Your ₹80K GIGW Audit Passed. 11 of 25 Checks Were Skipped

TL;DR: A GIGW 3.0 compliance certificate can look flawless on paper. It can also leave critical quality, security, and lifecycle checks untested. Most "GIGW audits" are really WCAG accessibility scans dressed in GIGW branding. Founders and procurement leads need a five-step contract checklist. They need to demand a STQC-aligned assessment before signing the cheque.

Key Takeaways: - GIGW 3.0 has four pillars. These are Quality, Accessibility, Security, and Lifecycle. But most auditors test only the accessibility pillar. Then they call it a GIGW audit. - Automated scanners cannot catch navigation failures. They also miss reflow issues or device lock-in. Those need manual testing with screen readers and real-device orientation checks. - A failed certificate found after launch is a documented compliance breach under the RPwD Act 2016. It is not a defendable position.

A vendor issues a GIGW compliance certificate. Then the portal launches. Months later the client finds that 11 of the 25 required quality checkpoints were never tested. The certificate was real. The audit was not.

This is a structural pattern in the Indian government website audit market. A GIGW 3.0 audit covers four pillars. Quality has 25 checkpoints. Accessibility has 50 WCAG 2.1 Level AA criteria. Security is CERT-In aligned. Lifecycle has 10 policies. Most vendors collapse all four into a single accessibility scan. Then they issue a branded certificate.

The portal looks compliant. The framework looks respected. The money looks spent.

The silent failures pile up where the scanner never looks. Unmarked headings break screen reader navigation. Missing skip links force keyboard users to tab through every menu item on every page.

Fixed portrait orientation locks out users who need landscape on mobile. Non-responsive layouts fail at 320px width. Print-unfriendly content breaks the right of every citizen to download a form and file it offline.

Each maps to a real WCAG criterion. These are 1.3.1, 2.4.1, 2.4.7, 1.3.4, or 1.4.10. The scanner either flags them as "manual review needed" or misses them entirely. The same pattern shows up in our 9 WCAG 2.2 Criteria Your ₹50K Audit Skipped analysis. Budget audits quietly ignore the criteria that need human judgment.

The certificate looks legitimate because it follows GIGW 3.0 branding. The problem is not the framework. It is what auditors choose to skip inside it.

The vendor selection process is where this gap gets created or closed. Our guide to the top accessibility audit companies in India shows how to vet it.

GIGW 3.0 was put together jointly by NIC, the STQC Directorate under MeitY, and CERT-In. That joint authorship matters because it bakes four separate evaluation disciplines into one standard. Quality covers 25 checkpoints spanning design, content, navigation, and technical hygiene.

Accessibility adopts 50 WCAG 2.1 Level AA criteria. Security aligns with three CERT-In advisory areas, updated through the year. Lifecycle Management demands 10 policies covering ownership, archival, content governance, and renewal.

An axe-core scan or a Wave report covers a small part of the accessibility pillar. It also covers zero of the other three. A GIGW audit that runs for two days and delivers a PDF is testing one pillar. It then infers the rest.

Manual testing fills gaps. Scanners by their nature cannot see those gaps. Navigation flows need someone to tab through the portal with a keyboard. Orientation needs someone to rotate a real device and confirm the layout adapts.

Reflow needs zooming to 400% and reading every line. Content relationships need a human check that a heading, label, and form input connect. No algorithm can replace a certified IAAP tester with NVDA, JAWS, or TalkBack open on a second monitor.

This is the same gap we covered in WCAG 2.2 Compliant, Screen Reader Broken: The Audit Gap. The pattern is compliance on paper, broken in practice.

The economic incentive explains the gap. A budget engagement buys a scanner subscription, a templated report, and a junior consultant's time.

A STQC-aligned assessment needs certified accessibility professionals. It also needs security engineers familiar with current CERT-In advisories. And policy reviewers who can audit a WIM (Website Information Manager) handover process. The work that matters most is the work the cheapest quote will not perform.

