Formally, “CERT-In certification” refers to a security audit or VAPT report issued by a CERT-In empanelled auditor. This blog explains the CERT-In certification process, the cost factors involved, and the role of CERT-In empanelled auditors. The goal is to help business leaders, CISOs, and IT managers understand what is required, what to expect, and how to plan compliance correctly.
CERT-In Certification Process in India
In India, many organizations are asked to provide a “CERT-In certification” as part of government projects, PSU tenders, regulatory or enterprise security requirements. CERT-In empanelled companies like Peneto Labs issue these reports after conducting successful security testing.
Thus, the CERT-In certification process refers to the steps an organization follows to obtain a security assessment report issued by a CERT-In empanelled auditor.
A. Identifying the Compliance or Contractual Requirement
The process begins by understanding why a Certificate or a security audit or a report by a CERT-In empanelled company is required. This requirement may come from a government department, regulator, PSU tender, customer contract, or internal security policy.
At this stage, the organization should identify:
- The authority or stakeholder requesting the report
- The type of assessment required (VAPT, security audit, or Safe to Host)
- Any timelines or submission deadlines
Clear identification of the requirement helps avoid unnecessary testing and ensures the assessment meets acceptance criteria.
B. Defining the Assessment Scope
Once the requirement is clear, the next step is to define what needs to be assessed. Scope definition is one of the most critical parts of the process.
This includes identifying:
- Applications (web, mobile, internal systems)
- Network components (firewalls, servers, IP ranges)
- Cloud environments and hosted services
- APIs and third-party integrations
- Supporting infrastructure
A well-defined scope ensures that all critical assets are covered and that the final report reflects the actual production environment.
C. Engaging a CERT-In Empanelled Auditor
Organizations must engage a CERT-In empanelled cybersecurity audit company to perform the assessment. Reports issued by non-empanelled firms may not be accepted by regulators or government bodies.
Before engagement, it is important to:
- Verify the auditor’s current empanelment status with CERT-In using CERT-In empanelled companies list
- Confirm that the auditor’s empanelment covers the required assessment type
- Agree on timelines, scope, and reporting format
This step ensures that the assessment outcome will be valid for compliance and submission.
D. Security Assessment Execution
After scope finalization, the auditor performs the VAPT security assessment. Depending on the requirement, this may include:
- Vulnerability Assessment to identify security weaknesses
- Penetration Testing to verify whether weaknesses can be exploited
- Configuration or architecture review to assess system setup and access controls
All testing is carried out within the agreed scope and rules of engagement to avoid disruption to business operations.
E. Reporting, Remediation, and Retesting
Once VAPT testing is completed, the auditor issues a detailed technical report that lists identified issues along with risk ratings and remediation guidance. The organization’s internal teams then work on fixing the reported issues. After remediation:
- The auditor performs retesting to confirm that vulnerabilities have been fixed
- Findings are updated based on retesting results
This phase is critical because unresolved or unverified issues may prevent acceptance of the final report.
F. Issuance of Final CERT-In Certificate
After successful retesting and validation, the auditor issues the final CERT-In Certificate. This document confirms:
- The assessment scope
- Testing performed
- Closure status of findings
- Overall assessment conclusion
Although commonly referred to as a “CERT-In certificate,” this report is issued by the CERT-In empanelled auditor, not by CERT-In itself. It is then used for compliance submission, audits, tenders, or regulatory review.
CERT-In Certification Cost in India
The CERT-In Certification Cost typically starts from around INR 50,000 and can increase based on the project’s scope and testing requirements. Below are the main factors that influence the CERT-In certification cost in India.
A. Assessment Scope and Complexity
The broader and more complex the scope, the higher the cost. Assessments that cover multiple applications, cloud environments, APIs, and supporting infrastructure require more effort than testing a single system. Complexity also increases when systems have multiple integrations or handle sensitive data.
B. Type of Testing Required
The cost varies depending on whether the requirement is for:
- Vulnerability Assessment and Penetration Testing (VAPT)
- A full security audit
- Retesting after remediation
Projects that require multiple testing phases or detailed audits generally cost more than basic assessments.
C. Size of Applications, Infrastructure, or Cloud Environment
Larger applications, wider IP ranges, multiple servers, or extensive cloud environments require additional testing time. The number of endpoints, users, and services directly affects the assessment effort and pricing.
D. Manual Testing Effort vs Automated Testing
Manual penetration testing requires skilled security professionals and more time compared to automated scanning. Assessments that rely heavily on manual testing are priced higher because they provide deeper validation and more accurate results.
E. Retesting and Validation Requirements
Many compliance requirements expect retesting after vulnerabilities are fixed. If extensive retesting is required across multiple systems, the overall cost may increase. Some CERT-In empanelled auditors include FREE retesting as part of the engagement, while others price it separately.
Important Note on CERT-In Fees
CERT-In does not charge any certification or audit fees. All costs are related to the security assessment services provided by CERT-In empanelled auditors, including testing, reporting, and retesting.
When Is CERT-In Certification Required in India?
