When You Need a CERT-In Empanelled Auditor
Some buyers in India may hire only from CERT-In's list of empanelled auditing organizations, and many are never asked to. Which applies to you is decided by the document that asks for the test, not by the kind of testing you want. This page sets out who is usually told to use the list, how to check your own requirement, and what to do in either case. BERRY9 is not on that list, and says so before any work is agreed.
- Decided by
- Who asks for the test
- Usually required for
- SEBI, government, some tenders
- Usually not for
- SOC 2, ISO 27001, customers
- BERRY9 status
- Not on the list
Last reviewed
In Short
- What it is
- A plain answer to whether your test has to come from an organization on CERT-In's list of empanelled auditors, and how to check that for yourself in the document that asks for the test.
- Who needs it
- Anyone in India holding a tender clause, a regulator's circular or a customer contract that mentions CERT-In, and anyone who has been told they need an empanelled auditor without being shown the rule.
- What you get
- A table of who is usually told to use the list, a five-step check on your own document, and a plain statement that BERRY9 is not on it.
01 / Who Is Asking
Who Is Usually Told to Use CERT-In's List
The condition travels with the person asking for the test, not with the test itself. The same web application assessment can be subject to it for one buyer and not for another, which is why the question is always who asked and under what rule.
| Who is asking | What such a requirement usually says | Can BERRY9 run it? |
|---|---|---|
| A SEBI-regulated entity: a broker, a depository participant, a fund house | SEBI's 2024 cybersecurity and cyber resilience framework expects the firms it covers to draw both their cyber audit and their VAPT from auditors on CERT-In's list. | No. |
| A government department, or anything hosted on government infrastructure | Hosting and go-live rules in this space commonly ask for a security audit signed off by an auditor from the list before an application is allowed to serve the public. | No. |
| A public tender or a public-sector contract | It depends entirely on the document in front of you. Some eligibility clauses name the list; others ask only for an independent tester with stated experience. | Only where the document does not name the list. |
| A bank, a non-bank lender, a payment firm or an insurer | The RBI's IT governance direction expects banks and the larger lenders it covers to run vulnerability assessment and penetration testing periodically, with trained and independent testers. Your board policy, a payment scheme rule or your own regulator's guidance may then add the panel condition on top of that. | Sometimes. Put the question to your compliance team in writing first. |
| A private company answering a customer, or preparing for PCI DSS, TPN, HIPAA, SOC 2 or ISO/IEC 27001 | Not one of them asks you to use the list. A single customer contract still might, so read its security clause before you assume anything. | Yes. |
BERRY9 is not on CERT-In's list of empanelled auditing organizations. Where your rule names the list, we say so at scoping and point you to a firm that is on it, before you have paid anything.
02 / Check Your Document
How to Check Your Own Requirement in Five Steps
This takes about ten minutes and settles the question properly, which reading a vendor's blog post about it does not.
Step 1
Find the Document That Asks for the Test
The tender, the regulator's circular, the customer contract or the audit scope. Not a summary of it, not an email about it, and not a vendor's description of it.
OutputOne document, with a date
Step 2
Search It for Three Words
Look for CERT-In, for panel, and for whether the word empanelled appears at all. If none of the three is in the clause that asks for the test, the condition probably is not either.
OutputThe clause itself, quoted
Step 3
Read the Clause, Not the Heading
A circular can name the list for one kind of audit and accept any qualified tester for another. The scope of the sentence matters more than the title of the section it sits under.
OutputWhich tests the condition covers
Step 4
Ask the Party That Set the Rule, in Writing
Where the wording is genuinely unclear, ask whoever wrote it which auditors they accept for this test. Their written answer settles it, and nobody else's does.
OutputA reply you can file
Step 5
Keep the Answer with the Audit File
The next test will raise the same question, often with a different person asking it. The quoted clause and the reply save that work twice over.
OutputA record for the next cycle
03 / The 2022 Directions
What the April 2022 CERT-In Directions Actually Require
These are regularly quoted as though they required a penetration test from a firm on the list. They do neither.
The CERT-In directions issued in April 2022 are the thing most often confused with the panel, and they are a separate matter. They apply broadly to organizations operating in India, and they deal with how you behave when something goes wrong rather than with who is allowed to test you.
Report Incidents Quickly
Certain categories of cyber incident are to be reported to CERT-In within six hours of being noticed or brought to your attention.
Keep Logs, in India
Logs of ICT systems are to be kept for a stated period and maintained within the country, so they can be produced when asked for.
Synchronize Your Clocks
System clocks are to be synchronized to a named national time source, so that logs from different systems can be lined up.
Name a Point of Contact
An organization is expected to have someone CERT-In can reach about incidents, and to keep those details current.
None of that orders a penetration test, and none of it says who may carry one out. A firm that cites the 2022 directions as the reason you must hire from the list is conflating two separate things. Empanelment matters when a rule in your own case names CERT-In's list; the directions matter whether or not it does.
04 / If the List Is Named
If Your Rule Does Name CERT-In's List
Then the shortlist is settled before anything else about the vendor matters, and there is no way to argue around it.
If the document does name the list, the position is simple and it is not negotiable: the audit has to come from an organization on CERT-In's current list, and a report from anyone else will not satisfy that clause however good the testing was.
- Check the list yourself, on <a href="https://www.cert-in.org.in/" rel="noopener">CERT-In's own website</a>. Organizations join it and leave it, and a firm's own description of itself is not evidence that it is on it today.
- Ask the firm for the name under which it appears on the list. A place on it belongs to a named organization, not to an individual tester or a brand.
- Confirm that the empanelment covers the kind of audit you need, and that it is current on the date the work will be done.
- Agree who signs the report, because the clause usually cares about the signatory as much as about the testing.
