CERT-In Empanelled Auditors: How to Choose One in 2026
Indian regulators — RBI, SEBI, IRDAI, UIDAI, MeitY, state governments — do not accept information security audits from arbitrary firms. For most regulated use cases, the audit has to be performed by an organisation on the CERT-In empanelment list. There are currently 236 empanelled firms, and picking the right one is less obvious than it looks.
This guide covers what empanelment actually certifies, which capabilities matter for which audits, and how to compare firms without ending up with a vendor whose paperwork is strong but whose testers aren't.
What CERT-In Empanelment Does and Doesn't Guarantee
It guarantees:
- The organisation has met CERT-In's criteria at empanelment time, including process, personnel, and infrastructure requirements.
- Reports from this firm are accepted by Indian regulators for the use cases those regulators specify (RBI banking audits, SEBI CSCRF VAPT, UIDAI AUA/KUA audits, etc.).
- The firm has self-declared a specific set of audit capabilities to CERT-In.
It does not guarantee:
- Depth or quality on any particular engagement — testers rotate.
- That the firm's declared capabilities match the staff available for your project right now.
- That the firm specialises in your sector or technology stack.
That gap is what this guide helps close.
Which Capability to Match
CERT-In classifies self-reported audit capabilities into around 50 categories. The ones that matter most for everyday buyers:
| Need | CERT-In capability to filter for |
|---|---|
| Web app security audit for a product company | web_application_security, api_security, source_code_review |
| Banking VAPT (RBI mandate) | vapt, compliance_audits, finance_sector, swift_audit |
| SEBI CSCRF | vapt, compliance_audits, rbi_sebi_irdai_compliance |
| UIDAI AUA/KUA audit | uidai_aua_kua_audit, compliance_audits |
| Cloud security review | cloud_security, architecture_review, iam_audit |
| ICS/OT environment | ics_ot, network_security |
The directory lets you filter by capability so you only see firms that have declared the capability you need.
Pricing Benchmarks (2026)
Pricing varies enormously across the 236-firm list. The following are 2026 benchmarks for mid-complexity engagements, India market:
| Engagement | Typical price range |
|---|---|
| Web app VAPT (single app, ~50 pages) | ₹1.5L – ₹5L |
| Mobile app VAPT (Android or iOS) | ₹1.5L – ₹4L |
| API VAPT (10–30 endpoints) | ₹1L – ₹4L |
| Network VAPT (per /24, external) | ₹60k – ₹2L |
| ISO 27001 Stage 1 + Stage 2 | ₹4L – ₹15L |
| SEBI CSCRF VAPT package | ₹5L – ₹20L |
| UIDAI AUA/KUA audit | ₹2L – ₹8L |
Big-four firms sit at the top of these ranges; specialist boutiques often deliver equivalent depth at the lower end. Ask for the proposed team's profiles and sample redacted report before signing.
A Three-Step Shortlist Process
Step 1: Filter by capability
Start on the CERT-In directory and apply the capability most central to your audit. Save the filtered list.
Step 2: Narrow by state
Many Indian buyers prefer an auditor based in their state for in-person kickoffs and evidence collection. Apply the state filter after capability.
Step 3: Ask the right questions
Any shortlisted firm should answer the following before you sign:
- Who will actually run the engagement? Names, certifications (OSCP, CEH, CREST, OSEP), and years of experience with your stack.
- Sample redacted report — pay attention to narrative, exploit chain, and remediation specificity, not CVSS counts.
- Can they test in your production-equivalent staging? What's their stance on destructive testing in prod?
- Are they on the list on the date of audit? Empanelment is time-bound; verify validity.
When Non-Empanelled Firms Are Fine
If your audit isn't for a regulator or doesn't need to clear a government procurement filter, you don't have to use an empanelled firm. SaaS startups doing SOC 2 or ISO 27001 can use any competent auditor. The empanelment constraint applies when the regulator demands it.