CERT-In Empanelment: What It Is and Why Auditors Pursue It
CERT-In empanelment is the authorisation granted by the Indian Computer Emergency Response Team to information security auditing organisations that meet CERT-In's technical, process, and personnel criteria. Only empanelled auditors are permitted to perform the regulatory audits required by RBI, SEBI, IRDAI, UIDAI and many government empanelment schemes.
The CERT-In empanelled auditor list is published on CERT-In's website and is periodically refreshed. Empanelment is time-bound — typically for a fixed period — and auditors must re-apply and re-qualify to remain on the list.
What Empanelment Covers
Empanelled auditors are authorised to perform:
- Information security audits (ISO 27001, PCI DSS, IEC 62443, etc.)
- Vulnerability Assessment and Penetration Testing (VAPT)
- Web, mobile, API, and network security audits
- Cloud security audits
- Compliance audits for sector-specific regulators (RBI, SEBI, IRDAI)
- UIDAI AUA/KUA audits for Aadhaar-dependent entities
- Red team, source-code review, forensics (where declared as capabilities)
Each empanelled firm self-reports the specific capabilities it offers via a capability snapshot. The directory makes this visible so clients can pick an auditor whose declared capabilities match the scope of work.
How to Verify a Firm Is Empanelled
- Check the CERT-In empanelment list directly.
- Confirm the firm's name and empanelment validity dates.
- For a filtered, cross-referenced view, use the AuditXYZ CERT-In directory.
Why It Matters For Buyers
Regulators do not accept audits from non-empanelled firms for the regulated use cases. If your firm needs an audit for RBI, SEBI, IRDAI, UIDAI, or government empanelment — the auditor must be on the list on the date of audit.