Who Needs a CERT-In Security Audit?

Not every enterprise in India requires a CERT-In audit by law, but for many critical sectors, it is a non-negotiable regulatory requirement.

Key Entities Required to Audit

• Banking & Financial Institutions

  RBI mandates periodic security audits for all banks, NBFCs, and payment system operators.

• Insurance Companies

  IRDAI guidelines require insurance providers to conduct annual cyber security audits.

• Government Agencies

  Any application or website being hosted on National Informatics Centre (NIC) servers must have a valid CERT-In audit certificate.

• Stock Brokers & Exchanges

  SEBI circulars mandate robust cybersecurity frameworks and regular auditing for market participants.

• Telecom Service Providers

  Critical infrastructure providers are required to maintain high standards of security verified by CERT-In empanelled organizations.

Even if your sector isn't strictly regulated yet, a CERT-In audit is the gold standard for verifying your security posture to enterprise clients and board members.