Government and public sector
Security audits and certification for government and public sector bodies
CERT-In empanelled audits and accredited certification for departments, public sector undertakings and their suppliers.
Certification and audits for government and public sector
Government departments and public sector bodies run services that citizens depend on, and their websites and systems are frequent targets. In India, hosting teams at NIC and state data centres commonly ask for a security audit clearance before an application goes live, and departments are expected to follow CERT-In directions on security practices and incident reporting.
As a CERT-In empanelled auditing organisation, we issue safe-to-host certificates for web applications and carry out IT security audits and VAPT for networks, cloud and mobile apps. For organisations that want a management system approach, we also certify to ISO 27001, ISO 9001 and related standards.
Public bodies need auditors who stand apart from the vendors who build their systems. We audit and certify; development and remediation stay with the department or its system integrator.
What we hear
Pressures we audit against
- 01
Hosting clearance deadlines
A website launch can wait on a security audit, and any late change to the code means the audited build no longer matches what is hosted.
- 02
Systems built by many vendors
Applications are often developed and maintained by different system integrators, which makes consistent security standards harder to enforce.
- 03
Incident reporting duties
CERT-In directions require cyber incidents to be reported promptly, which depends on logging and monitoring being in place beforehand.
- 04
Accessibility and quality expectations
Government websites are expected to meet GIGW guidelines on accessibility, content and security, alongside the department's own service standards.
Standards and audits for this sector
Security audits
Safe-to-host certificate
A security audit to CERT-In guidelines, ending in a certificate tied to the exact build you will host.
Security audits
IT security audit
An information security audit to CERT-In guidelines covering the systems you name, closed with a dated audit certificate.
Security audits
VAPT
Vulnerability scanning followed by hands-on exploitation, so you know which weaknesses an attacker could use.
Security audits
Web application security audit
Testing of your web application against OWASP guidance, with a certificate that names the URLs, dates and build covered.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
ISO certification
ISO 9001
Independent assessment of your quality management system against ISO 9001:2015, by an accredited certification body.
CMMI appraisals
CMMI Maturity Level 3
An independent appraisal of whether your organisation's standard processes are defined and followed across projects.
Guides
5 min read
From scoping to safe-to-host certificate
Many government and public sector hosting environments ask for a safe-to-host certificate before an application goes live. This guide walks through each step and explains why the audited build is identified by its hash.
5 min read
Preparing for a CERT-In empanelled security audit
A security audit by a CERT-In empanelled organisation goes faster and says more when the auditee is prepared. This checklist covers scope, environments, access, evidence, fixes and the final report.
5 min read
ISO/IEC 27001:2022: what changed and how audits treat it
The 2022 edition reorganised Annex A into 93 controls across four themes and tightened several clauses. This guide sets out what changed, what auditors look for and how to close the gaps in a sensible order.
5 min read
Preparing for stage 1 and stage 2 certification audits
Initial certification happens in two stages: a readiness review and a full assessment of how the system works. Here is what each stage covers and how to prepare without overbuilding.
5 min read
Integrated management system audits
Organisations with more than one ISO certification can be audited against them together. This guide explains what an integrated audit shares, what still has to be assessed standard by standard, and how to prepare.
5 min read
Transferring your certification to a new certification body
You can move an accredited management system certification from one certification body to another without starting over. This guide explains who is eligible, what the pre-transfer review covers and what happens to your audit cycle.
Frequently asked questions
Where we work
Our registered office is in Redwood Shores, California. Teams in London, Dubai, Mumbai and Singapore plan and lead audits in their regions.
Plan your certification
Tell us your sites, scope and the standards you need. We reply with an audit plan and a fixed quote.