CERT-In Empanelled Audit
The audit your regulator will accept on the first read.
Macksofy is empanelled by the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology. Our audits are accepted by SEBI, RBI, UIDAI, IRDAI, payment system operators and every major Indian regulator and certification body — without rework.
Information Security Auditor
Compliance is leverage, not paperwork.
CERT-In empanelment is the gold standard for cybersecurity auditors in India. For BFSI entities, payment aggregators, government contractors, regulated fintechs and any organization handling sensitive Indian data, a CERT-In empanelled audit is the only one that satisfies regulator inspection. Macksofy holds active empanelment with the requisite scope to perform information security audits.
- BFSI: Banks, NBFCs, brokers, AMCs, custodians, RTAs, RIAs
- Payment Aggregators / Payment Gateways (RBI authorized)
- Government / PSU IT systems (annual audits)
- UIDAI Aadhaar ecosystem entities (AUAs, KUAs, ASAs)
- Critical Information Infrastructure (CII) per CERT-In
- Healthcare entities (NDHM / ABDM)
How we run a CERT-In Audit engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
1 · Empanelment letter + scoping
- CERT-In empanelment confirmation to client
- Scope per regulator requirement (e.g., RBI System Audit Report)
- Engagement letter + RoE
- 011 · Empanelment letter + scoping
- CERT-In empanelment confirmation to client
- Scope per regulator requirement (e.g., RBI System Audit Report)
- Engagement letter + RoE
- 022 · Technical audit (VAPT)
- Annual VAPT per regulator schedule
- Network, application, mobile, cloud as applicable
- Manual exploitation of high-severity findings
- 033 · Process + governance audit
- Information security policy review
- Access management, change management
- Incident response evidence
- Third-party risk management
- 044 · Compliance attestation
- Mapping to specific regulator framework
- Gap identification + closure plan
- Management acceptance + risk treatment
- 055 · Regulator-format report
- CERT-In format report
- RBI System Audit Report (where applicable)
- SEBI cybersecurity attestation (where applicable)
- 066 · Closure + retest
- Free retest of remediated findings within 30 days
- Final closure letter + Macksofy attestation
- Ongoing advisory included in engagement
Everything you need to satisfy auditors.
- CERT-In empanelment letter for the engagement
- Audit report in regulator-prescribed format
- Findings register with risk + ETA + management response
- Free retest of remediated findings
- Closure letter / Macksofy attestation
- Ongoing advisory for regulator inspections
Annual System Audit Report
Outcome: Submitted to SEBI in CERT-In format inside 12 working days; zero rework
Annual cybersecurity audit per RBI guidelines
Outcome: All controls validated; remediation closed within 60 days
The shape of a CERT-In Audit engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- Governance & policy review3 pts
- Technical security audit3 pts
- Incident-response readiness3 pts
- Third-party & supply chain3 pts
- Audit pack & evidence3 pts
- Continuous monitoring uplift3 pts
Board-level accountability through to operator-level execution.
- InfoSec policy, charter, RACI
- Risk-management framework alignment
- Asset & data classification review
Hands-on testing against the production estate — not a paper review.
- External + internal VAPT in CERT-In format
- Configuration & patch-management evidence
- Vulnerability backlog with CVSS 3.1 + remediation effort
Validating that CERT-In's 6-hour reporting rule actually fires.
- IR plan + playbook walk-through
- Detection-and-response capability assessment
- CERT-In incident-reporting drill
Vendor and cloud-provider exposure mapped end to end.
- Vendor security questionnaire & contract review
- Cloud-shared-responsibility evidence
- Critical SaaS dependency mapping
Submission-ready artefacts in the format CERT-In actually reads.
- CERT-In format executive + technical report
- Evidence vault keyed to control statements
- Remediation tracker + 30-day retest letter
What you keep running once the audit ships.
- SOC use-case backlog seeded from audit findings
- Quarterly self-attestation template
- Year-2 readiness roadmap
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a CERT-In Audit engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things compliance leads ask before signing.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements