Do you need CERT-In empanelled VAPT?

When RBI, SEBI, IRDAI or government work requires CERT-In empanelment — and when a rigorous manual pentest is enough for SaaS and SOC 2-style evidence. How to verify the official list. No false empanelment claims.

Ask about your situation →Official CERT-In empanelment PDF

Short answer

Sometimes yes, often no. CERT-In empanelment is a procurement and regulatory construct for specific Indian contexts. It is not a universal requirement for every company that wants a penetration test, and it is not by itself a guarantee of testing depth. If your contract, regulator circular, or government tender explicitly requires an empanelled information security auditing organisation, you must use a firm that appears on the current official list under the correct legal entity name. If you are a SaaS or product company seeking high-quality offensive testing for customers, investors or ISO/SOC evidence, a capable specialist who is not empanelled may still be the right technical choice — provided your stakeholders do not mandate empanelment.

When buyers typically require it

Certain government and public-sector tenders that cite CERT-In empanelled auditors
Some regulated financial-sector assurance programmes where policy or customer contracts point to empanelled organisations (commonly discussed alongside RBI / SEBI / IRDAI expectations — always read the controlling circular or contract, not a vendor blog)
Enterprise questionnaires that explicitly ask “Is the testing firm CERT-In empanelled?” as a yes/no gate

PoCForge does not claim CERT-In empanelment on this page. If you need that checkbox, use the official PDF to shortlist vendors who appear on it.

When rigorous non-empanelled testing is usually enough

Product security for SaaS/startups preparing customer security reviews
Engineering-led risk reduction before major releases
Evidence of penetration testing for many SOC 2 / ISO 27001 control narratives (confirm with your auditor — auditors care about scope, competence and report quality)
International buyers who never ask about CERT-In

In these cases, evaluate methodology, sample report quality, retest policy and people — not only accreditation lists. See VAPT services India and penetration testing company India.

Decision checklist

Step 1 Does a written contract, tender or regulator instruction explicitly require a CERT-In empanelled organisation?
Step 2 If yes — open the current official PDF, find the vendor’s legal name, and proceed only with listed entities.
Step 3 If no — shortlist based on scope fit, manual testing depth, reporting and price transparency (our 2026 cost guide).
Step 4 Either way — demand a statement of work that names assets, environments, roles and retest terms.

More detail

What CERT-In empanelment is

The Indian Computer Emergency Response Team (CERT-In) publishes a list of empanelled information security auditing organisations. The authoritative document is the official PDF hosted on CERT-In’s website: Empanel_org.pdf (always download the current file; lists change). Empanelment indicates that an organisation has been accepted onto that programme under CERT-In’s criteria at the time of listing — it does not automatically mean every marketing claim you see in search ads is accurate. Verify the PDF yourself and match the contracting legal name.

RBI, SEBI, IRDAI, DPDP — keep the layers straight

These are distinct regimes. A penetration test report is one evidence artefact among many. Data protection obligations under India’s DPDP framework, sectoral IT/security circulars, and CERT-In directions (including incident reporting obligations for certain entities) are separate topics. Do not assume that “we did VAPT” equals “we are compliant” with any named regulator. Use counsel and your compliance team for legal interpretation; use offensive testing to reduce technical risk and produce clear findings.

How PoCForge positions itself

We compete as a transparent, human-led boutique for modern product teams. If you discover you need an empanelled firm, we would rather tell you early than waste your procurement cycle. If you need serious web/API/cloud/external testing with published INR ranges and a remediation retest, contact us.

Frequently asked questions

Is PoCForge CERT-In empanelled?

Do not treat this website as an empanelment certificate. Check the current official CERT-In Empanel_org.pdf and match legal entity names. We avoid false claims.

Can SOC 2 accept a non-empanelled pentest?

Many auditors accept penetration tests from competent independent providers when scope and report quality are adequate. Confirm with your auditor; requirements vary.

Where is the official list?

CERT-In hosts the empanelled organisations PDF at cert-in.org.in — direct file: https://www.cert-in.org.in/PDF/Empanel_org.pdf

What if my customer insists on CERT-In but my risk is mostly SaaS app logic?

You may need an empanelled firm for the contractual checkbox, or a split approach. We can help you articulate scope either way — without misrepresenting status.