This is why the same government portals run for years after launch with the same defects. No one re-tested. No one caught the drift.

The certificate aged on the wall while the website aged in the wild.

The fix is not a better scanner. The fix is knowing which checks the scanner will never catch.

The 25 GIGW Quality checkpoints are not a secret. They are published in the GIGW Compliance and Certification Handbook. What is rarely public is which 11 of those 25 get skipped in a typical budget audit.

The first cluster is navigation. Unmarked headings break the semantic structure that screen readers depend on. Missing skip links force keyboard-only users to traverse the entire header on every page load.

Inconsistent breadcrumbs break WCAG 2.4.1 (Bypass Blocks) and 2.4.7 (Focus Visible). These checks need a human to navigate the portal as a citizen with a disability would. Then they need to document the failure mode.

A scanner reports "potential issue" and moves on. The auditor reports "passed" without testing.

The second cluster is device lock-in. Fixed portrait orientation breaks WCAG 1.3.4. Non-responsive layouts break 1.4.10 (Reflow).

Print-unfriendly content fails the GIGW quality checkpoint for A4 print compatibility. This is a specific STQC requirement, not a WCAG criterion. These are not edge cases.

Government portals are accessed on entry-level Android phones. They are often held sideways at ration shops, Aadhaar centres, and Common Service Centres. A portal that breaks in landscape excludes a citizen.

The third cluster is lifecycle. The 10 lifecycle policies cover ownership handover, archival schedules, content governance, periodic review, and disaster recovery.

Most budget audits never open the policy binder. They assume the policies exist because the pitch deck mentions them.

CERT-In advisories change mid-year, often more than once a year. They never trigger a re-test, so the security pillar lapses the moment the certificate is issued.

Then there is the hosting boundary. GIGW requires that infrastructure sit within Indian geographical boundaries. Few auditors check the actual server location or backup residency.

Even fewer check the jurisdiction of CDN edge nodes. A portal can pass its accessibility scan and quietly route citizen data through Singapore.

The shift from diagnosis to procurement is now unavoidable. What should the audit contract actually demand?

A real GIGW 3.0 audit is a five-step engagement, not a single output. Each step has a specific output the contract should name.

Step one is a gap assessment scored against all 25 quality checkpoints, not a WCAG-only scan. The vendor must produce a matrix showing every checkpoint. It must also show its pass/fail status, the evidence reviewed, and the fix needed. A one-page summary is not a gap assessment.

Step two is manual accessibility testing. Real screen reader sessions: NVDA on Windows, JAWS on enterprise installs, TalkBack on Android. PDF/UA check for every downloadable form. Why? Because a portal that meets WCAG but ships inaccessible PDFs has not met GIGW.

The auditor's report should name the assistive technology, the version, and the test scenarios run.

Step three is CERT-In-aligned VAPT. Not a generic OWASP Top 10 scan. The report should name the current CERT-In advisories in force at audit time. It should also show how each was tested.

The Safe-to-Host certificate, if issued, must tie to this VAPT, not backdate to a generic pentest.

Step four is a phased fix roadmap with WIM training. A defect list is not a roadmap. The vendor should specify which fixes ship in phase one, two, and three.

WIM training ensures the client's team can maintain compliance between audits.

Step five is quarterly monitoring dashboards after certification. CQW certification from the STQC Directorate is not permanent. It needs periodic renewal and continuous monitoring.

Vendors who offer post-certification dashboards have built the renewal cycle into their service. Vendors who disappear after the certificate do not. Vetting long-term posture is exactly what the top accessibility audit companies in India rankings are designed to surface.

The five steps above are the floor. The next question is how to tell which vendor will actually deliver them.

The audit contract is a trust instrument. The procurement process is where trust gets checked. Five questions separate the STQC-aligned vendors from the template-shops.

Question one: ask for a sample report. Count how many of the 25 quality checkpoints are individually scored. If the sample shows a single accessibility score, the vendor is selling a WCAG scan with GIGW branding.

Move on.

