TodayTools

CERT-In Empanelled Audits flashcards

How security audits by CERT-In listed auditors work in India.

Donate
Beginner friendly, starts from zero
Section
How to study
0
CERT-In Empanelled AuditsStart from zero · 1 of 12

What is a , in one plain sentence?

A security check-up of your website or app, done by an outside company that the Indian government has tested and put on an approved list.

Like a vehicle fitness test, but only at a garage the transport office has approved.

All topics

CERT-In Empanelled Audits at a glance

A CERT-In empanelled audit is a security check of your website, app or systems by an outside company the Indian government has approved.

It is like a vehicle fitness test: the test only counts if it is done at a garage on the approved list, and you get a certificate when you pass.

Words you will meet

CERT-In
India's national team for cyber attacks, which also keeps the approved auditor list
Empanelled
Tested and placed on an official approved list
Audit
A careful check of something against a set of rules
Scope
The exact list of websites, apps and systems that will be tested
Finding
One weakness the auditor found and wrote in the report
Tender
A public request from a buyer, often the government, inviting bids for work
Regulator
The body that sets rules for a sector, such as RBI for banks
Safe-to-Host
A certificate saying a government site passed its audit and may go live

The steps

  1. 1. Start from zero (12 cards): What an audit is, who CERT-In is, and the everyday words you need first.
  2. 2. Core basics (14 cards): What empanelment means, who needs it and what you get.
  3. 3. Next steps (15 cards): Choosing the auditor, preparing, and running the process.
  4. 4. Go deeper (15 cards): Validity, regulators, hosting rules and staying audit ready.
All 12 cards in Start from zero
What is a CERT-In empanelled audit, in one plain sentence?
A security check-up of your website or app, done by an outside company that the Indian government has tested and put on an approved list.
Why do these approved lists exist at all?
Without them, any company could say "our app is safe" and nobody could check. A tester on the approved list has itself been tested, so buyers can trust the report.
Where have you already met this without noticing?
When you file tax online, book a train ticket or log in to your bank app, the site behind it has usually passed such an audit before it went live.
What is CERT-In?
India's national team that responds to cyber attacks, part of the IT ministry (MeitY). It also keeps the approved list of security auditors.
What do audit, auditor and auditee mean?
An audit is a careful check against a set of rules. The auditor is the one who checks; the auditee is the organisation being checked.
What does empanelled mean?
Placed on an official panel, or list, after passing tests. An empanelled auditor is a company CERT-In has tested and listed on its website.
What are a server, a web app, a mobile app and an API?
A server is a computer that stays on and sends data to others. A web app runs in your browser, a mobile app on your phone, and an API is the hidden door apps use to ask a server for data.
What are a network and the cloud?
A network is the cables and Wi-Fi that join computers together. The cloud means computers you rent over the internet instead of keeping them in your own office.
What is a vulnerability, and what is a finding?
A vulnerability is a weakness an attacker could use, like a lock that opens with any key. A finding is one such weakness the auditor writes down in the report.
What do scope, tender, regulator and PSU mean?
Scope is the exact list of what gets tested. A tender is a public request for bids, a regulator makes rules for a sector (like RBI for banks), and a PSU is a government-owned company.
What do you need before starting this topic?
Nothing to install. Knowing roughly what a website and a phone app are is enough; every other word is explained as you go.
What will you be able to do after this topic?
Pick an approved auditor, plan the scope, prepare your team, fix findings and get the final report or certificate a tender or regulator asks for.
CERT-In Empanelled Audits cheatsheet

Audit types

  • Web app OWASP Top 10, ASVS
  • Mobile app OWASP MASVS, app plus its APIs
  • API Auth, limits, data exposure
  • Network Hosts, services, patches
  • Cloud IAM, storage, logs, encryption
  • Source code Manual and tool review
  • Wireless, IoT, OT Special scopes

Documents to prepare

  • Authorisation letter Signed permission to test
  • Scope form URLs, IPs, builds, roles
  • Test accounts One per role
  • API docs OpenAPI or Postman collection
  • Architecture Parts and data flow
  • NDA Protects you and the report
  • Allow-list Auditor IPs on WAF for the window

Typical timeline

  • Week 1 Scope, quote, documents, access
  • Week 1 to 2 First round testing
  • Week 2 First report
  • Week 2 to 4 Your fixes
  • Week 3 to 6 Re-test and certificate

Rules to know

  • Sec 70B IT Act CERT-In's legal power
  • 25 Jul 2025 Audit Policy Guidelines v1.0
  • Yearly Third party audit, plus after major change
  • GIGW / NIC Safe-to-Host before hosting
  • SEBI CSCRF Empanelled auditors for market entities
  • Directions 2022 6 hours, 180 days, NTP, POC

Before sign off

  • Critical, High Must be closed
  • Medium, Low Fix or written acceptance
  • Build version Matches what goes live
  • List check Auditor still empanelled
  • Storage Report encrypted, shared under NDA
Donate