Blogs, Frameworks & Regulations

CERT-In Empanelled Auditors List 2026: How to Find and Verify an Approved Auditor

By CyRAACS Team
September 18, 2026

A vendor displaying a CERT-In badge on its website does not automatically prove that the firm is currently empanelled. Before appointing an auditor, organisations should verify the firm’s legal name, current listing, and approved audit capabilities directly against the official CERT-In list.

CERT-In stands for the Indian Computer Emergency Response Team. It has been operational since January 2004 and works under the Ministry of Electronics and Information Technology (MeitY) as India’s national agency for responding to cybersecurity incidents. Its role includes coordinating incident response, issuing security advisories, and helping strengthen cybersecurity across India’s digital ecosystem.

This matters because CERT-In empanelment is not a blanket approval for every type of cybersecurity audit. CERT-In maintains an official list of empanelled Information Security Auditing Organisations and updates it as needed. The list also provides information about an organisation’s audit capabilities and technical competence.

What Does CERT-In Empanelment Mean?

CERT-In, under the Ministry of Electronics and Information Technology (MeitY), empanels Information Security Auditing Organisations to conduct information security audits. CERT-In also provides guidelines for conducting cybersecurity audits and monitors the performance of empanelled organisations.

Empanelment should not be treated as a permanent or unlimited approval. More importantly, each organisation’s capability can differ by audit category. The current CERT-In list includes categories such as:

Network security audits
Web application security audits
Wireless security audits
Cloud security audits
Compliance audits
Finance sector audits
ICS/OT audits

Therefore, being listed by CERT-In is only the first check. You should also confirm whether the auditor is empanelled for the specific audit you need.

Where to Find the Official CERT-In Empanelled Auditors List

The safest source is the official CERT-In empanelled Information Security Auditing Organisations list.

The current document describes itself as the up-to-date, valid list and states that it is updated when there is a change. It also includes organisation details and, for empanelled organisations, information about their skills, audit capabilities, technical manpower, and audit experience.

Do not rely only on:

A vendor’s website or CERT-In badge.
An old PDF shared by a consultant or procurement team.
A screenshot of an earlier CERT-In listing.
A third-party directory of cybersecurity companies.

Always verify the organisation against the current CERT-In source before finalising the engagement.

How to Verify a CERT-In Empanelled Auditor

Use the following checks before selecting an auditor:

1. Check the Exact Legal Name

Search for the organisation’s registered name in the current CERT-In list.

Do not rely only on the brand name shown on the vendor’s website. The legal entity mentioned in your purchase order or contract should match the organisation listed by CERT-In.

2. Check the Required Audit Category

Do not stop after finding the organisation’s name.

Check whether the firm has the capability for the specific audit you require, such as network security, web application security, cloud security, compliance, or finance-sector audits.

For example, the current CERT-In snapshot for CYyRAAC Services Private Limited lists capabilities in network security, web application security, wireless security, compliance audits, finance-sector audits, cloud security, configuration review, secure code review, and phishing assessment. 3. Review the Organisation’s Competence Details

CERT-In’s current list provides more than just the organisation’s name. Its competence snapshots can include audit experience, categories covered, technical manpower, certifications, and previous audit activity.

Use this information to check whether the firm’s experience matches your actual requirement.

For example, if you need a finance-sector audit, look for relevant experience rather than selecting a firm only because CERT-In lists it.

4. Verify the Listing Before Signing

Take a fresh copy of the current CERT-In list when you begin procurement.

This is especially important if you plan the engagement months in advance. Keep a dated copy of the verification in your vendor or audit records.

5. Confirm Regulatory Requirements Separately

CERT-In empanelment does not automatically mean that an audit will meet every regulatory requirement.

Your organisation should first confirm what the relevant regulator requires and then select an auditor whose empanelment and audit scope match that requirement.

For example, SEBI’s CSCRF requires regulated entities to engage CERT-In empanelled Information Security Auditing Organisations for applicable external audits.

