Findings map to controls. Certificates come from elsewhere
Nine frameworks, and one rule that governs every one of them. An engagement produces evidence against the controls a framework names. Certification and attestation are issued by certification bodies and auditors appointed for that purpose, which is separate work from testing and is not work we do.
The nine
Each framework, and what it asks for
All nine have a page of their own, each citing the instrument it rests on and the date that instrument was read.
| Framework | What it asks for |
|---|---|
| CERT-In | Security Brigade has been CERT-In empanelled since 2008, and Indian regulators expect audits from an empanelled firm. The expert-verified and human-led models put an empanelled auditor in the engagement, so the report is ready to file. |
| SEBI CSCRF | Four cadences the framework keeps separate: VAPT, cyber audit, red teaming and threat hunting. Conflating them is the most frequent error made against it. |
| RBI Directions, 2026 | Vulnerability assessment six-monthly and penetration testing twelve-monthly under paragraph 151, plus the lifecycle triggers that sit outside the calendar. |
| DPDP | Rules notified 14 November 2025, phasing over eighteen months. Testing is evidence about the safeguards around personal data. |
| PCI DSS | External and internal penetration testing on a twelve-month cycle and after significant change, plus review of bespoke software before release. |
| ISO 27001 | Evidence for the technical-vulnerability and secure-development controls in Annex A. Security Brigade is certified. |
| SOC 2 | Evidence an auditor can use against the Trust Services Criteria. |
| GDPR | Article 32(1)(d) asks for a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures. |
| HIPAA | The Security Rule in force asks for a risk analysis and a periodic evaluation. A proposed update would name testing explicitly. |
- What it asks for
- Security Brigade has been CERT-In empanelled since 2008, and Indian regulators expect audits from an empanelled firm. The expert-verified and human-led models put an empanelled auditor in the engagement, so the report is ready to file.
- What it asks for
- Four cadences the framework keeps separate: VAPT, cyber audit, red teaming and threat hunting. Conflating them is the most frequent error made against it.
- What it asks for
- Vulnerability assessment six-monthly and penetration testing twelve-monthly under paragraph 151, plus the lifecycle triggers that sit outside the calendar.
- What it asks for
- Rules notified 14 November 2025, phasing over eighteen months. Testing is evidence about the safeguards around personal data.
- What it asks for
- External and internal penetration testing on a twelve-month cycle and after significant change, plus review of bespoke software before release.
- What it asks for
- Evidence for the technical-vulnerability and secure-development controls in Annex A. Security Brigade is certified.
- What it asks for
- Evidence an auditor can use against the Trust Services Criteria.
- What it asks for
- Article 32(1)(d) asks for a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.
- What it asks for
- The Security Rule in force asks for a risk analysis and a periodic evaluation. A proposed update would name testing explicitly.
The delivery decision
Which model you buy decides where the report can go
Coverage is identical across the three delivery models. What differs is whose signature the report carries. Where a report leaves your organisation for a regulator or an assessor, that is the whole question.
Two of the three put a senior Security Brigade auditor inside the engagement. Start from the expert-verified model where the output is going into a filing, and read the CERT-In page for what empanelled delivery attaches to.
Tell us which instrument you file under, and we will scope to it
Which framework applies to your entity is a determination for you and your advisers. What the engagement has to cover, and which delivery model produces output you can file, is a short conversation.