In short
Government websites and apps in India follow GIGW 3.0, the Guidelines for Indian Government Websites and Apps. It covers four areas: quality, accessibility, cybersecurity and lifecycle management. In practice, a vendor must deliver WCAG 2.1 Level AA accessibility, pass a security audit and get a safe-to-host certificate before go-live, and host on approved infrastructure in India. Software for government also faces the Rights of Persons with Disabilities rules, MeitY cloud rules and GeM purchasing rules.
Who it applies to
- GIGW 3.0: all websites and apps owned by government organisations, at central, state, district and local level. Browser-based intranet applications are recommended to follow it too. Each guideline says whether the organisation, the developer or the evaluator must act.
- Accessibility rules: every establishment covered by the Rights of Persons with Disabilities Act, 2016, for its websites, apps and ICT products.
- MeitY cloud rules: government departments buying cloud services, and the providers selling them.
- GeM: central ministries and departments buying goods and services. Public sector undertakings, autonomous bodies and states often have their own procurement manuals, so read the tender.
What it means for your website
Accessibility
GIGW 3.0 requires conformity with Level AA of WCAG 2.1. Rule 15 of the RPwD Rules, as amended in 2023, also requires websites and apps to comply with IS 17802 Part 1 (requirements) and Part 2 (determination of conformance). In practice: proper headings and labels, text alternatives for images, keyboard access, enough colour contrast, captions for video and accessible documents.
A draft RPwD (Amendment) Rules, 2026 was published on 20 July 2026. It would require an accessibility conformance report on the website and stop government bodies buying non-compliant ICT. It is still a draft, but tenders may start asking for such reports.
Security and the safe-to-host certificate
GIGW 3.0 includes a cybersecurity chapter written by CERT-In. It draws on ISO 27001, OWASP and CIS benchmarks, and later CERT-In advisories count as updates to it. Before go-live, the organisation must get a safe-to-host certificate from auditors empanelled by CERT-In or STQC, from STQC’s own auditors, or from NIC.
Quality certification
GIGW 3.0 forms the basis for the Certified Quality Website (CQW) certification from the STQC Directorate. Organisations can obtain it to show conformity, and STQC publishes a list of compliant websites.
Integration with public digital infrastructure
GIGW 3.0 gives guidance on connecting to shared services such as DigiLocker, Aadhaar-based identity and single sign-on. Tenders may ask for these in place of separate logins.
What it means for your software
Web applications and mobile apps
GIGW 3.0 covers web portals, web applications and mobile apps, not only informational sites. Its security chapter applies to all of them. IS 17802 also covers software and apps, so internal screens used by staff with disabilities need the same care as public pages.
Security audit before go-live
Build time for the audit into the plan. Agree with the department and host where the audit will run, usually a staging environment that mirrors production. Allow for fixing and retesting what the auditor finds, because the certificate must be in hand before production. Secure coding against OWASP risks, hardened servers and logging make the audit shorter. See VAPT and CERT-In Directions for the incident reporting and log duties that also apply.
Hosting on MeitY-empanelled cloud
Government departments may only buy cloud services from providers empanelled by MeitY and registered on GeM. Empanelment involves a detailed assessment and an STQC audit of the provider’s services and data centres. Approval lasts three years, with an annual surveillance audit. Providers can be empanelled for public cloud, virtual private cloud or government community cloud, under IaaS, PaaS or SaaS.
Ask the provider to confirm in writing that every service your architecture uses, such as a managed database or storage, is covered by its empanelment.
Data stays in India
MeitY’s cloud rules require all data functions and processing by the provider to happen only within India. Exporting data, including backups, is not allowed, and the duty flows down to subcontractors. Design so that logs, backups, monitoring and support tools also stay in India. Avoid third-party services, such as analytics or email, that send government data abroad.
Buying through GeM
Under Rule 149 of the General Financial Rules, 2017, central ministries and departments must buy goods and services available on GeM through GeM. Depending on value, buyers use direct purchase, the lowest-priced (L1) offer, or a bid or reverse auction. Demands may not be split to avoid these steps. Cloud providers, managed service providers and system integrators selling cloud to government must register on GeM.
Defence and sensitive projects
Defence, security and other sensitive projects add their own conditions, set by the organisation and its security staff. Expect vetting of the company and staff, limits on internet connectivity and foreign components, on-premises or isolated hosting, and strict control of source code and documents. Read these conditions before you bid, not after you win.
Checklist
- Read the tender for GIGW 3.0, accessibility, audit, hosting and GeM requirements before estimating.
- Design and test to WCAG 2.1 Level AA and IS 17802 from the first sprint.
- Follow the GIGW 3.0 cybersecurity chapter and current CERT-In advisories in code and server setup.
- Plan a staging environment and time for the security audit and retests.
- Get the safe-to-host certificate before production go-live.
- Host on a MeitY-empanelled cloud or the infrastructure the department specifies.
- Keep data, backups and logs in India, and remove services that send data abroad.
- Use DigiLocker, Aadhaar-based identity or single sign-on where the department asks.
- Prepare an accessibility conformance report, as the 2026 draft rules may require it.
- For defence or sensitive work, agree security, hosting and access conditions in writing first.
How Kreon helps
We build websites, portals and business software designed for GIGW 3.0 accessibility and security from the start, and we prepare applications for the independent audit the department arranges. We have deployed automation systems in the Indian defence sector, and we work within the hosting, access and security instructions each organisation sets.