems, where you run them |
Few organisations need every type every year. Let your risk assessment and your regulator's requirements decide, and agree the scope in writing with the auditor before fieldwork starts.
Where RBI and SEBI fit
For regulated entities the CERT-In guidelines sit next to sector rules rather than replacing them. RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices, effective from 1 April 2024, expects periodic VA/PT, especially of internet-facing and critical systems. SEBI's CSCRF requires VAPT and cyber audits, sets half-yearly VAPT for Qualified Stock Brokers, expects VAPT findings to be closed within three months of report submission, and calls for application security testing by CERT-In empanelled auditors where it specifies. IRDAI's 2023 guidelines expect periodic assessments at insurers. Map each of these to the audit types above so one annual plan covers them all. Our article on VAPT frequency helps with the calendar.
A preparation plan that works
- Fix the asset list first. Internet-facing hosts, applications, cloud accounts, OT segments and key suppliers. An auditor can only examine what you can name.
- Run a pre-audit VAPT and close what it finds. Walking into a formal audit with known critical issues wastes everyone's time. A readiness test gives you room to fix them first. Our VAPT service is built for this.
- Check the 2022 Directions basics. Can you report within six hours, with a named owner and a tested process? Are 180 days of logs kept within India? Do clocks sync with NIC or NPL servers?
- Start the inventories early. If SBOM or AIBOM is in scope, ask development teams and vendors for component lists weeks before fieldwork.
- Write down vendor access. Who connects to your systems, from where, with which accounts, and what the contract says about security.
- Verify the auditor. List, legal entity and team, as the guidelines expect.
- Protect time for closure. Leave weeks, not days, between the audit report and any regulator deadline so fixes can be made and checked. See our closure and retesting guide.
What PentestProviders can and cannot do
We do not claim CERT-In empanelment. If your audit has to be performed by an empanelled auditor, flag it at the scoping stage and you will get a clear answer on whether we can meet that requirement. Where we cannot, the empanelled auditor carries out the formal audit and we can still help around it: pre-audit VAPT, source code review, cloud testing, red team readiness, remediation advice and retesting of fixes. For budgeting, the VAPT cost guide and the cost calculator give indicative ranges in rupees.
Frequently asked questions
Who counts as a CERT-In empanelled auditor?
An information security auditing organisation that CERT-In has approved and lists publicly. Empanelment belongs to the organisation, so check that the legal entity on your contract is the one on the list, not just that the testers hold strong personal certifications.
How often do the 2025 guidelines expect an audit?
At least one comprehensive audit a year, with further audits when risk or compliance needs call for them, for example after a major change to systems in scope.
Is PentestProviders CERT-In empanelled?
No, we do not claim CERT-In empanelment. If your audit must be carried out by an empanelled auditor, mention it during scoping and you will hear from us clearly whether we can meet that requirement. We can help with pre-audit VAPT, remediation and readiness either way.
Getting ready for a CERT-In audit? Ask for a readiness VAPT proposal and mention any empanelment requirement at the start.