CERT-In Empanelment Explained: Why It Matters for Your Audit

A procurement head at a mid-size NBFC once forwarded us a VAPT report and asked one question: is this valid? It was forty pages, neatly formatted, with CVSS scores and screenshots. It was also worthless for what she actually needed, because the firm that produced it was not CERT-In empanelled, and her RBI cyber-audit clause required exactly that. She had paid, she had a report, and she still had a finding waiting for her.

That is the gap almost nobody explains to buyers. Empanelment is not a quality badge you can safely ignore. In several Indian regulatory contexts it is the difference between an audit that closes a gap and an audit that becomes one.

CERT-In is the Indian Computer Emergency Response Team, the national nodal agency for cybersecurity incidents, operating under the Ministry of Electronics and Information Technology (MeitY). Under Section 70B of the Information Technology Act, 2000, CERT-In is empowered to issue directions and to maintain a panel of information security auditing organisations. That panel is the empanelment.

So when someone says they are CERT-In empanelled, they mean their organisation has passed CERT-In's evaluation and appears on the official list of auditors that CERT-In recognises for third-party information security audits. It is an organisational status, not an individual certification. A single auditor cannot be empanelled; the firm is.

This matters because of how the panel is used downstream. Regulators and public bodies do not each run their own auditor-vetting programme. They point at the CERT-In panel and say: use one of these. The empanelment therefore carries weight far beyond CERT-In's own incident-response remit.

The honest answer is that empanelment matters because other people's rules make it matter. Let me be concrete about who those people are, because this is where buyers get burned.

The Reserve Bank of India (RBI) is the biggest driver. RBI's cybersecurity frameworks for banks, its Master Direction on Digital Payment Security Controls, and its guidelines for NBFCs and cooperative banks repeatedly require independent security audits and VAPT (Vulnerability Assessment and Penetration Testing) by empanelled auditors. When an RBI inspection team reviews your audit trail, one of the first things they check is whether the auditor was on the CERT-In panel at the time of the engagement. A report from a non-empanelled firm does not close the requirement. It reopens it.

SEBI (the Securities and Exchange Board of India) does the same through its Cyber Security and Cyber Resilience Framework for market infrastructure institutions, stock brokers, depositories and mutual funds. UIDAI, which runs Aadhaar, mandates audits by CERT-In empanelled auditors for AUAs and KUAs (authentication and KYC user agencies). NPCI attaches empanelment expectations to onboarding for UPI and other payment participants. Government departments procuring security audits under GIGW and various e-governance rules default to the panel.

So the reason your audit needs an empanelled firm is rarely CERT-In itself knocking on your door. It is your own regulator, your payment network, or your enterprise customer's vendor-risk team reading your audit report and checking the letterhead against a list.

Picture a Tuesday at a payments company preparing for RBI's off-site scrutiny. The compliance lead has a shelf of reports. We sit down and go clause by clause, and within twenty minutes three things surface that no glossy report had flagged.

First, the previous year's VAPT was scoped to the corporate website and a couple of internal apps. The actual payment switch, the piece RBI cares most about, was never in scope. The report was clean because the risky thing was never tested. Second, the retest was missing. The framework expects that identified vulnerabilities are fixed and then verified by retest; there were closure emails but no evidence of the retest itself. Third, the report was signed by a firm that had been empanelled the previous cycle but had lapsed and not renewed before this engagement. All three are findings. None of them are exotic. They are the ordinary ways audits fail.

This is the part practitioners understand and buyers do not: the value of the audit is in the scope, the evidence chain, and the auditor's standing, not in the page count. A thin, correctly scoped report from a currently empanelled firm with a clean retest trail beats a thick one every time.

Empanelment is often discussed as an audit-procurement issue. But CERT-In's own directions of 28 April 2022 (issued under Section 70B(6)) put obligations directly on you, the audited entity, regardless of who your auditor is. If you operate in India and you skip these, an empanelled audit will still write you up.

The six-hour reporting window is the one to internalise. Build the runbook now, with the contact path and the template, because you cannot draft it calmly during a live incident. A good empanelled auditor will test whether that runbook exists and whether anyone has ever rehearsed it.

Do not take the logo on the proposal at face value. Empanelment status changes between cycles, and some firms keep old badges up. Verify it the way an examiner would.

Buyers ask for a number and get frustrated when the honest answer is that it depends on scope. It genuinely does, but you can plan around realistic ranges. These are indicative Indian market figures for a currently empanelled firm; complex payment, cloud-native or OT environments sit at the upper end or beyond.

Two cost lessons practitioners learn the hard way. First, the cheapest quote is usually the most expensive one, because a thin scope means a reopened finding and a second audit under regulatory pressure. Second, budget for the retest up front. Every serious framework expects verified closure of high and critical findings, and if you have not planned for the retest you will scramble for it at quarter-end.

That NBFC procurement head did not have a bad report. She had a report that did not do the one job it needed to do, because empanelment was treated as a footnote instead of a requirement. The lesson is not that empanelment is magic. It is that the audit only counts if the right firm, currently on the panel, tests the right systems and proves the fixes. Everything else is paper.

At CyberSigma we sit on the CERT-In panel and do this work hands-on, scoping to the crown jewels and carrying findings through to verified retest. If you want a second set of senior eyes on a scope or a report before you commit, that conversation is one we are happy to have.