Buyer's guide
Who Can Sign Your Security Report: QSA, Empanelled Auditor, CPA Firm or Certification Body
Four documents, four signatures, four different bodies deciding who may give them. Confusing them is expensive in both directions: a consultancy that cannot sign what your acquirer is waiting for, or an empanelled auditor for an obligation that never asked for one. SecureRoot Risk Advisory LLP signs none of the four, and this page says so first rather than last.
Why this page states its author’s limits
SecureRoot’s own management system holds ISO/IEC 27001:2022 certificate IN60432E, issued by its certification body after an audit of this firm. That audit says nothing about any client’s management system, and nothing on this page should be read as if it did.
The four signatures
Who may sign what, and who decides
Each row is a separate qualification conferred by a separate body. None of them is interchangeable with another, and no consultancy holds any of them by being good at security.
Qualified Security Assessor (QSA)
The PCI Security Standards Council, which qualifies both the assessor company and the individual assessors working under it.
- Signs
- A Report on Compliance, and the Attestation of Compliance that goes with it to your acquiring bank or card brand.
- When you need one
- When your validation level calls for a ROC rather than a self-assessment questionnaire. A SAQ is completed by your own organisation and signed by one of your officers — no assessor signs it, and no consultancy can sign it for you.
- Where SecureRoot sits
- SecureRoot is not a QSA and signs neither document. We run the segmentation and penetration testing Requirements 11.3 and 11.4 ask for, fix what the test finds and retest it, so the assessment confirms controls that already hold.
CERT-In empanelled auditing organisation
The Indian Computer Emergency Response Team, which empanels organisations after a capability assessment and Ministry of Home Affairs vetting.
- Signs
- The formal audit or VAPT report in the places that name the panel — a SEBI CSCRF cyber audit, an IRDAI external test, or a tender whose clause requires an empanelled signature.
- When you need one
- When the instrument or the contract says so, and only then. This is the one most often assumed: the RBI's 2026 Directions ask for testing by appropriately trained and independent experts and never require empanelment for it, and CERT-In appears once in the whole Direction, as a six-hour incident notification duty.
- Where SecureRoot sits
- SecureRoot is not CERT-In empanelled and will not blur that line. Where an empanelled signature is genuinely required, that auditor signs the formal report and we run the testing, the remediation and the retest that sit in front of it.
Licensed CPA firm
State licensing for public accountancy, working to the AICPA's attestation standards.
- Signs
- The SOC 2 report, Type I or Type II.
- When you need one
- Whenever a customer asks for a SOC 2 report. There is no version of SOC 2 that a security consultancy can issue; the report is an attestation and only a licensed CPA firm may make it.
- Where SecureRoot sits
- SecureRoot is not a CPA firm. We build the control set and the evidence base, then the CPA firm examines it and issues the report.
Accredited certification body
An accreditation body — NABCB in India, or an equivalent signatory to the IAF multilateral arrangement elsewhere.
- Signs
- The ISO/IEC 27001 certificate, after its own stage 1 and stage 2 audit.
- When you need one
- Whenever you want a certificate rather than an internal assurance that you would pass one.
- Where SecureRoot sits
- SecureRoot is not an accredited certification body. We implement the management system and run the internal audit; the certification body audits you and issues the certificate. SecureRoot holds ISO/IEC 27001:2022 certificate IN60432E for its own management system — that audit was of this firm, and it says nothing about any client's.
The empanelment row is the one most often assumed rather than checked. Which instrument reaches a given regulated entity, and what each asks of testing, is worked through in penetration testing for regulated firms, and the nine checks that separate a test from a scan are in how to choose a VAPT company in India.
In practice
What to do when a customer asks
The request usually arrives as one sentence in a procurement email. The sentence tells you which signature you need, and therefore which firm you are actually shopping for.
“Send us your SOC 2.”
- Signed by
- A licensed CPA firm.
- What we do
- Readiness, the control set, the evidence base, and the gaps closed before the examination.
“We need your PCI DSS ROC.”
- Signed by
- A QSA. If your level allows a SAQ, your own officer signs that instead.
- What we do
- Scope reduction, segmentation testing, and the Requirement 11 penetration test with its retest.
“Are you ISO 27001 certified?”
- Signed by
- An accredited certification body.
- What we do
- The management system, the internal audit, and the remediation before stage 2.
“Our tender needs a CERT-In empanelled auditor.”
- Signed by
- A CERT-In empanelled auditing organisation.
- What we do
- The testing and remediation in front of that audit. Send us the clause on the call and you get a straight answer in that call.
What we sign
Three documents SecureRoot does put its name to
None of these replaces the four above. They are what the four read when they arrive.
- The test report, with a reproduction for every finding, a justified severity graded with CVSS v4.0, and a fix that names the component to change.
