The True Cost of a CERT-In Audit in India: Breaking Down Scoping, Timelines, and Free Retesting

Why Two CERT-In Quotes Can Differ by Lakhs

A fintech founder in Bengaluru has two quotes on her desk for the same job: a CERT-In empanelled audit of a web app and its API, needed before a bank partner will sign. One is almost a lakh cheaper, so she takes it. Three weeks later, the first report arrives, her team fixes the findings, and a second invoice follows for the re-audit. Then a third line appears for the certificate. The cheaper quote has quietly become the dearer one.

This happens because nobody publishes a standard price. CERT-In has no audit rate card and charges the auditee nothing. You and the auditor set the price based on three things: what’s in scope, how much effort it takes, and how many audit rounds the contract covers.

Public government tenders give a useful range. A 2023 estimate put one government portal audit at ₹1.5 lakh. A 2026 empanelment for critical government applications sets rates of up to ₹16.2 lakh per application. CERT-In’s 2025 audit guidelines also expect follow-up audits to fall within the scope you’ve already paid for.

This guide breaks the CERT-In VAPT audit cost in India into parts you can check. It covers who sets the price, what tenders reveal, the scoping choices that move a quote, certificate and retest costs, realistic timelines, budgets for startups and enterprises, and the red flags that turn a cheap quote into a second bill.

Who Sets the Price: CERT-In, the Auditor and the Buyer

Before comparing numbers, understand the rules that shape them.

CERT-In empanels auditing organisations. It doesn’t fix their fees, issue VAPT certificates or bill auditees. The price is a commercial deal between your organisation and the empanelled firm.

That deal still has rules around it. CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines (v1.0, 25 July 2025) say fees should be “based on predefined scopes, deliverables, and timelines”, and that payment shouldn’t depend on the audit’s outcome or on closure reports (section 7(i)). In plain terms, you pay for the work agreed, not for a clean result.

The same guidelines make effort visible:

• The test plan has to show calendar time and man-hours (13.2.2(ii)).
• The report has to list the manpower involved (16.1(ii)).
• The auditing organisation can’t sublet the work (10.5(vii)).

That gives buyers something solid to compare. If one quote shows twelve person-days and another shows none, you aren’t comparing like with like, no matter what the totals say.

The organisation and the auditor negotiate the final price. However, CERT-In’s guidelines provide requirements around scope, effort, deliverables and audit documentation that buyers should check before accepting a quote

What Public Tenders Reveal About CERT-In Audit Pricing

Private quotes are confidential, but government buyers publish theirs. These five documents are the closest thing India has to a public price reference.

A word of caution on reading this table. An estimated bid value shows what the buyer budgeted, not what the buyer paid. The NICSI rates cover critical government applications and include source code review, so they aren’t typical prices for a private startup’s web app.

What the documents do show clearly is the structure of a fair deal:

• Pricing is per application, banded by size or complexity.
• Re-audits are written into the scope, not sold later.
• Payment follows milestones, and the final share is often held until the certificate or follow-up audit.
• GST is usually extra.

Use the structure, not the headline numbers, as your benchmark when a private quote lands.

The Scoping Variables That Move the Quote

Most of the gap between two quotes comes from scope. Each choice below adds or removes testing effort, and effort is what you’re buying.

One callout before the worked example. CERT-In’s guidelines discourage “solely tools-based testing” (section 8(ii)). If a quote sits far below the rest, ask whether it’s a scan with a report wrapped around it. That isn’t an audit, and a regulator won’t treat it as one.

Here’s how the drivers play out for a typical fintech startup. Effort figures are left out, since they depend on each auditor’s model.

Get the scope sheet right before you ask for quotes, and the quotes you get back become comparable.

VAPT Certificate Price in India: What You’re Actually Paying For

Many buyers see the certificate as a separate purchase. In a well-run audit, it isn’t. Ask whether the audit fee includes the certificate or clearance document, where applicable, and whether any separate documentation charges apply.

The certificate is issued after fixes have been verified, and it only means something because the testing and the re-audit happened first. A quote that lists the certificate as a separate line item is often a sign that the re-audit is also extra.

A valid certificate carries specific details under CERT-In’s 2025 guidelines:

• the application’s version, hash value and timestamp (section 9.5(i));
• the environment that was tested;
• the signatures of the Lead Auditor and the head of the auditing organisation (9.5(iii)).

The CAG’s ePPO tender shows how government buyers handle this. The final report includes the Website Security Clearance Certificate, and the client releases the full payment only after the auditor issues it. The certificate is the end of the job, not an add-on.

