CERT-In Empanelled Auditor vs. Full-Service Compliance Partner: Which Do You Need?

What Does a CERT-In Empanelled Auditor Do?

CERT-In (the Indian Computer Emergency Response Team) maintains a list of empanelled Information Security Auditing Organisations (ISAOs). These are firms that have been assessed and approved by CERT-In to conduct information security audits for regulated entities. SEBI and RBI both require that certain audits be conducted by empanelled auditors — so this is a regulatory prerequisite, not just a quality signal.

A CERT-In empanelled auditor's primary function is to:

• Conduct Vulnerability Assessment & Penetration Testing (VAPT) on your systems
• Perform annual Information Security (IS) audits as required by SEBI (IAAP) or RBI
• Issue a formal audit report that you submit to your regulator
• Provide a findings report with observations and recommendations

Crucially, an empanelled auditor's job is to assess and report — not to implement. They identify gaps; they do not fix them.

When a Specialist Auditor Makes Sense

A standalone CERT-In empanelled auditor is the right choice when:

• You have a strong internal IS and compliance team that handles implementation, policy, and remediation in-house
• You only need the audit report itself to satisfy a regulatory submission requirement
• You have already completed a gap analysis, implemented all required controls, and need an independent third-party to verify and certify your posture
• Your organisation is large enough to have dedicated resources for ongoing compliance management

The Limitations of Only Hiring an Auditor

Many regulated entities — particularly mid-sized stockbrokers, NBFCs, and fintechs — make the mistake of hiring only an auditor and expecting a clean report. The audit report does not solve compliance gaps; it finds them. After the audit, you still need to:

• Remediate all findings (critical and high must be closed before the next cycle)
• Implement or update policies and procedures
• Produce evidence for the next audit cycle (access reviews, patch records, IR test reports)
• Manage the ongoing VAPT remediation tracker
• Stay current with evolving SEBI/RBI guidance

If you do not have internal resources to handle all of this, you will likely need multiple vendors — a policy consultant, an implementation partner, a training provider, and still the auditor. This fragmentation is costly and creates accountability gaps.

We regularly see firms that have a CERT-In empanelled auditor's report in hand — and dozens of open findings they do not know how to close. The audit is the beginning of the work, not the end.

Infosek Team

When a Full-Service Compliance Partner Makes More Sense

A full-service compliance partner handles the entire lifecycle: gap assessment → remediation → policy development → implementation → audit co-ordination → ongoing monitoring. This is typically the right model when:

• Your IT team is primarily focused on business operations, not compliance
• You do not have a dedicated CISO or IS compliance function in-house
• You face multiple regulatory requirements simultaneously (e.g., SEBI CSCRF + CERT-In + DPDP Act)
• You want a single point of accountability for your entire compliance posture
• You have experienced prior audit failures and want structured remediation
• You are building your compliance programme from scratch

The Infosek Approach: One Team for Everything

Infosek operates as a full-service compliance partner. Our team handles VAPT, IS audit co-ordination (with CERT-In empanelled auditors), CSCRF implementation, policy development, incident response planning, and ongoing monitoring — all from a single engagement. You do not need to manage multiple vendors or explain your regulatory context to five different firms.

Whether you need SEBI CSCRF compliance (see our full CSCRF checklist), SEBI IAAP audit preparation (see our IAAP audit guide), or RBI IT framework compliance, we handle it all.

Common questions

What does a CERT-In empanelled auditor do?

Carries out the security audits that certain Indian regulators will only accept from an empanelled firm, including SEBI's CSCRF information systems audit. Empanelment is a formal recognition by CERT-In, not a self-declared credential.

Is hiring an empanelled auditor enough for compliance?

No. An auditor assesses and reports; it does not build policies, implement controls or remediate findings. Organisations that engage only an auditor often receive a report they then have no capacity to act on before the deadline.