Step 1 — Confirm You Actually Need Empanelment
CERT-In empanelment matters only when a regulator or government buyer specifies it. Confirm the requirement in writing before paying the empanelment premium:
| Context | Empanelled firm required? |
|---|---|
| RBI-regulated bank, NBFC, payment system operator | Yes |
| SEBI market intermediary (CSCRF VAPT) | Yes |
| IRDAI-regulated insurer | Yes |
| UIDAI AUA/KUA | Yes |
| MeitY empanelment / GIGW audit | Yes |
| SOC 2 or ISO 27001 vendor penetration test | No |
| Internal product security assurance | No |
If no regulator or buyer is asking, you can use any competent VAPT firm. See Cheapest VAPT in India for non-regulated pricing.
Step 2 — Scope the Engagement Precisely
Decide and document the following before you talk to vendors:
- Primary driver: regulator audit, customer requirement, internal risk register. Determines what the report must support.
- Targets: list of apps / APIs / network ranges / cloud accounts. Include tech stack details (frameworks, runtimes, auth models).
- Test posture: credentialed vs. non-credentialed, grey-box vs. black-box, staging vs. production.
- Compliance mapping needed: ISO 27001, PCI DSS, RBI, SEBI CSCRF, UIDAI, etc.
- Timeline: regulatory deadline (if any), freeze windows for production testing.
- Deliverable requirements: report format, re-testing policy, remediation support.
A clear scope cuts RFP-to-kickoff time in half and prevents the single biggest cost blowout — scope creep after signing.
Step 3 — Shortlist Three to Five Firms
Start from the CERT-In empanelled directory and filter in this order:
- Capability: pick the capability closest to your scope (
vapt,cloud_security,swift_audit,uidai_aua_kua_audit, etc.). - State: narrow to one or two states if you need on-site kickoffs or local presence.
- Firm size: match your organisational preference — boutiques for depth, mid-size for process, big firms for procurement familiarity.
You want three to five firms. More than five creates coordination overhead; fewer leaves you without leverage.
Step 4 — Vet the Proposals, Not Just the Prices
For each proposal, confirm:
- Named team: individual testers with certifications (OSCP, OSEP, CEH, CREST, OSWE) and prior engagements in your sector.
- Sample redacted report: pay attention to narrative, exploit chains, remediation specificity — not CVSS counts.
- Methodology: OWASP WSTG / MASVS / NIST SP 800-115 alignment. Custom methodology that nobody can describe is a red flag.
- Empanelment validity: verify the firm is on the list on the planned audit date — empanelment is time-bound.
- Insurance and NDA: professional indemnity cover, mutual NDA, data handling clauses that align with your DPDPA posture.
Step 5 — Contracts and Kickoff
Standard clauses to insist on:
- Scope lock: scope and effort fixed; changes handled via written change requests at a stated rate.
- Re-testing: one re-test round within 30 days of final report included.
- Data handling: no production data on tester laptops; secure channel for evidence; test data destroyed on project close.
- Testing window: approved start/end dates and a maintenance window for destructive activities (if any).
- Point of contact: single SPOCs on both sides to prevent diffusion of responsibility.
Kickoff call checklist: scope confirmation, test accounts provisioned, allowlists in WAF/SIEM, incident response plan if testing triggers production impact, communication cadence (daily brief / weekly steerco).
Step 6 — During Testing
- Daily short status update from the testing lead: what's been covered, major findings so far, blockers.
- Immediate escalation of critical findings (not just in the final report).
- Clarification channel (a Slack / Teams channel works well) so testers can ask product-side questions quickly.
Step 7 — Final Report and Sign-off
The deliverable should include:
- Executive summary usable by non-technical readers.
- Finding list with CVSS, business impact narrative, remediation recommendations, and reproducible evidence.
- Compliance mapping to the frameworks that drove the audit.
- Appendix: scope, methodology, team, tooling, time log.
After remediation, trigger the included re-test. On successful re-test, the firm issues the final signed report — this is what you submit to the regulator or share with your customer.