India · CERT-In · Government · SEBI cyber audit
CERT-In empanelled VAPT audits, run end to end by Sumrite.
When a regulator, ministry or tender asks for a CERT-In empanelled audit, Sumrite scopes it, tests by hand, helps you fix and retests, and the formal audit is issued through our CERT-In empanelled partner. You deal with one team.
A CERT-In empanelled VAPT audit is a security audit carried out by an organisation on the list of information security auditors maintained by CERT-In, India’s national cyber security agency. It is required when a regulator, government department or contract names it, for example for government systems, government-hosted websites, SEBI’s cyber audit and many tenders. Sumrite runs the whole engagement and routes the formal audit through its CERT-In empanelled partner.
Who needs it
| Who | When it applies |
|---|---|
| Government and public sector systems | Ministries, departments and PSUs before go-live and periodically after |
| Government-hosted websites | A security audit clearance before production hosting |
| SEBI regulated entities | The CSCRF cyber audit must be done by an auditor on CERT-In’s list |
| Tenders and contracts | When a bid or contract makes an empanelled audit report a condition |
How Sumrite delivers it
Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.
- Read the requirement. We confirm the exact wording: empanelled audit, audit as per CERT-In guidelines, or a security audit clearance certificate.
- Scope and NDA. The system that will actually go live is listed in full, and an NDA is signed first.
- Expert-led testing. Manual testing of authentication, access control, input handling, business logic and configuration, following CERT-In’s audit guidelines.
- Fix and retest. Findings are fixed with our guidance, then retested, because many certificates are issued only once high and critical issues are closed.
- Formal audit issued. The report and certificate come through Sumrite’s CERT-In empanelled partner, matched to the scope tested.
What you receive
| Deliverable | What it contains |
|---|---|
| Scope document | Every URL, API, build, version and IP range in scope, and the test dates |
| Audit report | Methodology, each finding with severity, evidence, impact and a specific fix |
| Retest record | The closure status of every finding after your fixes |
| Audit certificate or compliance letter | Issued through Sumrite’s CERT-In empanelled partner when your requirement asks for one |
Frequently asked questions
What is a CERT-In empanelled auditor?
An information security auditing organisation that CERT-In has evaluated and placed on its published panel. CERT-In maintains the list; the report is issued in that firm’s name.
Does CERT-In certify my company?
No. CERT-In does not certify organisations through empanelment. The empanelled auditor performs the audit and issues the report and, where requested, an audit certificate or compliance letter.
Can Sumrite deliver a CERT-In empanelled audit?
Yes. Sumrite runs scoping, testing, remediation support and the retest, and routes the formal audit through its CERT-In empanelled partner, so you deal with one team from start to finish.
How often is a CERT-In audit needed?
CERT-In’s audit guidelines call for audits at least once a year and after major changes. Your regulator, sector rules or contract may set a different frequency; follow whichever is stricter.
Accredited testing
Need a test a regulator or buyer will accept?
Send the requirement and the deadline. NDA first, fixed-scope quote, one team end to end.