Agent Index by Heritage Services
Submit / Claim
AI
Agent Index by Heritage Services
theagentindex.io/guides/cert-in-empanelled-auditors/ · Last reviewed 22 Oct 2026

Agent Index by Heritage Services · theagentindex.io/guides/cert-in-empanelled-auditors/ · Not legal or audit advice · CC BY 4.0
Home / Guides / CERT-In empanelled auditors

Free guide · CERT-In · auditors · 22 Oct 2026

CERT-In empanelled auditors: how to check the official list and shortlist a firm

CERT-In publishes the official empanelled-auditor list as a PDF. This page explains how that list works, how to check a name on it, and how the 117 CERT-In firms in this directory break down by city. Not a ranking.

Last reviewed 22 Oct 2026Auditors dataset v0.1.32
General information, not legal advice. Confirm scope with your counsel or auditor. A directory listing is a set of checked facts, not an endorsement. Confirm current empanelment on CERT-In’s PDF before engaging a firm.

The official list

CERT-In publishes Empanelled Information Security Auditing Organisations as a PDF. The file heading matches that title. The PDF states that the list “is up-to-date valid list of CERT-In Empanelled Information Security Auditing Orgnisations” and that “This list is updated by us as soon as there is any change in it.” [1]

The copy fetched 2026-10-22 is numbered through entry 236 (last named organisation on that fetch: M/s Yoganandh & Ram LLP). That count is read from the snapshot stored with this page and re-read at build. [1]

Open the official file: cert-in.org.in/PDF/Empanel_org.pdf.

What this directory lists

Agent Index lists 117 organisations whose frameworks field contains “CERT-In”. Each of those listings has a registry row “CERT-In empanelled information security auditing organisations”. [5]

6 of the 117 also have a published US office — see CERT-In empanelled auditors in the United States.

Centre for Development of Advanced Computing (C-DAC) is a government body (CERT-In entry no. 38, Hyderabad) and shows the “Government body” label on its listing.

13 of the 117 are also PCI SSC QSA companies (they carry both CERT-In and PCI DSS framework tags in this dataset). [5]

Related: CERT-In hub · CERT-In CIAD-2026-0049 guide · CERT-In empanelled auditors in India · Sprinto alternatives · Get matched.

Cities

Office counts below are computed at build from published India offices on CERT-In-tagged listings. A city page exists only where at least three Verified firms match. Not a ranking.

CERT-In empanelment vs STQC vs ISO 27001 certification

CERT-In empanelment is a listing of information security auditing organisations on CERT-In’s PDF. It is not an ISO/IEC 27001 accreditation. [1]

STQC is a MeitY directorate. Its ISMS page says it “operates third party ISMS certification scheme based on the ISO/IEC 27001 standard and offers ISMS Certification services since November 2001 to its valued clients in India and abroad.” The same page says the scheme is accredited by NABCB “vide Accreditation no:ISMS003”. [2]

The NABCB register lists STQC IT Certification Services under Information Security Management Systems as certificate IS003, valid from 20 August 2014 to 19 December 2029, accreditation standards ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, scope ISO/IEC 27001:2022. [3] [4]

STQC’s own page writes the accreditation number as ISMS003. NABCB writes IS003. This page quotes both, with sources. We do not treat that spelling difference as a different accreditation.

Directory listing: STQC IT Certification Services. This guide does not add claims about STQC audits beyond that listing and the two official pages above.

Get matched

If you want a shortlist of listed firms for CERT-In or another published framework, use Get matched or the form below. We store the request for review; we do not email firms automatically.

Get matched

Get matched with verified auditors

We'll review your request; no automatic emails. Introductions start later. This does not send a message to any firm and does not include prices. Not a ranking.

Framework(s) (select all that apply)

FAQ

Where is the official list of CERT-In empanelled auditors?

CERT-In publishes “Empanelled Information Security Auditing Organisations” as a PDF. The PDF says it is the “up-to-date valid list” and is “updated by us as soon as there is any change in it”. https://www.cert-in.org.in/PDF/Empanel_org.pdf

How many organisations are on it?

The list fetched 2026-10-22 is numbered through entry 236 (last named organisation on that fetch: M/s Yoganandh & Ram LLP). Agent Index lists 117 of these organisations, each with a registry row “CERT-In empanelled information security auditing organisations”.

How do I check whether a firm is empanelled?

Find the firm’s name and entry number on the official CERT-In PDF. Agent Index listings that carry a CERT-In tag quote that registry row, including the entry text we checked.

Is STQC the same as CERT-In empanelment?

No. CERT-In empanelment is a listing of information security auditing organisations. STQC is a MeitY directorate that operates a third-party ISMS certification scheme based on ISO/IEC 27001. Those are different registers.

Which cities have the most empanelled firms in this directory?

Bengaluru (32), Mumbai (30), Gurugram (15), New Delhi (14), Pune (14), Chennai (13), Noida (13), Ahmedabad (10), Hyderabad (10), Navi Mumbai (9), Kolkata (8), Kochi (5).

Get updates by email

Subscribe to the Brief

Weekly, free, unsubscribe anytime.

We use your email only to send the newsletter. See our privacy policy.

Sources

  1. CERT-In, Empanelled Information Security Auditing Organisations (PDF), fetched 22 Oct 2026. https://www.cert-in.org.in/PDF/Empanel_org.pdf
  2. STQC, Information Security Management System (ISMS). https://www.stqc.gov.in/en/information-security-management-system-isms
  3. NABCB register — STQC IT Certification Services (IS003). https://nabcb.qci.org.in/is003/
  4. NABCB, Management System Certification — Information Security Management Systems. https://nabcb.qci.org.in/management-system-certification/
  5. Agent Index auditors dataset v0.1.32, generated 2026-10-27. https://theagentindex.io/auditors.json

Prepared by Agent Index (Heritage Services). Last reviewed 22 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.