India · CERT-In · Government · SEBI cyber audit
CERT-In empanelled VAPT audits, run end to end by Sumrite.
When a regulator, ministry or tender asks for a CERT-In empanelled audit, Sumrite scopes it, tests by hand, helps you fix and retests, and the formal audit is issued through our CERT-In empanelled partner. You deal with one team.
A CERT-In empanelled VAPT audit is a security audit carried out by an organisation on the list of information security auditors maintained by CERT-In, India’s national cyber security agency. It is required when a regulator, government department or contract names it, for example for government systems, government-hosted websites, SEBI’s cyber audit and many tenders. Sumrite runs the whole engagement and routes the formal audit through its CERT-In empanelled partner.
Who needs a CERT-In empanelled audit?
- Government and public sector systems: ministries, departments and PSUs before go-live and periodically after.
- Government-hosted websites: a security audit clearance before production hosting.
- SEBI regulated entities: the CSCRF cyber audit must be done by an auditor on CERT-In’s list.
- Tenders and contracts: when a bid or contract makes an empanelled audit report a condition.
For SOC 2, ISO 27001 or a customer’s vendor review, an empanelled auditor is not required; an independent expert-led VAPT report is enough.
What Sumrite delivers
| Deliverable | What it contains |
|---|---|
| Scope document | Every URL, API, build, version and IP range in scope, and the test dates |
| Audit report | Methodology, each finding with severity, evidence, impact and a specific fix |
| Retest record | The closure status of every finding after your fixes |
| Audit certificate or compliance letter | Issued through Sumrite’s CERT-In empanelled partner when your requirement asks for one |
| Management summary | A plain-language view for leadership and the requesting authority |
How the engagement runs
- Read the requirement. We confirm the exact wording: empanelled audit, audit as per CERT-In guidelines, or a security audit clearance certificate.
- Scope and NDA. The system that will actually go live is listed in full, and an NDA is signed first.
- Expert-led testing. Manual testing of authentication, access control, input handling, business logic and configuration, following CERT-In’s audit guidelines.
- Fix and retest. Findings are fixed with our guidance, then retested, because many certificates are issued only once high and critical issues are closed.
- Formal audit issued. The report and certificate come through Sumrite’s CERT-In empanelled partner, matched to the scope tested.
Frequently asked questions
What is a CERT-In empanelled auditor?
An information security auditing organisation that CERT-In has evaluated and placed on its published panel. CERT-In maintains the list; you choose a firm from it, and the report is issued in that firm’s name.
Does CERT-In certify my company?
No. CERT-In does not certify organisations through empanelment. The empanelled auditor performs the audit and issues the report and, where requested, an audit certificate or compliance letter.
Can Sumrite deliver a CERT-In empanelled audit?
Yes. Sumrite runs scoping, testing, remediation support and the retest, and routes the formal audit through its CERT-In empanelled partner, so you deal with one team from start to finish.
How often is a CERT-In audit needed?
CERT-In’s audit guidelines call for audits at least once a year and after major changes. Your regulator, sector rules or contract may set a different frequency; follow whichever is stricter.
Related
Have a CERT-In audit deadline?
Send the requirement and the go-live date. We will scope it, test, help you fix and deliver the audit.