Security Brigade is a CERT-In empanelled auditor authorised to issue the SBI Vendor Site Compliance Certificate (VSCC). We assess your application, network, and payment integration controls and deliver the signed Form C certificate required for SBI ePay and payment gateway merchant onboarding.
Trusted by India's leading enterprises
Where this sits
VSCC is a gate in someone else’s process. Understanding that shapes the whole engagement: the deliverable is a signed document with a deadline attached to a commercial launch.
Why this is quick when it is quick
Engagements of this shape fail their date in one of three ways, and none of them is the testing. The first is scope discovered late: the integration turns out to include a second environment, a partner-hosted component or a callback path nobody mentioned at scoping, and the assessment has to widen after it has started. The second is a finding that needs an architectural change and not a fix. Payment data written to an application log, a callback endpoint that authenticates the payload but not the caller, a shared credential across environments: for these the remediation is a week of engineering, not a configuration change. The third, and the most common, is a retest cycle that waits: fixes are made, nobody says so, and the retest is scheduled for the end, which turns a one-day verification into a fortnight of calendar. We plan against all three. Scoping asks specifically about environments, partner components and callbacks, not about systems. Findings are triaged on the day they are found so anything architectural surfaces first, while there is still time. And retests run continuously as fixes land, so the certificate follows the last fix instead of waiting for a scheduled pass. A short engagement is not a shallower one; it is one where nothing waited.
What is assessed
| State | What it means | What follows |
|---|---|---|
| The payment integration | The checkout, callback, refund and reconciliation paths, including how the integration authenticates both directions and what it trusts from the other side. | The area that most often produces a material finding, because callbacks are commonly built to verify the payload and not the caller. |
| The application | Authentication, session handling, authorisation on every path that touches an order or a payment, and input handling across the transaction flow. | Passes cleanly where the application was tested before, and produces the long tail of findings where it was not. |
| Payment data handling | What is stored, what is logged, what reaches analytics and what crosses to a third party, in transit and at rest, across every environment. | Logging is the recurring finding. Card and payment data written to application logs is easy to fix and hard to see without looking. |
| Network and infrastructure | Exposed services, management interfaces, segregation between environments and credential handling around the payment estate. | Usually the cleanest area, and the one where a shared credential across environments is the thing that holds up a signature. |
After the certificate
The application and infrastructure testing behind the certificate is the same evidence an ISO 27001 ISMS or a SOC 2 readiness programme needs for its technical controls. Produced once, it answers more than one question.
Most organisations that need one payment-gateway certification need another within a year. The second is materially cheaper when the first left a tracked, retested evidence base instead of a PDF.
The data-handling assessment produces a map of what is stored, logged and shared across environments, which is the question every payment-related obligation eventually asks in some form.
A certificate proves a posture on a date. ShadowMap watches the internet-facing boundary continuously, so drift between assessments is visible, not discovered at the next one.
Methodology
Every engagement follows this process through Lemon, our proprietary audit management platform.
Security Brigade's VSCC methodology is built around one goal: delivering a valid, SBI-accepted certificate as quickly as possible without cutting corners on assessment depth. Every engagement follows a structured workflow managed through our Lemon platform, giving you real-time visibility into progress, findings, and remediation status.
We review your SBI integration scope, identify all in-scope applications, infrastructure, and payment flows, and map them against the full SBI VSCC checklist. This ensures complete coverage from day one with no surprises mid-assessment.
Our CERT-In empanelled auditors perform the core technical assessment: web application security testing, network vulnerability assessment, network penetration testing, SSL and encryption validation, firewall review, and data handling controls. B-52, our AI-powered audit engine, ensures consistent coverage across all checklist requirements.
All findings are documented with clear severity ratings, proof-of-concept evidence, and technology-specific remediation guidance. Findings are published to the Lemon client portal in real time. Our team provides hands-on remediation support to help your developers close gaps quickly.
Once your team marks findings as fixed in Lemon, our auditors retest each finding to confirm the fix is effective. Only confirmed fixes are marked as closed. This verified remediation evidence is critical for certificate issuance.
After all findings are closed and validated, we issue the signed and sealed VSCC certificate (Form C) along with the complete technical assessment report. The certificate package is formatted for direct submission to SBI as part of your merchant onboarding documentation.
"We ship 50 deploys a week. Traditional pentesting firms take three weeks to deliver a report that's already stale. Security Brigade's B-52 engine generates structured test plans and validates coverage in days, not weeks. Their AI doesn't replace testers — it makes sure nothing gets missed. We've caught business logic flaws in our payment orchestration that SAST and DAST both labelled 'low priority.'"
Continuous Compliance with ShadowMap
An annual audit proves your posture at a single point in time. Between audits, attack surfaces drift, credentials leak, sub-domains get added, vendors get breached. ShadowMap watches the boundary continuously so the next audit isn't a surprise.
FAQ
What it is, how long it takes, and what decides the date. Talk to our team if you have a launch to hit.
Contact usTalk to a CERT-In empanelled auditor today. We will scope your assessment, provide a fixed-fee quote, and get you on the fastest path to your VSCC certificate.
Typically responds within 1 business day · No commitment required
