We deliver CERT-In audits, end to end, with our CERT-In empanelled partners. Scoping, testing, help with the fixes, the retest and the certificate your regulator or department asks for all run as one engagement.
Safe-to-host · Web, mobile and API · Network and cloud · RBI, SEBI and IRDAI
- ScopeAgreed in writing before testing starts
- TestOn a staging or test environment
- ReportFindings graded on CVSS, with evidence
- Fix supportWe work through the findings with you
- RetestClosure confirmed, finding by finding
- CertificateThe one your regulator or department asks for
The CERT-In audits we deliver.
Safe-to-host audits for government applications, the application and infrastructure audits behind them, and the CERT-In audits RBI, SEBI and IRDAI expect of the entities they regulate.
Safe-to-host audit
For government websites, web applications, portals and mobile apps. GIGW guideline 5.3.1 requires an audit clearance certificate before an application is hosted in production, and the data centre or cloud provider asks for it before opening production.
What a safe-to-host certificate isWeb application audit
Authentication, user roles, sessions, input handling and business logic, tested against OWASP ASVS and the OWASP Top 10, the standards GIGW names for government applications.
The types of VAPTMobile application audit
The app and the API tier behind it, scoped as one. Leaving the APIs out is the most expensive gap in a mobile audit, because object-level authorisation flaws only show up when the API is tested directly.
Scoping a VAPTAPI security audit
Your APIs tested directly, with accounts at every privilege level, for authentication and token handling, object and function level authorisation, rate limiting and old endpoints still serving traffic.
API security testingNetwork and infrastructure audit
Internet-facing and internal networks, servers, operating systems, web hosting software and databases. If your application runs on a server you own, the server is part of the audit too.
What VAPT actually isCloud configuration audit
A configuration and posture review of your cloud accounts with read access, covering identity and privilege, network exposure, data protection, key management and logging.
Cloud security audits in IndiaHow a CERT-In audit runs with us.
Six stages in one engagement, planned around your go-live date or your regulator’s deadline.
Scope
We agree the scope in writing before testing starts, covering URLs, user roles, environments, APIs, mobile builds, third-party integrations and anything left out.
Test
Testing runs against the agreed scope on a staging or test environment that matches the build you will ship, with test accounts at every role.
Report
You get a findings report that grades each finding on CVSS, with EPSS likelihood, CWE and CVE mapping, and the evidence behind it.
Fix support
We work through the findings with your developers, so each fix is in place before the retest.
Retest
The fixes are retested and closure is confirmed, finding by finding.
Certificate
Once closure is verified, the audit certificate your regulator, department or data centre asks for is issued, naming the build that was audited.
Who asks for a CERT-In audit.
It usually arrives as a line in a tender, a data centre’s hosting checklist or a regulator’s guidelines. Here is who asks, and what they mean by it.
- Government departments and PSUsA safe-to-host certificate before a website, portal or app goes into production, under GIGW guideline 5.3.1. Central and state departments and district administrations are covered, and PSUs meet the same gate wherever their portal is hosted. GIGW compliance before go-live
- Vendors building for governmentThe certificate belongs to the department, but the testable build, the staging environment and the version and hash usually sit in your work order. How to get a safe-to-host certificate
- Banks, NBFCs and payment aggregatorsRBI expects periodic VAPT and security audits by a CERT-In empanelled auditor. RBI audit and compliance
- SEBI-regulated entitiesUnder SEBI’s CSCRF, cyber audits are carried out by CERT-In empanelled auditors, on a cadence set by your entity category. ISO 27001 and SEBI CSCRF
- Insurers and intermediariesIRDAI’s cyber security guidelines are assessed through the Annexure III audit by CERT-In empanelled firms, alongside regular VAPT. ISO 27001 and the IRDAI guidelines
- Private companies in a tenderWhen a tender asks a private company for “safe to host”, it almost always means a security audit certificate from an empanelled auditing organisation. Safe-to-host vs security audit certificate
Questions before you book.
Validity, verification, testing environments and what we need from you to start.
Do you deliver CERT-In audits?
What is a safe-to-host certificate?
How long is a safe-to-host certificate valid?
How can we verify a CERT-In audit certificate?
Is the audit done on our live site?
What do you need from us to start?
Which audits do RBI, SEBI and IRDAI expect?
Related Reading
What a Safe-to-Host Certificate Is
The audit clearance certificate GIGW 5.3.1 requires before a government application is hosted in production.
Read moreHow to Get a Safe-to-Host Certificate
Eleven stages end to end — eligible auditor, staging, first pass, remediation, retest, issue — plus what drives duration and cost.
Read moreGIGW Compliance Before Go-Live
The wider conformity picture — quality, accessibility, cybersecurity and lifecycle — of which safe-to-host is one part.
Read moreWhat Is CERT-In?
The national agency under section 70B of the IT Act — what it does, and what empanelment actually means.
Read moreRBI Cyber Security Framework
CSITE, IT governance and incident reporting for RBI-regulated entities.
Read moreVAPT / Penetration Testing
Manual-first web, API, network and mobile testing with retest included.
Read more