Cybernerds is a CERT-In Empanelled Information Security Auditing Organisation, authorised to conduct IS audits across government, private sector, and regulated industry environments.

Not sure where your organisation stands? Start here.

Why This Audit Matters

CERT-In, India's national nodal agency for cybersecurity under Section 70B of the IT Act, 2000, has issued Comprehensive Cyber Security Audit Policy Guidelines that make independent IS audits a statutory obligation , not just a best practice.

In simple terms:

  • Annual IS audits are mandatory across government, critical infrastructure, BFSI, telecom, and healthcare
  • Major system changes trigger mandatory re-audits
  • Regulators such as RBI, SEBI, IRDAI, and UIDAI mandate CERT-In empanelled auditors
  • Non-compliance can lead to penalties, imprisonment, and loss of eligibility for government contracts

The audit provides independent, evidence-based verification that your cybersecurity controls are implemented and functioning , not just documented.

Who Needs a CERT-In IS Audit

If your organisation falls into any of the following categories, a CERT-In IS audit is either mandated or expected:

  • Government departments and public sector undertakings
  • Banks, NBFCs, stock brokers, insurers, and other BFSI entities
  • Telecom service providers and internet service providers
  • Healthcare organisations and hospitals managing patient data
  • Critical infrastructure operators -power, energy, transport, water
  • Entities accessing UIDAI, NIC-hosted, or e-governance platforms
  • Technology and IT service providers to regulated industries
  • Any organisation handling sensitive data under regulatory or contractual obligation

Also, applicable where: SEBI CSCRF, IRDAI cybersecurity guidelines, RBI frameworks, and UIDAI ecosystem requirements independently specify a CERT-In empanelled auditor as the mandated audit authority.

What the Audit Covers

The scope of a CERT-In IS audit is defined in alignment with CERT-In's Cyber Security Audit Baseline Requirements and the 2025 Comprehensive Audit Policy Guidelines. Depending on your environment and regulatory context, the audit covers:

  • Network Infrastructure Security
  • Application Security
  • Vulnerability Assessment and Penetration Testing (VAPT)
  • Endpoint and Infrastructure Controls
  • Cloud, OT/ICS, and Emerging Technology
  • Source Code Review
  • Compliance and Governance Controls
  • Red Team Exercises and Forensic Readiness (where in scope)

Our Audit Methodology

Structured, evidence-based, and aligned with CERT-In's audit policy guidelines:

  • Scope Definition - Confirm all digital assets in scope: applications, networks, cloud infrastructure, OT/ICS environments, and APIs; agree on audit boundaries with a formal engagement agreement and NDA
  • Document and Policy Review - Review security policies, architecture documentation, incident records, and existing compliance evidence
  • Technical Assessment and Testing - VAPT, configuration review, source code review, and control validation through evidence collection and walkthrough sessions
  • Gap and Risk Analysis - Each control mapped against applicable requirements; gaps classified by severity with clear references to the applicable standard or guideline
  • Reporting - Detailed audit findings with evidence references, risk prioritisation, and structured remediation guidance
  • Remediation Review - Post-fix validation to confirm that identified vulnerabilities have been addressed before certificate issuance

Common Observations

Recurring gaps identified across IS audit engagements:

  • Network segmentation defined in policy but not implemented at the infrastructure level
  • Patch updates applied but not tracked or evidenced
  • Source code review skipped for internally developed applications
  • VAPT limited to external testing, with no internal assessment
  • Cloud environments excluded from audit scope despite hosting critical data
  • Incident response plans not aligned with CERT-In’s 6-hour reporting requirement
  • OT/ICS environments excluded despite connectivity to IT networks
  • No formal engagement agreement or NDA in place before audit commencement

What You Receive

  • IS Audit Report: Technical findings with evidence reference, severity classification, and control-level observations
  • VAPT Report: Vulnerability findings, risk ratings, and remediation recommendations
  • Recommendations and Remediation Roadmap: Prioritised actions aligned to applicable requirements
  • Compliance Certificate: Issued by Cybernerds upon satisfactory completion of the audit and remediation review

The compliance certificate is issued solely based on audit findings and remediation closure and is not a predetermined outcome of the engagement.

How Cybernerds Conducts the Audit

Cybernerds conducts IS audits as independent assessments of how effectively your organisation protects its systems, data, and operations, rather than as a certification exercise.

As a CERT-In Empanelled Information Security Auditing Organisation, Cybernerds:

  • Conducts audits with statutory recognition from CERT-In and sectoral regulators
  • Provides independent, evidence-based evaluation of implemented controls
  • Assesses technical controls across network, application, cloud, OT, and compliance domains
  • Applies regulatory understanding across BFSI, government, healthcare, and critical infrastructure sectors
  • Delivers clear, structured reporting aligned with regulatory and supervisory expectations

See How We Report

Understand how IS audit findings, VAPT results, and compliance observations are structured and presented.

Speak With Our Experts

If your organisation requires a CERT-In IS audit — whether for regulatory compliance, internal assurance, or sectoral mandates — connect with our team.