When you’re weighing the VAPT certificate price in India, watch for three red flags:

• a certificate offered without a full report;
• a certificate issued before the fixes have been revalidated;
• “CERT-In certified” wording, because CERT-In does not certify applications.

If a certificate costs extra, ask what it covers that the audit did not.

CERT-In Empanelled Auditor Validation Fees: Retesting, Revalidation and What Should Be Included

“Validation” gets used for three different things in audit quotes. Only one of them should cost you money, and it should already be in the fee.

When people search for CERT-In empanelled auditor validation fees, they usually mean one of these:

1. Checking that an auditor is empanelled. This is free. CERT-In publishes its list of empanelled organisations on cert-in.org.in, under Cyber Security Assurance. Check the firm’s name and validity yourself rather than trusting a badge on a website.
2. Revalidating your fixes. This is the retest. CERT-In’s guidelines expect follow-up audits to be inside the scope of the RFP (section 9.3(iv)), and the contract should include a revalidation clause after the compliance window (13.1.7(i)(g)). Since fees shouldn’t be tied to closure (7(i)), a retest shouldn’t be priced as a reward for passing.
3. Fees auditors pay to sector bodies. Some public bodies charge auditors to join their own panels. SECI’s 2026 request for empanelment, for example, charges ₹20,000 plus GST per zone. That’s the auditor’s business cost, not a fee the auditee pays.

So most CERT-In empanelled auditor validation fees you’ll see on a quote are really retest charges. Before you sign, get these points in writing:

• How many retest rounds are included
• the window for each round, counted from the first report;
• whether a retest checks only the fixed findings or repeats the full scope;
• how new findings discovered during a retest are handled;
• What counts as a scope change, and how is it priced?

If the quote is silent on any of these, that’s where the second invoice usually comes from.

Timelines: From Scoping Call to Certificate

Time is a cost too, especially when a customer or regulator is waiting on the certificate.

The two figures don’t clash: a single web app sits at the shorter end, while an app, API, infrastructure and cloud together run longer. Large public buyers set their own limits too. NICSI’s empanelment allows 60 days for the first round.

Regulated entities have fixed dates to work back from. SEBI’s VAPT calendar, set through exchange and depository circulars, is covered in our companion guide on preparing a CERT-In-compliant VAPT report for RBI and SEBI.

Rushed timelines cost more. Weekend testing windows, parallel testers and a compressed re-audit all add effort. The cheapest way to hit a deadline is to book the audit early.

Cybersecurity Audit Cost for Startups: Spending Where It Counts

Startups rarely need an audit for its own sake. They need one because a buyer, a regulator or a government department has asked for it.

The cybersecurity audit cost for startups usually lands at one of three moments:

• selling to a government department, which requires a safe-to-host certificate under GIGW 3.0 before hosting an app.

• becoming a SEBI- or RBI-regulated entity, or a technology vendor to one;
• facing an enterprise customer’s security due diligence.

In each case, the audit has to be real. A scan-only report may not meet a bank’s vendor-security assessment requirements, particularly when the bank expects manual testing and evidence of remediation.

The way to control the cybersecurity audit cost for startups is to cut wasted effort, not testing quality:

• Fix the obvious first. Patch known library issues and close default settings before the auditor arrives, so paid days go on real findings.
• Prepare for grey-box testing. Test accounts for each role, and an API collection saves days of discovery.
• Use a staging setup that mirrors production, and say so in the scope.
• Bundle the web app and API in one engagement. Shared setup and one report cost less than two projects.
• Choose a plan with retests included. A startup usually needs at least one retest round.
• Avoid scan-only quotes. They’re cheap once and expensive the second time.

Spend on the testing a buyer will read, and save on the effort that a little preparation removes.

Enterprise and Regulated Programmes: Budgeting Beyond One Application

For larger organisations, the question isn’t the price of one audit. It’s the cost of a year of them.

Frequency sets the budget:

• CERT-In sets an annual audit as the minimum (13.1.2(i)), plus an audit after any major change.
• The RBI Directions, 2026 ask commercial banks for VA at least every six months and PT at least every 12 months for critical systems.
• SEBI’s CSCRF sets half-yearly VAPT for qualified stockbrokers and critical information infrastructure and yearly for most other regulated entities.

A realistic annual budget has these lines: VA cycles, penetration testing, configuration review, source code review where needed, follow-up audits, the action taken report (ATR) cycle, and audits after major releases.

The public tenders help here. The BIS bid shows what a two-year infrastructure and compliance programme can be budgeted at, with payment split between the first round and the follow-up. The NICSI rates show the per-application ceiling for critical systems with source code review included. CERT-In’s suggestion of 2- to 3-year contracts for critical applications (12.4(i)) also helps on cost, since an auditor who knows your estate spends less time rediscovering it each cycle.