CERT-In Certificate assessments support compliance with the Information Technology Act, 2000. The objective is to ensure that security testing follows approved national cybersecurity standards and is performed by authorized entities. CERT-In Certification is required in India in the following cases:
A. Government and Regulatory Requirements
Many government bodies and regulators require CERT-In certification on a periodic basis for Indian organizations, including MSMEs, that manage sensitive information, government-linked systems, or critical infrastructure. This is mandated for systems that handle sensitive data, provide public services, or connect with government platforms.
B. PSU Projects and Government Tenders
Public Sector Undertakings (PSUs) and government tenders frequently mandate submission of an audit or VAPT report by a CERT-In empanelled auditor as part of the eligibility or pre-go live process. These reports are used to confirm that applications, networks, or infrastructure meet expected security requirements before deployment or integration.
C. Enterprise and Customer-Mandated Security Compliance
Large enterprises and regulated customers may also require CERT-In Certificate reports from their vendors, service providers, or partners. In such cases, the requirement is contractual rather than regulatory.
Validity and Renewal of CERT-In Certification
CERT-In certification does not have permanent validity. The acceptance of an audit or VAPT report depends on time, system stability, and change management.
A. Typical Validity of Audit and VAPT Reports
Most CERT-In Certificates are considered valid for six months to one year, depending on the requesting authority, system criticality, and usage context. Some government projects or tenders may specify shorter validity periods.
B. When Reassessment Is Required?
Reassessment is usually required when:
- The report validity period expires
- A regulator, PSU, or customer requests an updated report
- There is a security incident affecting the assessed system
Using an expired VAPT report may result in rejection during audits or compliance reviews.
C. Impact of System Changes on Validity
Major changes can invalidate an existing CERT-In Certificate report even if it is still within its validity period. These changes include:
- New application releases or major feature updates
- Infrastructure or cloud architecture changes
- New integrations, APIs, or third-party services
- Changes in authentication or access control mechanisms
In such cases, a fresh assessment or limited reassessment is often required to ensure the report reflects the current system’s state.
Types of Assessments Commonly Called CERT-In Certification
In India, the term “CERT-In certification” is commonly used to describe different types of security assessments that differ in purpose, depth, and usage. The most common types of CERT-In Certificate are explained below:
A. Vulnerability Assessment and Penetration Testing (VAPT)
VAPT is the most frequently requested assessment under CERT-In compliance requirements. It focuses on identifying security weaknesses and verifying whether those weaknesses can be misused.
A Vulnerability Assessment identifies known security issues such as outdated software, misconfigurations, weak authentication, or exposed services. Penetration Testing then attempts controlled exploitation of selected vulnerabilities to confirm their impact.
VAPT reports are widely used for:
- Government and PSU project approvals
- Pre-production or go-live security checks
- Regulatory and customer security requirements
The final VAPT report issued by a CERT-In–empanelled auditor is commonly referred to as a “CERT-In VAPT certificate.”
B. Security Audit
A Security Audit provides a broader review of an organization’s security posture. In addition to technical testing, it may include reviews of system architecture, access controls, configurations, and security practices.
This type of assessment focuses on how systems are designed, deployed, and managed, rather than only testing for exploitable weaknesses. Security audits are often required where a deeper review of controls and processes is expected. Security audit reports are commonly used for:
- Regulatory compliance
- Internal governance and risk review
- Large government or enterprise systems
The audit outcome issued by a CERT-In–empanelled auditor is often called a “CERT-In audit certificate.”
C. Safe to Host Assessment
A Safe to Host assessment is conducted to determine whether an application or system is suitable for hosting or production use, particularly on government or regulated infrastructure.
This assessment typically includes security testing, configuration checks, and verification of basic compliance requirements. It is often requested before hosting applications on government data centers or integrating with official platforms.
The resulting document, commonly called a “Safe to Host certificate,” confirms that the system has been assessed and does not present unacceptable security risks at the time of review.
D. Compliance-Focused Security Reviews
Compliance-focused security reviews are performed to meet specific regulatory or contractual security requirements. These assessments may not involve deep penetration testing but focus on verifying adherence to defined rules, policies, and controls.
Such reviews may include checks related to:
- Regulatory security directions
- Logging and monitoring requirements
- Incident response readiness
- Access management and policy compliance
These assessments are often required by regulators, enterprises, or customers who need assurance that certain security conditions are met.
Get CERT-In Certificate from Peneto Labs
Peneto Labs has been empanelled by CERT-In to conduct information security auditing services. We help organizations like yours to obtain CERT-In Certificate and security audit reports hassle free. We support you across the full process from requirement analysis and scope definition to testing, remediation guidance, FREE retesting, and final report issuance.
If you need a CERT-In VAPT certificate, security audit report, or Safe to Host assessment for regulatory compliance, government tenders, or enterprise requirements, contact us today.
Conclusion
The CERT-In certification process in India involves engaging a CERT-In empanelled auditor to carry out security assessments such as VAPT or security audits, followed by reporting, remediation, and retesting. These VAPT reports are commonly required for regulatory compliance, government projects, PSU tenders, and enterprise security reviews. The cost of CERT-In certification depends on factors such as assessment scope, system size, type of testing required, and retesting needs.