How to Check an Auditor Is Really CERT-In Empanelled

A great many Indian security firms describe themselves as CERT-In empanelled. It is a claim worth checking, because it is checkable: the Indian Computer Emergency Response Team publishes the list, and the list is the only thing that settles it.

This is how to check, and what else the register will tell you once you have it open.

Where the list actually lives

CERT-In publishes Empanelled Information Security Auditing Organisations as a single PDF at cert-in.org.in/PDF/Empanel_org.pdf. The document describes itself as the "up-to-date valid list", updated "as soon as there is any change in it" — so it supersedes any list a vendor, a directory or an article gives you, including this one.

The edition retrieved on 16 August 2026 runs to 995 pages and numbers 236 organisations. If you have read that "over 150 firms" hold empanelment, that figure has been overtaken.

Checking a specific firm, in about two minutes

1. Open the PDF. It is large — around 6 MB — so give it a moment.
2. Search for the firm's registered legal name, not its trading name. Entries appear as "M/s <Legal Name>", so a firm you know as one word may be listed as a Private Limited or LLP.
3. Check the entry carries an address, a contact person and an email. Every listing does.

If the firm is not in the current PDF, it is not currently empanelled — whatever a certificate on their website shows. Empanelment is a status on a list that changes, not a badge that is earned once.

The part almost nobody reads

After the roster, the same document carries a section titled Snapshot of skills and competence of CERT-In empanelled organisations. Each firm completes a standard disclosure, and two of its fields are far more useful to a buyer than the empanelment itself:

• "Capability to audit, category wise" — the kinds of audit the firm states it can perform.
• "Number of audits in last 12 months, category-wise" — how much of each kind it says it actually did.

That second field is the closest thing to a public track record that exists in this market. A firm listing a category it has performed no audits in over twelve months is telling you something. So is a firm whose numbers are concentrated in one category when you are buying a different one.

These are self-declared, and worth reading as such. But they are declared to the national CERT rather than to a prospect, and they sit next to every competitor's answer to the same question.

What empanelment does and does not settle

Empanelment is a qualifying status. Several Indian regulatory instruments name a CERT-In empanelled auditor directly, so for those engagements it is not a preference but a condition of the work being accepted — an unempanelled firm's report, however good, does not discharge the obligation.

What it does not settle is which of 236 organisations should do your work. Every firm on the list clears the same bar; that is what a list is. The difference between them lives in the questions the register cannot answer — methodology, who actually performs the testing, what the report contains, and whether retesting is included.

Three ways the claim goes wrong

• Lapsed. A firm was empanelled and is not now. The website badge outlives the status, and only the current PDF shows it.
• A different entity. A group has several registered companies and the empanelled one is not the one on your contract. Check the legal name on the engagement letter against the legal name on the list.
• A partner's empanelment. The firm is subcontracting to an empanelled organisation. That can be legitimate, and it needs to be explicit — the entity signing the report is the one that has to be listed.

Worth doing before you shortlist

Checking the register is the cheapest step in the entire procurement, and it is the only one that can be completed without speaking to anybody. Do it before the demo rather than after the contract.

Security Brigade InfoSec Pvt. Ltd. appears at entry 177 in the edition retrieved on 16 August 2026.