VAPT Services in Delhi NCR

No. AxVeil LLP is a young Indian entity and is not currently on the CERT-In Information Security Auditor empanelment list. For CERT-In mandated audits we partner with empaneled firms — see /partners. For Delhi NCR Cyber Hub GCCs, foreign-HQ India ops, e-commerce / marketplace / edtech platforms, OT-aware private manufacturing, DPDP Act work and SOC 2 / ISO 27001 driver engagements, AxVeil contracts directly. For MeitY empanelment, PSU procurement, STQC / GIGW government-portal certification and any audit where the procurement clause names a CERT-In empanelled auditor, AxVeil delivers the technical engagement under sub-contract to an empanelled partner who signs the regulator-facing report. Reference: https://www.cert-in.org.in.

CERT-In's April 2022 directions mandate that 20 categories of cyber incidents — including ransomware, identity theft, phishing, data breaches and CII targeting — be reported within 6 hours of noticing or being brought to notice. Logs must be retained for 180 days inside India. Every Delhi NCR enterprise, GCC and government body is covered, regardless of empanelment status of the audit firm. AxVeil engagements include the IR runbook for this clock as a direct deliverable. Reference: https://www.cert-in.org.in.

AxVeil reports follow the CERT-In VAPT reporting format and incident-response taxonomy and support the 6-hour breach notification obligation under the April 2022 directions. For private NCR enterprises, GCCs, e-commerce platforms and foreign-HQ India ops, AxVeil contracts directly and signs the report on AxVeil letterhead. For PSU procurement, ministry / government-facing audits and any tender that names a CERT-In empanelled auditor as a procurement floor, AxVeil delivers the technical engagement under sub-contract to an empanelled partner (see /partners) who signs the regulator-facing report. Reference: https://www.cert-in.org.in.

Yes — and DPDP Act advisory does not require CERT-In empanelment, so AxVeil contracts directly. We deliver DPDP Act 2023 readiness for Significant Data Fiduciaries (SDFs) — the tier most large NCR conglomerates and e-commerce / marketplace platforms fall into. This includes consent architecture review, DPIA support, grievance officer workflow design, breach-notification tabletop exercises, and prep for the independent data audit and DPO obligations. Penalties under the Act go up to INR 250 crore per instance. Reference: https://www.meity.gov.in.

MeitY empanelment and STQC certification both require a CERT-In empanelled auditor on the signed report. AxVeil delivers technical depth — VAPT, configuration audit, GIGW review, accessibility and security testing — under sub-contract to an empanelled partner who holds the buyer paper and signs the regulator-facing submission. The empanelled partner is named in the proposal up front. See /partners. Reference: https://www.meity.gov.in.

Yes — directly. OT / ICS-aware VAPT for manufacturing plants across the Delhi NCR industrial belt — Manesar, Faridabad, Greater Noida, Sonipat — covering IEC 62443, Purdue model segmentation, PLC / SCADA exposure and IT-OT bridge security. Production OT is tested against staging or read-only mirror environments only. Private manufacturing OT does not require CERT-In empanelment; AxVeil contracts directly.

Foreign-HQ Gurugram and Noida BFSI captives (HSBC, Macquarie, Amex-style operations) are governed by parent-jurisdiction policy (FCA / OCC / MAS / FINMA / ECB) plus DPDP Act over the Indian-resident data they process — AxVeil contracts directly. Indian-regulated bank back-offices that need to feed evidence into a formal RBI cyber security framework submission route through a CERT-In empanelled partner; AxVeil sub-contracts under that partner. Reference: https://www.rbi.org.in.

Remote-first by default — testing, daily digests and the readout call run over Teams / Zoom in IST hours. Engagements are served across DLF Cyber Hub, Udyog Vihar, Connaught Place, Nehru Place, Noida Sector 62 / 132 and the Manesar-Faridabad industrial belt. Onsite kick-offs, internal AD testing and OT walkthroughs are arranged on a per-engagement basis under your visitor-management policy.