Audits your regulator accepts, at the speed of B-52
Indian regulators expect your security audits to come from a CERT-In empanelled auditor. Security Brigade has held that empanelment since 2008, and B-52 is Security Brigade’s platform. Choose the expert-verified or human-led model and an empanelled auditor is inside the engagement and signs the report, with B-52 doing the mapping, the testing and the exploitation underneath.
Who can sign it
Two of the three delivery models put an auditor inside the engagement
The coverage is the same in all three. Two of them put an empanelled Security Brigade auditor in the engagement, so the report that comes out is ready to file.
| State | What it means | What follows |
|---|---|---|
| Autonomous, expert verified | A senior Security Brigade auditor verifies every finding before any of it reaches you. The auditor is inside the engagement. | Signable under the Security Brigade empanelment. |
| Human led | A senior auditor runs the engagement with B-52 underneath: sets the scope, directs where the depth goes, and owns the report. | Signable under the Security Brigade empanelment. |
| Fully autonomous Terminal | A person authorises scope and targets and takes no further action. There is no auditor in the engagement to sign what it produced. | Built for coverage between filings. |
- An empanelled auditor is inside the engagement
- No auditor in the engagement: scope sign-off, then nothing
- TerminalNo state follows this one
Speed and a signature
Platform speed, with an auditor’s signature on the report
Most buyers are offered a choice: a fast automated scan that no regulator will take, or a manual audit that takes weeks to schedule and run. B-52 removes the trade-off. The platform maps the application, writes the test cases and works through the exploitation; an empanelled Security Brigade auditor verifies every finding and signs the report. Run the fully autonomous model for continuous coverage between filings, and switch to the expert-verified model when the report is going to a regulator, an auditor or your board.
Who asks for it
The regulators your report has to satisfy
Whoever you answer to, a report from a CERT-In empanelled auditor is what they expect to see. These are the places it comes up most often.
| Regulator and instrument | What they expect |
|---|---|
| RBI Directions, 2026 | Banks assess their testing firm and the people on the engagement every time they select or renew one. An empanelled auditor answers that before it is asked, and brings CERT-In’s audit policy guidelines into the engagement: the standard your supervisor already measures audits against. |
| SEBI CSCRF | VAPT carried out by a CERT-In empanelled auditor, with the expectation attached to the testing itself, not just to the name on the invoice. |
| Payment aggregators and gateways | An annual system and cybersecurity audit by a CERT-In empanelled auditor. |
| Payment system data storage | The System Audit Report on data localisation, approved by your Board and submitted to the RBI, carried out by a CERT-In empanelled auditor. |
RBI Directions, 2026
- What they expect
- Banks assess their testing firm and the people on the engagement every time they select or renew one. An empanelled auditor answers that before it is asked, and brings CERT-In’s audit policy guidelines into the engagement: the standard your supervisor already measures audits against.
SEBI CSCRF
- What they expect
- VAPT carried out by a CERT-In empanelled auditor, with the expectation attached to the testing itself, not just to the name on the invoice.
Payment aggregators and gateways
- What they expect
- An annual system and cybersecurity audit by a CERT-In empanelled auditor.
Payment system data storage
- What they expect
- The System Audit Report on data localisation, approved by your Board and submitted to the RBI, carried out by a CERT-In empanelled auditor.
What we hold
An empanelment held since 2008
Security Brigade’s CERT-In empanelment As of 2026-10-12
- Empanelled by CERT-In since 2008, and listed on CERT-In’s own register of empanelled organisations.
- B-52 is Security Brigade’s platform, so every expert-verified and human-led engagement is delivered and signed by the empanelled firm.
- An empanelled auditor brings CERT-In’s audit policy guidelines into the engagement, so the method your regulator expects is the method that runs.
How the output maps
What an engagement produces against this requirement
Testing carried out under the empanelment
In the expert-verified and human-led models the engagement has a Security Brigade auditor inside it, which is exactly what a regulator reading the report looks for.
A report that carries the signature
Findings, evidence, severity and remediation in one document, signed by the firm that holds the empanelment and not referred out to a third party.
A scope agreed and recorded in writing
Which targets, which classes, which roles, and what the run was authorised to do. Signed before the engagement and retained with it.
Closure, not just a finding
Each finding carries through open, fixed, retested and closed, and closes on a retest that cannot reproduce it, which is what a closure record is made of.
For banks
Why banks choose an empanelled auditor
Under the 2026 RBI Directions a bank checks its testing firm, and the people on the engagement, every time it selects or renews one. An empanelled firm settles that question before it is asked. It also brings CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines into the engagement, so the audit runs to the standard your supervisor already measures against. With B-52 doing the mapping and the exploitation, the auditor’s time goes where it counts: verification, judgement and a report your board can stand behind.
What you receive
What the report carries for this filing
The exchange that proved it
Request and response as sent and returned, with the part that proves the defect marked, plus steps written so your own engineer can reproduce it.
Severity, with its vector
CVSS v4.0 with the vector printed, the CWE, and the framework category the finding is reported under, so a score can be recomputed instead of taken on trust.
Scope, authorisation and dates
What was in scope, who authorised it, when the testing ran, and what the three approval gates permitted or refused during it.
The signature
In the expert-verified and human-led models, the report is signed by Security Brigade as the empanelled firm that delivered the engagement.
Before you scope
Three things the scoping call settles
| What we settle | |
|---|---|
| Who you file with | Tell us your regulator and we scope the engagement, and the report, to what they expect to see. |
| Which delivery model | Expert-verified or human-led for anything that leaves your organisation; fully autonomous for continuous coverage in between. |
| What is in scope | Applications, APIs, networks and cloud in one scope, agreed in writing before any testing starts. |
Who you file with
- What we settle
- Tell us your regulator and we scope the engagement, and the report, to what they expect to see.
Which delivery model
- What we settle
- Expert-verified or human-led for anything that leaves your organisation; fully autonomous for continuous coverage in between.
What is in scope
- What we settle
- Applications, APIs, networks and cloud in one scope, agreed in writing before any testing starts.
Where to go next
If the filing is under SEBI CSCRF
The CSCRF page sets out the four cadences the framework keeps separate (VAPT, cyber audit, red teaming and threat hunting) and what each one asks you to produce, and when. If you file under the RBI Directions instead, the RBI page has the paragraphs and the cadence that apply to your entity type. Both are linked below.
FAQ
Common questions
Still deciding whether this is the right test? Ask us directly.
Talk to an engineerIs Security Brigade CERT-In empanelled?
Will my regulator accept a B-52 report?
Does the fully autonomous model produce a report we can file?
We are a bank under the 2026 RBI Directions. Why does an empanelled auditor matter?
Other frameworks
Scope it with the delivery model the filing needs
Going to a regulator? Start from the expert-verified model: an empanelled auditor in the engagement and a signed report at the end. A scoping call settles the rest.