BERRY9 does not appear on that list and will not pretend otherwise. Where your rule names it, tell us at scoping: we will say so plainly and point you toward a firm that is on it, rather than take work that cannot meet your requirement. That costs us the engagement and saves you a failed audit, which is the right way round.
There is one thing worth separating. A requirement that names the list governs the audit that satisfies the rule. It does not stop you from commissioning your own testing as well, for your own assurance, before the formal audit happens. Plenty of teams do exactly that, and find the expensive problems in private first.
05 / If It Is Not Named
If It Does Not: What Decides the Test Instead
This is where most private buyers in India actually sit, and where the usual questions about scope, method and reporting take over.
Most private software companies in India never meet this condition. A startup answering a customer's security questionnaire, a team preparing for SOC 2 or ISO 27001, a product company that simply wants to know where it is exposed: all of them can choose any competent tester, and the choice turns on other things entirely.
What Is Actually in Scope
Written down before the work starts, as applications, roles, endpoints, hosts and environments, rather than as the phrase complete VAPT.
How Much Is Done by Hand
A scanner finds the known. Access control between two customers, and logic that breaks when requests arrive in an unexpected order, are found by a person looking for them.
What the Report Looks Like
Ask to see a sample before you sign. A finding your developers cannot reproduce from the report is a finding they will not fix.
What Happens After the Fixes
Whether a retest is included, how long you have to use it, and whether each finding is then marked closed or left open in writing.
The buyer guide to picking a testing firm works through those in full, with the questions to put to any firm and the answers that should worry you. The VAPT cost guide explains what moves a price, and the methodology page and the sample report show what we do and what you would receive.
06 / Our Own Status
Where BERRY9 Stands on the CERT-In List
Stated here so that you do not have to ask for it, and so that nobody discovers it late.
BERRY9 IT SERVICES PRIVATE LIMITED is a penetration testing firm in Hyderabad, founded in 2015, and it is not a CERT-In empanelled auditing organization. We publish that here rather than leaving you to discover it halfway through a procurement.
- Where a regulator, a tender or a contract in your case names CERT-In's list, we say so before any work is agreed, and we would rather introduce you to a firm on the list than waste your cycle.
- Where no such condition applies, we run the test and write the report, and it is judged on the scope, the manual effort and whether your developers can fix from it.
- Where the work is evidence for PCI DSS, TPN, HIPAA, the DPDP Act, SOC 2 or ISO/IEC 27001, or for a customer security review, no panel condition arises from the framework itself.
- We hold ISO/IEC 27001:2022 and ISO 9001:2015 certificates for our own management systems. Those are certificates about how BERRY9 runs, not a substitute for empanelment and not a statement about your systems.
If you are still unsure which case you are in, send us the clause. Reading it with you costs nothing and takes a few minutes, and it is a better use of a first conversation than a proposal for work that might not qualify.
07 / FAQ
Frequently Asked Questions
Short answers about scope, price and how penetration testing works. For anything else, call +91 78425 18484.
Does BERRY9 appear on CERT-In's list?
No, it does not. BERRY9 holds no place on that list of empanelled auditing organizations. Where a regulator, a tender or a contract in your own case names that list, we say so at scoping and point you to a firm that is on it. Where no such condition applies, we run the test ourselves. See the section on Where BERRY9 stands on the CERT-In list above.
Do I need a CERT-In empanelled auditor for my VAPT?
Only if the document asking for the test says so. SEBI-regulated entities and government hosting are usually told to use the list, some public tenders are, and most private companies answering customers or preparing for SOC 2 or ISO 27001 are not. Read the clause that asks for the test and check whether it uses the word empanelled at all. See the section on Who is usually told to use CERT-In's list above.
How do I check whether a firm is on CERT-In's list?
Search the list published on CERT-In's own website, and look for the exact name of the organization that will sign your report. Organizations join the list and leave it, so a firm's own description of itself is not evidence of its position today, and a certificate from a previous cycle is not either. See the section on If your rule does name CERT-In's list above.
Do the CERT-In directions of April 2022 require a penetration test?
No. Those directions deal with reporting certain cyber incidents within six hours, keeping ICT logs for a stated period within India, synchronizing system clocks to a national time source, and keeping a point of contact current. They do not order a penetration test and they do not say who may carry one out. See the section on What the April 2022 CERT-In directions actually require above.
Does SOC 2 or ISO 27001 require a CERT-In empanelled auditor?
Neither framework asks for one. Your SOC 2 auditor judges whether the evidence meets the criteria, and ISO/IEC 27001 asks you to manage technical vulnerabilities without saying whose hands must do the testing. The panel condition turns up only where your own regulator, tender or customer contract puts it there. See the section on If it does not: what decides the test instead above.
Can a firm that is not on the list still test my systems?
Yes, for your own assurance, and many organizations commission exactly that before a formal audit so the expensive problems surface in private first. What such a report cannot do is satisfy a clause that names CERT-In's list; that audit has to come from an organization on it. See the section on If your rule does name CERT-In's list above.
What should I do if the requirement is ambiguous?
Ask the party that set it, in writing, which auditors they accept for this test, and keep their reply with your audit file. A written answer from whoever wrote the rule settles the question; an opinion from a vendor who wants the work does not. See the section on How to check your own requirement in five steps above.
Is CERT-In empanelment a measure of testing quality?
It is a measure of eligibility, not of merit. The list says an organization met CERT-In's criteria for selection; it is not an order of ranking and it does not describe how much of a given test will be done by hand. Where you are free to choose, judge the scope, the manual effort, the testers and the report. See the section on If it does not: what decides the test instead above.
Plan Your Next Security Test
Tell us what needs penetration testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 78425 18484
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana