Step-by-Step Guide to Passing STQC Certification for Indian Government Portals (GIGW 3.0)
A practical roadmap for developers, IT heads, and government contractors preparing for STQC web certification under GIGW 3.0, WCAG 2.1 AA, and CERT-In guidelines.
Introduction: What is STQC Certification?
The **Standardisation Testing and Quality Certification (STQC) Directorate**, an attached office of the Ministry of Electronics and Information Technology (MeitY), Government of India, is the sole national accreditation body responsible for certifying Indian government portals and e-governance systems.
An STQC Web Certification (officially awarded as the **STQC Quality Mark**) signifies that a portal has undergone rigorous third-party auditing across four primary domains: 1. **Compliance with Guidelines for Indian Government Websites (GIGW 3.0)** 2. **Digital Accessibility under W3C WCAG 2.1 Level AA** 3. **Cybersecurity Hardening & Vulnerability Assessment (CERT-In baseline)** 4. **Performance, Quality, and Contingency Management**
Securing STQC certification is mandatory for any portal operating on `.gov.in` or `.nic.in` domains, and is a prerequisite for bidders participating in high-value Government e-Marketplace (GeM) tenders.
---
1. Governance & Policy Requirements (Clauses 1–18)
STQC auditors begin by inspecting the institutional governance metadata rendered in portal headers and footers. The following static elements must be present across all web templates:
- **National Identity:** Clear display of the State Emblem of India or Departmental Crest conforming to the State Emblem of India (Prohibition of Improper Use) Act, 2005.
- **Bilingual Requirement:** Primary navigation, core citizen advisories, and service forms must be accessible in both Hindi and English.
- **Mandatory Policy Links:**
- * **Copyright Policy:** Explicit statement detailing re-use rights of government gazettes and notifications.
- * **Privacy Policy:** Compliant with the Digital Personal Data Protection (DPDP) Act 2023, disclosing cookie usage, grievance officer contact, and data retention schedules.
- * **Hyperlinking Policy:** Clear disclaimer stating that external links do not constitute ministerial endorsement.
- * **Terms & Conditions:** Statutory disclaimers regarding official government announcements.
- * **Contingency Management Plan (CMP):** Documented disaster recovery procedures, downtime notification protocols, and defacement restoration workflows.
---
2. Digital Accessibility (WCAG 2.1 AA)
In adherence to the **Rights of Persons with Disabilities (RPwD) Act 2016**, GIGW 3.0 elevates accessibility to a non-negotiable legal requirement. Key test areas include:
Contrast Ratio * Standard body text must maintain a minimum contrast ratio of **4.5:1** against its background. * Large text (18pt or 14pt bold) must maintain at least **3.0:1**.
Keyboard Operability * Every interactive button, link, dropdown menu, and modal dialog must be fully navigable using the `Tab`, `Enter`, `Space`, and `Arrow` keys without encountering keyboard traps. * A prominent **"Skip to Main Content"** link must be the very first focusable element when loading the page.
Screen Reader Support * All `<img>` tags must feature meaningful `alt` attributes describing the image content. Decorative icons must feature `alt=""` or `aria-hidden="true"`. * Dynamic content updates (such as live form validation errors) must use `aria-live="polite"` or `role="alert"`.
---
3. Technical Security & CERT-In Hardening
STQC auditing includes mandatory vulnerability assessment and penetration testing (VAPT) performed according to CERT-In standards:
- **HTTPS Enforcement:** Port 80 (HTTP) must permanently redirect (HTTP 301) to Port 443 (HTTPS). Unencrypted HTTP endpoints are an instant failure.
- **Modern Cryptography:** Enforce TLS 1.2 or TLS 1.3. Completely disable deprecated SSLv2, SSLv3, TLS 1.0, and TLS 1.1 protocols.
- **Defensive Response Headers:** Deploy Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), and X-Frame-Options. Suppress `Server` and `X-Powered-By` headers.
- **Perimeter Hygiene:** Ensure non-public ports (SSH 22, MySQL 3306, RDP 3389) are inaccessible from the public internet.
---
4. The 4-Stage STQC Certification Lifecycle
flowchart LR
A["Stage 1: Internal Pre-Audit (SecPulse)"] --> B["Stage 2: Formal STQC Application"]
B --> C["Stage 3: Empanelled Lab Testing"]
C --> D["Stage 4: Clearance & Quality Mark"]1. **Stage 1: Internal Pre-Audit & Remediation:** Run automated assessments using CyberCheck India's pre-audit engine to detect contrast failures, missing GIGW links, and SSL weaknesses prior to submission. 2. **Stage 2: Application Submission:** Submit portal documentation, Contingency Management Plan, and agency undertaking via the STQC website. 3. **Stage 3: Formal Testing:** STQC auditors or a CERT-In empanelled auditing lab execute manual and automated compliance sweeps. A preliminary non-conformance report (NCR) is issued listing any findings. 4. **Stage 4: Verification & Certification:** The development agency resolves all NCR findings within 30 days. STQC issues the formal Certificate of Quality Compliance, valid for three years.
---
Summary Checklist
Before requesting formal STQC audit review: - [ ] Implement "Skip to Main Content" and test 100% keyboard navigation. - [ ] Verify color contrast across dark and light themes with 4.5:1 ratio. - [ ] Deploy HSTS with `max-age=31536000` and suppress server version headers. - [ ] Add bilingual language toggle and verified GIGW policy footers. - [ ] Run [CyberCheck Pre-Audit Scanner](/scan) and attach the generated compliance dossier to your submission.
Put this guide into practice on your domain
Launch the companion tool to verify your web configurations and receive actionable remediation guidance.