Budget by application and by cycle, and you’ll see the real annual figure before the first quote arrives.

Secure Your Business with a Expert-Led Security Assessment

Partner with certified security specialists to identify, prioritize, and remediate real-world risks across your systems.

Book a Security Assessment →

Hidden Costs and Red Flags in a CERT-In Audit Quote

Most surprise costs come from things a quote leaves out, rather than from things it overprices.

A note from the testing side. When I review a client’s previous audit before quoting, the most common gap I find isn’t a missed vulnerability. It’s a report with no retest. The first round found issues, the team fixed them, and nobody ever verified the fixes because the retest was never in the contract. I now ask every client one question at the first call: how many rounds do you expect to need?

Code example: comparing two quotes on full cost

This Python script compares two quotes on full cost. It adds retest rounds not covered by the fee, a separately charged certificate, travel and GST, then flags terms that conflict with CERT-In’s 2025 guidelines. The rupee figures in the sample file are illustrative, not market rates. It was run on Python 3.13 with the standard library only.

Real output:

Quote A looked ₹80,000 cheaper and finished nearly ₹95,000 dearer, with six terms that a regulator or a bank’s reviewer would question. The script can’t judge testing quality, so treat it as a first filter.

Ask every bidder to fill in the same fields, and the hidden costs come out before you sign.

How Qualysec Prices and Retests CERT-In Audits

Qualysec is a specialised penetration testing company, and retesting sits at the centre of how we price an engagement, because a test without verified fixes leaves the job half done.

In addition, Every quote starts from a fixed scope: the assets, roles, environment and reporting format agreed before testing begins. Retests are included in the fee within the limits of each published plan on our pricing page:

• Starter: one retest within a month.
• Growth: two retests within two months, with a Letter of Attestation.
• Business and Enterprise: unlimited retests.

Case study: banking software provider, eight issues closed through retests

Aicura Solutions, a banking software provider, worked with us from November 2025 to January 2026. The scope covered the customer journey, the back office and the Azure cloud environment, and their verified Clutch review notes that the company needed the testing for a banking licence.

We found eight issues, resolved all of them, and confirmed each fix with multiple retests.

However, this engagement was not a CERT-In audit, but it shows the cost pattern this guide argues for: one scope, one fee, and as many verification rounds as closure needed.

Retests that come with the fee are what keep the first quote from the final one.

Prepare for Your Next Cybersecurity Audit with Qualysec

Choose a partner that helps you identify and fix real security risks before attackers do. We are here to help.

Talk to an Expert→

Conclusion and Next Steps

The important number is not the one in the first quote. It’s the total you’ve paid when the last finding is verified, and you have the certificate in hand.” There can be a lakhs difference between the two quotes for the same app for valid reasons like source code review, additional roles or the regulator’s format. Another reason they may be different is that one has omitted the re-audit, the certificate or the tax. CERT-In’s 2025 guidelines ask you to consider three questions: what’s the effort, who is doing it, and whether the follow-up rounds are included.

The next course of action is straightforward. “Put all your assets, user roles and environment on one page and ask each bidder for a fixed-scope quote with the number of retest rounds and windows written in.

Frequently Asked Questions

1. How much does a CERT-In VAPT certificate and audit cost in India?

Therefore, There is no official price, because CERT-In does not charge fees or issue certificates. Public tenders offer various prices: a 2023 government estimate of ₹1.5 lakh for one portal and NICSI’s 2026 prices of ₹10.8 lakh to ₹16.2 lakh for a critical application. Private quotes are based on scope, effort and the number of retest rounds included. The audit fee should include the certificate.

2. How much does a comprehensive cybersecurity audit cost for an Indian enterprise?

It is contingent upon the number of applications, networks and cloud accounts in scope and how often you are testing. Against this, the BIS had budgeted an estimated ₹51.54 lakh for a two-year infrastructure and compliance audit as a public reference. Build your budget out by application and by cycle. Include VA, pen testing, config review, follow-up audits and audits after major changes.

3. How do I get a valid VAPT certificate for my application?

Hire an empanelled auditor and check its name on CERT-In’s published list. Agree on the scope. Test. Fix the findings. Have the auditor revalidate. Then, the lead auditor and the head of the auditing organisation issue a certificate containing a version of your application, a hash, a timestamp and the tested environment.

4. Does Qualysec charge extra fees for VAPT remediation re-testing?

Each plan covers retests within its published limits.The starter plan includes one retest per month, the growth plan includes two retests per month with a letter of attestation, and the business and enterprise plans also offer unlimited retests. Therefore, Your quote includes the rounds and windows that are relevant to your scope, so there is no separate retest invoice in those terms.