CERT-In Empanelled Audit
The audit your regulator will accept on the first read.
Macksofy is empanelled by the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology. Our audits are accepted by SEBI, RBI, UIDAI, IRDAI, payment system operators and every major Indian regulator and certification body — without rework.
Information Security Auditor
What is a CERT-In empanelled audit?
A CERT-In empanelled audit is a security assessment performed by an auditor formally empanelled by CERT-In (MeitY, Government of India), whose reports RBI, SEBI, UIDAI, and IRDAI accept without rework. Macksofy is CERT-In empanelled and delivers these audits — VAPT, application, and infrastructure — across India.
CERT-In Audit is leverage, not paperwork.
CERT-In empanelment is the gold standard for cybersecurity auditors in India. For BFSI entities, payment aggregators, government contractors, regulated fintechs and any organization handling sensitive Indian data, a CERT-In empanelled audit is the only one that satisfies regulator inspection. Macksofy holds active empanelment with the requisite scope to perform information security audits.
- BFSI: Banks, NBFCs, brokers, AMCs, custodians, RTAs, RIAs
- Payment Aggregators / Payment Gateways (RBI authorized)
- Government / PSU IT systems (annual audits)
- UIDAI Aadhaar ecosystem entities (AUAs, KUAs, ASAs)
- Critical Information Infrastructure (CII) per CERT-In
- Healthcare entities (NDHM / ABDM)
How we run a CERT-In Audit engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
1 · Empanelment letter + scoping
- CERT-In empanelment confirmation to client
- Scope per regulator requirement (e.g., RBI System Audit Report)
- Engagement letter + RoE
- 011 · Empanelment letter + scoping
- CERT-In empanelment confirmation to client
- Scope per regulator requirement (e.g., RBI System Audit Report)
- Engagement letter + RoE
- 022 · Technical audit (VAPT)
- Annual VAPT per regulator schedule
- Network, application, mobile, cloud as applicable
- Manual exploitation of high-severity findings
- 033 · Process + governance audit
- Information security policy review
- Access management, change management
- Incident response evidence
- Third-party risk management
- 044 · Compliance attestation
- Mapping to specific regulator framework
- Gap identification + closure plan
- Management acceptance + risk treatment
- 055 · Regulator-format report
- CERT-In format report
- RBI System Audit Report (where applicable)
- SEBI cybersecurity attestation (where applicable)
- 066 · Closure + retest
- Free retest of remediated findings within 30 days
- Final closure letter + Macksofy attestation
- Ongoing advisory included in engagement
What your CERT-In Audit engagement puts on the table.
- CERT-In empanelment letter for the engagement
- Audit report in regulator-prescribed format
- Findings register with risk + ETA + management response
- Free retest of remediated findings
- Closure letter / Macksofy attestation
- Ongoing advisory for regulator inspections
Annual System Audit Report
Outcome: Submitted to SEBI in CERT-In format inside 12 working days; zero rework
Annual cybersecurity audit per RBI guidelines
Outcome: All controls validated; remediation closed within 60 days
The shape of a CERT-In Audit engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- Governance & policy review3 pts
- Technical security audit3 pts
- Incident-response readiness3 pts
- Third-party & supply chain3 pts
- Audit pack & evidence3 pts
- Continuous monitoring uplift3 pts
Board-level accountability through to operator-level execution.
- InfoSec policy, charter, RACI
- Risk-management framework alignment
- Asset & data classification review
Hands-on testing against the production estate — not a paper review.
- External + internal VAPT in CERT-In format
- Configuration & patch-management evidence
- Vulnerability backlog with CVSS 3.1 + remediation effort
Validating that CERT-In's 6-hour reporting rule actually fires.
- IR plan + playbook walk-through
- Detection-and-response capability assessment
- CERT-In incident-reporting drill
Vendor and cloud-provider exposure mapped end to end.
- Vendor security questionnaire & contract review
- Cloud-shared-responsibility evidence
- Critical SaaS dependency mapping
Submission-ready artefacts in the format CERT-In actually reads.
- CERT-In format executive + technical report
- Evidence vault keyed to control statements
- Remediation tracker + 30-day retest letter
What you keep running once the audit ships.
- SOC use-case backlog seeded from audit findings
- Quarterly self-attestation template
- Year-2 readiness roadmap
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a CERT-In Audit engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
CERT-In Audit — what compliance leads ask before signing.
RBI Cyber Security Framework Audit
End-to-end RBI CSF audit — control assessment, SAR drafting, inspector defence.
Learn moreSEBI CSCRF Audit
CSCRF audit for stock brokers, depository participants, AMCs.
Learn moreSEBI System Audit Report (SAR)
The half-yearly / annual SAR your stock broker or DP can submit on the first read.
Learn moreCERT-In Audit evidence starts with hands-on testing.
A clean CERT-In Audit report rests on real technical assurance. These Macksofy assessments generate the vulnerability, penetration and control-effectiveness evidence your auditor expects to see.
Penetration Testing
Find what attackers will. Before they do.
Explore serviceVulnerability Assessment & Penetration Testing (VAPT)
VAPT done properly — not a scan with a cover page.
Explore serviceWeb Application Security Testing
Test web apps the way attackers (and bug bounty hunters) do.
Explore serviceField notes from CERT-In Audit engagements.
CERT-In Empanelled Audit: The Complete Guide (2026)
Everything Indian organisations need to know about CERT-In empanelled audits in 2026 — what CERT-In empanelment means, who needs an empanelled audit, what it covers, the CERT-In Directions of 2022 (6-hour reporting, 180-day logs), the report format, timelines, cost drivers, how CERT-In compares to ISO 27001 and SOC 2, and how to verify a provider's empanelment.
Read article ComplianceCyber Security Companies in Mumbai & India (2026): The CERT-In Empanelled Audit Guide
A buyer's guide to choosing a cyber security company in Mumbai and across India in 2026 — why CERT-In empanelment is the single most important credential, how to verify it on the official CERT-In list, and how Macksofy Technologies delivers empanelled-grade VAPT and regulatory audits from Bandra Kurla Complex, Mumbai.
Read articleMacksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements