Do You Need a CERT-In Empanelled Auditor?
Buyers often ask whether a security test has to come from a firm on CERT-In's list. The honest answer is that it depends on who is asking for the test, and a few minutes of checking will tell you.
Buying guides · By Thimmagurudu Bathini · Published · 5 min read · Last reviewed
What is the CERT-In list?
CERT-In is India's national computer emergency response team. It publishes a public list of approved information security auditing organizations, often called the CERT-In panel. The list is revised from time to time, and a firm is either on it or not.
Who is usually told to use it?
The requirement comes from whoever sets the rules for your audit, not from the law of testing in general. It tends to appear in these places:
- Government departments and public-sector bodies, where tender documents or hosting rules often require an auditor from the CERT-In panel.
- Some regulated entities, where the regulator's circular says that an audit must be done by an auditor from the CERT-In panel.
- Customers that copy those rules into their own vendor requirements, even when no regulator asks them to.
The exact wording matters. A circular may require an auditor from the panel for one kind of audit and allow any qualified tester for another, so read the clause itself and not a summary of it.
Who is usually not told to?
Most private software companies are not. A startup answering a customer's security questionnaire, a team preparing for SOC 2 or ISO 27001, and a business that wants to know where it is exposed can all choose any competent tester. In those cases the report is evidence for your auditor or customer, and what counts is the scope, the quality of the testing and the report itself.
How do you find out which one applies to you?
- Find the document that asks for the test: the tender, the regulator's circular, the customer contract or the audit scope.
- Look in it for the words CERT-In, panel or approved auditor.
- If it is unclear, ask the party that set the requirement, in writing: which auditors does it accept for this test?
- Keep the answer with your audit file.
What if you do need one?
Then the test has to come from a firm that is on the current list, and you should check the list yourself on CERT-In's website, because firms join and leave it. A firm that is not on the list can still test your systems for your own assurance, but its report will not meet a requirement that names an auditor from the panel.
BERRY9 is not CERT-In empanelled and is not on the list. If a buyer's rules call for an auditor from the panel, we say so before any work is agreed and can introduce a firm that is on it. If they do not, the test is chosen on its scope and its report. The guide to choosing a VAPT company covers what else to check in a vendor.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana