CERT-In empanelled auditing organisation
Security audits and safe-to-host certificates
Web application, infrastructure and safe-to-host audits to CERT-In guidelines, with re-testing until findings are closed and a certificate anyone can verify.
- Empanelment
- CERT-In
- Testing
- Manual and automated
- Certificates
- QR verified
Accredited and empanelled
Independent testing to CERT-In guidelines
Government departments, regulators and large customers often require security audits to be carried out by an organisation empanelled by CERT-In, India’s national computer emergency response team. Our empanelment, and how to check it, is on our accreditation page.
Our auditors combine automated scanning with manual testing of business logic, authentication and access control. Findings are reported with evidence and severity, re-tested after your team fixes them, and closed out in a final report and certificate.
All security audits
Web application security audit as per CERT-In guidelines
Safe-to-host certificate
A security audit to CERT-In guidelines, ending in a certificate tied to the exact build you will host.
Safe to Host
Web application security audit
Testing of your web application against OWASP guidance, with a certificate that names the URLs, dates and build covered.
Information security audit as per CERT-In guidelines
IT security audit
An information security audit to CERT-In guidelines covering the systems you name, closed with a dated audit certificate.
VAPT
VAPT
Vulnerability scanning followed by hands-on exploitation, so you know which weaknesses an attacker could use.
Privacy & personal data protection
Data protection compliance
An independent check of how your organisation collects, uses, protects and deletes personal data.
How a security audit runs
From scoping to the final certificate, every audit follows the same steps.
01
Scoping
We agree the applications, URLs, APIs, networks or assets in scope, the test environment and the rules of engagement.
02
Testing
Auditors test against CERT-In guidelines and recognised methods such as the OWASP Testing Guide, using automated tools and manual techniques.
03
Findings report
Each finding comes with its severity, evidence and the risk it poses. Your team fixes them in the audited environment.
04
Re-testing
We re-test until findings are closed or formally accepted, and record the version that was finally audited.
05
Certificate and report
The final report and certificate are issued, and the certificate is listed in the public register with a QR code for verification.
Frequently asked questions
We audit; we do not consult.
To keep audits independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Get a fixed quote
Tell us what you need certified or audited, where and when. We reply with an audit plan and a fixed price.