CERT-In Audit and India Cyber Compliance Guides
Guides for CERT-In empanelled audits and India cyber compliance, covering auditor selection, VAPT evidence, audit policy, RBI, SEBI and sector-specific readiness.
What is a CERT-In empanelled audit?
A CERT-In empanelled audit is a security assessment delivered under the governance of an auditing organisation currently listed by CERT-In. The exact technical scope and report depend on the relying regulator or customer. This hub helps buyers verify eligibility, define evidence, compare providers and prepare for India-specific compliance reviews.
Start with the party that will rely on the report. A regulator, bank, tender, certification body and enterprise customer may each expect a different scope, cadence and closure artifact even when all use the phrase CERT-In audit. The provider must translate that requirement into testable assets, controls and evidence.
This cluster covers the official empanelment process, audit-provider selection, security-audit policy, VAPT versus management-system assurance, and practical readiness for RBI, SEBI and telecom obligations. Official sources are linked from each article so current status and requirements can be verified directly.
- Verify current provider status against the official CERT-In panel
- Translate regulator language into technical scope and evidence
- Compare audit providers on delivery depth, independence and closure terms
- Prepare VAPT, governance, SOC and incident evidence before fieldwork
Continue through the topic.
The CERT-In Empanelment Process (2026): How an Auditing Organisation Actually Gets on the Panel
A step-by-step walkthrough of how CERT-In empanels information security auditing organisations in India — the single three-month application window each year, the eligibility bar, the documentation round, the offline and online practical skill tests and their 90% pass threshold, the Personal Interaction Session, government background verification, what it costs, how long the whole cycle takes, and what an organisation has to keep doing to stay on the panel.
CERT-In Empanelled Audit: The Complete Guide (2026)
Everything Indian organisations need to know about CERT-In empanelled audits in 2026 — what CERT-In empanelment means, who needs an empanelled audit, what it covers, the CERT-In Directions of 2022 (6-hour reporting, 180-day logs), the report format, timelines, cost drivers, how CERT-In compares to ISO 27001 and SOC 2, and how to verify a provider's empanelment.
CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (2025): What Every CISO and Auditee Must Know
CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (Version 1.0, 25 July 2025) rewrite how empanelled audits are scoped, scored and reported in India. Download the official PDF and read our section-by-section analysis of what changes for auditees and auditors.
CERT-In Empanelled VAPT vs ISO 27001 in 2026 — What Each Actually Proves
CERT-In empanelled VAPT vs ISO 27001 — clear 2026 explainer on audit vs certification, what each one proves, where they complement, and which to buy first.
Cyber Security Companies in Mumbai & India (2026): The CERT-In Empanelled Audit Guide
A buyer's guide to choosing a cyber security company in Mumbai and across India in 2026 — why CERT-In empanelment is the single most important credential, how to verify it on the official CERT-In list, and how Macksofy Technologies delivers empanelled-grade VAPT and regulatory audits from Bandra Kurla Complex, Mumbai.
RBI CSF vs SEBI CSCRF in 2026 — Which Framework Applies to You?
RBI Cyber Security Framework vs SEBI CSCRF — clause-by-clause 2026 guide for Indian BFSI, including dual-regulated broker-dealers, NBFCs and bank-owned AMCs.
RBI IT-Governance Master Direction — A 2026 Readiness Checklist for Banks & NBFCs
The RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices is in force from April 2024. Here is a practical, chapter-by-chapter readiness checklist — ITSC, CISO line, patch and change controls, BCP/DR and IS Audit — for the next supervisory cycle.
SEBI CSCRF — A 2026 Compliance Readiness Guide for Regulated Entities
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) is now in force across all Regulated Entities after a phased 2025 rollout. A practical readiness guide to the graded model, the Cyber Capability Index, the SOC mandate, VAPT/SBOM and audit evidence — for MIIs, brokers, AMCs and other REs.
Telecom Cyber Security Rules 2024: What India's Telecom Entities Must Do
India's Telecom Cyber Security Rules, 2024 put a six-hour incident-reporting clock, a mandatory Chief Telecommunication Security Officer, and standing SOC and testing duties on every telecom entity. Who must comply, the timelines, and the compliance checklist.
Read the engagement records behind the guidance.
Each anonymised record shows the original scope, execution phases, material findings, reported outcomes and metrics without disclosing the client identity.
Chained BOLA + JWT alg=none in a listed fintech — full PII access surfaced and remediated before the next regulator filing
A BSE-listed digital lending platform asked Macksofy for a full-scope pentest ahead of a SEBI CSCRF audit. Within four days the team chained an authorization-bypass with a forged JWT to reach every customer's KYC and balance — fixed pre-filing.
NoPac chained with Kerberoasting reached Domain Admin in 4 hours inside a BFSI MNC's internal AD
A multinational BFSI's Indian arm asked Macksofy for an assumed-breach internal pentest of its AD + Citrix estate. From a single low-privilege user, the team chained NoPac (CVE-2021-42278) with a Kerberoastable service account to reach Domain Admin in four hours.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC
- Thousands of professionals trained
- India + UAE engagements