- The verified retest report, which records what closed and what still stands, inside the same engagement rather than on a second purchase order.
- An attestation letter stating what was tested, when, by whom and to what method — for a customer, a partner or a board pack, and never as a substitute for any of the four signatures above.
Questions
What buyers ask about signatures
Can a security consultancy sign our SOC 2 report?
No, and no consultancy can. A SOC 2 report is an attestation made under the AICPA's standards, and only a licensed CPA firm may issue one. That is true of both types: a Type I describes whether the controls are suitably designed at a point in time, and a Type II tests whether they operated effectively across a review period, usually three to twelve months. Both are signed by the CPA firm, not by whoever helped you prepare. What a consultancy does is the work in front of the examination: building the control set, assembling the evidence base, and closing the gaps that would otherwise become exceptions in the report. SecureRoot is not a CPA firm, so a licensed CPA firm issues any SOC 2 report for our clients. If a vendor says they will deliver the report itself, ask which licensed firm signs it, because somebody has to.
Do the RBI's 2026 Directions require a CERT-In empanelled auditor for VAPT?
No. Para 122 of the NBFC Directions asks for vulnerability assessment and penetration testing by appropriately trained and independent information security experts or auditors. It does not mention empanelment, and CERT-In appears once in the whole Direction, at para 141, as a duty to notify incidents within six hours. Independence and competence are the test, evidenced by the scope document, the method, the testers' credentials and the retest record. The cadence that goes with it is para 121: vulnerability assessment at least every six months and a penetration test at least once every twelve, on critical systems and customer-facing systems in the DMZ. Confirm which chapter reaches you first, because Chapter V carries the testing clauses and reaches the Top, Upper and Middle layers only. Empanelment does bind elsewhere, including SEBI CSCRF cyber audits, so check the instrument before buying against the wrong one.
What is the difference between a ROC and an SAQ, and who signs each?
A Report on Compliance is completed by a Qualified Security Assessor, an assessor company and individuals qualified by the PCI Security Standards Council, and your acquiring bank or card brand receives it together with an Attestation of Compliance. A self-assessment questionnaire is completed by your own organisation and signed by an officer of it. Which applies depends on your validation level, and that is set by your acquirer or the card brand rather than by you or your assessor. Volume is the usual driver: Visa's published criteria put a service provider above 300,000 transactions a year at Level 1, which most aggregators clear. SecureRoot is not a QSA and signs neither document. Our role sits on both sides of the assessment: the segmentation and penetration testing that Requirements 11.3 and 11.4 ask for, the remediation of what it finds, and the retest that closes it before the assessor arrives.
Who issues an ISO 27001 certificate?
An accredited certification body, after its own stage 1 and stage 2 audits. The accreditation comes from a body such as NABCB in India, or another signatory to the IAF multilateral arrangement, and it is worth checking which one, because an unaccredited certificate is a document rather than a recognised certification. The cycle continues after the certificate too: surveillance audits in the following years and a recertification audit at the end of the three-year cycle. A consultancy implements the management system, runs the internal audit and fixes what it finds, and that work is deliberately separate from the certification audit, because the body that certifies you may not also have built what it is certifying. SecureRoot holds ISO/IEC 27001:2022 certificate IN60432E for its own management system; that audit was of this firm and says nothing about any client's.
If SecureRoot cannot sign any of these, what does it actually put its name to?
The test report, the verified retest report, and an attestation letter stating what was tested, when, by whom and against which method. The test report carries a reproduction for every finding, a severity graded with CVSS v4.0 and a fix that names the component to change; critical findings reach you within three hours of discovery rather than at the end of the engagement. The retest sits inside the same engagement rather than on a second purchase order, and the retest report records what closed and what still stands, which is the document an auditor or a regulator file actually wants. The attestation letter is useful for a customer, a partner or a board pack. None of the three is a substitute for a ROC, a SOC 2 report, an ISO certificate or an empanelled auditor's signature, and anyone offering you one of those four under a different name is selling something else.
Why does this page list what SecureRoot cannot do?
Because the alternative costs buyers money, in both directions. The four signatures come from four different bodies, and a buyer who confuses them purchases the wrong engagement: a consultancy that cannot sign the document their acquirer is waiting for, or an empanelled auditor for an obligation that never asked for one, at a price the obligation did not require. The second mistake is the quieter one, because nothing goes wrong until someone reads the instrument and finds that independence and competence were the test all along. Stating the constraint up front is also the only way to be useful on this question, since a firm that leaves it vague is hoping you will not ask until after the contract is signed. Where a signature is needed, the qualified firm signs it, and we say which one before you buy rather than after.
Send us the clause and we will tell you who has to sign it
Paste the sentence from the tender, the questionnaire or the regulator’s circular. You get a straight answer on which of the four signatures it requires, whether we can do the work in front of it, and a written scope and fixed price if we can.