Question two: confirm the team composition. Are there certified IAAP accessibility testers on the engagement? Or are there only QA engineers who learned axe-core last quarter? Accessibility is a professional discipline, not a plugin.

Question three: check CERT-In empanelment and STQC audit experience. The vendor should be on the CERT-In empanelled list. They should also have prior CQW certification pathways in their track record.

Cross-check this against curated rankings of the top accessibility audit companies in India rather than relying on cold proposals. A vendor list put together from public empanelment data and verified client references will outrank any cold proposal you receive.

Question four: ask what happens after the certificate. Is post-certification monitoring included? Does the vendor commit to periodic re-testing when CERT-In advisories update?

GIGW needs renewal. A vendor who treats the certificate as the end-state will leave you exposed at month 13.

Question five: read the contract's liability clause. If the certificate turns out to be wrong, who pays for the fix and the reputational damage? Cheap vendors exclude this clause by default.

Even a rigorous audit leaves one question unanswered for the founder signing the contract.

That question is liability. A GIGW certificate is not just a procurement badge. Under the RPwD Act 2016, accessible government services are a legal duty, not a quality preference.

A citizen who cannot access a government portal because the audit missed a navigation checkpoint has grounds for a complaint. A documented GIGW certificate that failed in practice strengthens that complaint, not weakens it.

We have written about this mismatch in WCAG 2.2 Compliant, RPwD Rejected: The Gap That Hurts. It shows how technical compliance and legal compliance diverge.

The founder's exposure grows. Contractual penalties with the government client are the first hit. Removal from the empanelled-vendor pool is the second.

Reputational damage in the small circle of Indian government IT procurement is the third. Litigation under the RPwD Act, while rare, is the fourth and most public.

The upside is real and concrete in the other direction. Portals that pass a real GIGW 3.0 audit become referenceable assets.

Government clients vet vendors through previous CQW certifications. A clean audit opens the door to the next 50 tenders. The difference between the cheap audit and the real one is the difference between one contract and a pipeline.

The same logic drives security-critical systems across Indian banking. In that space, audit trails are expected to hold up under regulatory scrutiny. Your GIGW audit should hold up the same way. The procurement contract is where you make sure it does.

Q: What are the 4 pillars of a GIGW 3.0 audit?

A: GIGW 3.0 structures compliance across four pillars. Quality has 25 checkpoints. Accessibility has 50 WCAG 2.1 Level AA criteria. Security has three core areas aligned with CERT-In advisories. Lifecycle Management has 10 policies covering ownership, archival, and renewal. A real audit must score each pillar separately. It must not collapse them into a single accessibility scan.

Q: How is GIGW 3.0 different from WCAG 2.1 or WCAG 2.2?

A: GIGW 3.0 is the Indian government framework put together jointly by NIC, the STQC Directorate under MeitY, and CERT-In. It adopts WCAG 2.1 Level AA as its accessibility baseline. On top of that, it layers quality, security, and lifecycle requirements. A WCAG audit alone does not satisfy GIGW. It only covers the accessibility pillar.

Q: Who is required to comply with GIGW in India?

A: GIGW applies to government organisations at central, state, district, and local levels. It also includes any vendor, developer, or agency building websites, portals, web applications, or mobile apps on their behalf. PSU portals and municipal corporation sites fall within scope.

Q: What is the RPwD Act penalty for inaccessible government portals?

A: The Rights of Persons with Disabilities Act 2016 requires accessible government services. It also empowers persons with disabilities to seek enforcement. Penalties vary by case. But documented non-compliance after a GIGW certificate is issued creates a clear breach record. That record strengthens any complaint or litigation.

Q: How long does a real GIGW 3.0 audit take?

A: A STQC-aligned GIGW 3.0 audit takes time in proportion to the portal's page count, document inventory, and mobile app scope. Each quality checkpoint and lifecycle policy needs individual evidence review. Any delivery squeezed into a few days almost certainly means the quality and lifecycle pillars were not tested manually.