RBI requirements also refer to CERT-In empanelled auditors in several regulated contexts. For example, RBI has required certain UCBs to conduct cybersecurity gap assessments through CERT-In-empanelled auditors, and its payment-system requirements have recognised CERT-In-empanelled auditors for system audits.

Red Flags to Watch Before Selecting an Auditor

Be careful if:

The vendor claims CERT-In empanelment but cannot be found in the current official list.
The legal entity name does not match the CERT-In listing.
The firm is listed but does not cover the audit category you require.
The vendor relies only on an old CERT-In certificate or website badge.
The vendor cannot clearly explain how its proposed audit scope matches your regulatory requirement.
The vendor outsources important audit work without clearly explaining who will perform the assessment.

Treat a CERT-In listing as a verification point, not the only factor in auditor selection.

Why CERT-In Auditor Verification Matters

Choosing the wrong auditor can create more than a procurement issue. If an audit does not meet the applicable regulatory requirement, your organisation may need to repeat the assessment, address the issue under a tight deadline, or explain the gap during a regulatory review.

CERT-In itself has issued guidance stressing the importance of clear audit scope, comprehensive assessment, evidence-based findings, and alignment with applicable regulatory requirements. Its 2025 Comprehensive Cyber Security Audit Policy Guidelines also provide a structured approach for both audited organisations and auditing organisations.

A simple verification of the current CERT-In listing and the auditor’s specific capabilities can therefore prevent avoidable compliance and audit risks.

How We Can Help With CERT-In Audits

If you need help selecting or engaging a CERT-In empanelled auditor, our team can help you understand the required audit scope and align it with your regulatory obligations.

We can help with:

CERT-In information security audits.
Network and web application security audits.
Cloud security assessments.
Compliance audits.
Finance-sector security audits.
VAPT and technical security assessments.
Regulatory audit and compliance requirements.

Our audit services help organisations assess security controls, identify gaps, and prepare for regulatory and compliance requirements. We are also CERT-In empanelled for Information Security Auditing.

CyRAACS and CERT-In Empanelment

CYyRAAC Services Private Limited is listed in the current CERT-In empanelled Information Security Auditing Organisations register. The current CERT-In competence snapshot states that the organisation has been conducting information security audits since 2017 and lists capabilities across network security, web application security, wireless security, compliance, finance-sector audits, and cloud security.

The same CERT-In snapshot records 200+ information security audits in the previous 12 months and 50+ technical personnel, along with certifications including CISSP, CISA, CISM, OSCP, CEH, CCSP, and other security qualifications.

If you are preparing for an RBI, SEBI, or other regulatory audit, our technical security services team can help you define the right scope and identify the security assessments required for your organisation.

Conclusion

Verifying a CERT-In empanelled auditor should take more than checking a badge on a vendor’s website. Start with the current official CERT-In list, confirm the exact legal entity, check the required audit category, review the firm’s relevant capabilities, and confirm that the engagement meets your regulator’s requirements.

This simple process can help you avoid choosing an auditor whose listing, scope, or capabilities do not match your actual requirements. It also gives your procurement and compliance teams clear evidence that you verified the auditor before the engagement began.

FAQs

1. What is a CERT-In empanelled auditor?

A CERT-In empanelled auditor is an Information Security Auditing Organisation approved by CERT-In to conduct specified cybersecurity audits. Empanelment applies to defined audit capabilities, not every type of security audit.

2. Where can I find the official CERT-In empanelled auditors list?

You can find the current list on the official CERT-In website. Always check the latest list rather than relying on an old PDF, screenshot, or vendor website.

3. Does CERT-In empanelment cover all types of cybersecurity audits?

No. Empanelled organisations can have different audit capabilities, such as network security, web application, cloud, compliance, finance-sector, or ICS/OT audits. You should confirm that the auditor’s approved capability matches your requirement.

4. Can a CERT-In empanelled auditor lose its empanelment?

Yes. CERT-In continuously assesses the performance of empanelled auditing organisations, and organisations that do not meet the required criteria can be de-empanelled.