After the OnMark Breach: Security Standards Universities Must Demand from Exam Platform Vendors

What the CBSE Breach Actually Revealed

In 2026, the Central Board of Secondary Education deployed a digital evaluation platform called OnMark, operated by Hyderabad-based Coempt Edutech Pvt Ltd, for its Class 12 board examination results. In May 2026, a cybersecurity researcher demonstrated that they had gained full create, read, update, and delete (CRUD) access — as well as shell access — to the platform's production servers in approximately 30 minutes.

The vulnerabilities were not obscure or difficult to discover. The researcher found hardcoded master passwords, an OTP bypass that allowed access without valid credentials, and answer book images stored in unencrypted cloud storage without access controls. These are not zero-day vulnerabilities. They are the kind of basic security failures that a structured security audit would identify in the first hour of testing.

The researcher had formally reported vulnerabilities through official channels in February 2026. No meaningful response was received. When the results were announced in May and students began reporting wrong answer sheets, blurred scans, and unexpected marks, the platform became a national controversy. CBSE's Chairman and Secretary were transferred. The contract with Coempt Edutech was terminated. A parliamentary committee heard testimony from a Class 12 student who documented 15 alleged discrepancies in the original procurement tender. The board was left managing 70,000+ revaluation applications on hastily-assembled government infrastructure.

The lesson for India's universities is not that digital evaluation is unsafe. The lesson is that digital evaluation deployed without adequate security validation is catastrophically unsafe, and that the consequences fall on students who trusted the system.

Why Exam Platforms Are High-Value Targets

Digital evaluation platforms store data that is valuable to multiple categories of bad actors.

Marks manipulation. A platform with inadequate access controls allows someone to alter marks after evaluation — either to benefit a specific student for financial gain or to harm a student as targeted sabotage. In a manual system, altering a mark requires physical access to an answer book and multiple co-conspirators. In a poorly secured digital system, it can be done remotely by anyone with the right access.

Bulk data exfiltration. Answer book images, student identity information, and evaluation data are held in large volumes on exam platforms. This data has value for academic fraud, targeted impersonation, and in some contexts, extortion.

Service disruption. A ransomware attack or deliberate disruption timed to coincide with results publication creates enormous institutional and student harm. The CBSE revaluation portal was taken offline by a cyberattack in June 2026, forcing the board to re-architect its infrastructure under time pressure.

Credential harvesting. Evaluator accounts on exam platforms often use institutional email credentials. A platform that does not enforce strong authentication becomes a vector for broader institutional credential compromise.

Given this threat profile, treating an exam platform as a generic web application with standard commercial hosting practices is a category error. Exam platforms require security treatment equivalent to financial systems or health records platforms — because the data they hold and the decisions they enable are comparably consequential.

The Standards That Should Be Non-Negotiable

Universities evaluating or procuring digital evaluation platforms should require explicit documentation of compliance with the following standards and practices:

CERT-In Empanelment for Security Auditors

The Indian Computer Emergency Response Team (CERT-In) maintains a list of empanelled security auditors who are authorised to conduct information security audits for organisations subject to Indian regulatory requirements. Any security audit of an exam platform should be conducted by a CERT-In empanelled organisation, not by the platform vendor's internal team or an unapproved third party.

The audit scope should include penetration testing of the web application, API security assessment, infrastructure configuration review, and access control verification. The OnMark platform was not demonstrably subject to a CERT-In empanelled audit before deployment. A university that receives a security audit report from a non-empanelled auditor or from the vendor's own team has not received meaningful independent assurance.

ISO/IEC 27001 Certification

ISO 27001 is the internationally recognised standard for Information Security Management Systems. It requires organisations to establish, implement, maintain, and continually improve a documented information security management system, including formal risk assessment processes, access control policies, incident response procedures, and regular internal and external audits.

Certification is issued by accredited certification bodies after a formal assessment. A vendor that holds valid ISO 27001 certification — not one that is merely "ISO 27001 compliant" without certification — has demonstrated to an independent assessor that their security management processes meet the standard's requirements.

For exam platforms, ISO 27001 certification should cover the infrastructure and processes that handle answer book images, evaluation data, and student records. Vendors that hold certification for peripheral operations but not for the core examination data processing environment have not provided adequate assurance.

Application-Level Security Requirements

The CBSE OnMark breach exploited application-level vulnerabilities that are well-documented in the OWASP Top 10 — the Open Web Application Security Project's list of the most critical security risks in web applications. A properly developed and audited application should demonstrate that it is free from:

Universities should require vendors to provide a current OWASP-based security assessment report, ideally from within the past 12 months, showing that these vulnerability classes have been assessed and that identified issues have been remediated.

Data Residency and Encryption Requirements

Answer book images and evaluation data for Indian examinations should be stored on infrastructure physically located within India, in compliance with the Digital Personal Data Protection Act 2023 and applicable UGC and state regulatory requirements. Vendors should provide explicit contractual commitments to India data residency, not just assurances that data is "secure."

Data at rest — stored answer book images, marks data, evaluator credentials — should be encrypted using current standards (AES-256 or equivalent). Data in transit between the university, evaluators, and the platform should be encrypted using TLS 1.2 or higher. Vendors should provide documentation of their encryption implementation, not just assertions.

Multi-Factor Authentication and Access Controls

Every evaluator, administrator, and university officer accessing the platform should authenticate using multi-factor authentication (MFA). The OnMark breach involved an OTP bypass — a failure to enforce MFA correctly. A platform that allows any access to production systems without functioning MFA has a fundamental authentication weakness.

Access controls should implement the principle of least privilege: evaluators see only the scripts assigned to them, administrators see only the institutions they manage, and no single credential should provide system-wide access to all records. Vendors should be able to demonstrate their access control model with documented role definitions and audit logs.

Incident Response and Breach Notification Commitments

The service agreement with an exam platform vendor should include explicit incident response commitments: what the vendor will do in the event of a security incident, what timeline they commit to for breach notification, and what forensic access the university will have to understand the scope of an incident.

The CBSE situation involved the board learning about vulnerabilities through public disclosure by a researcher rather than through the vendor's own monitoring and reporting. This is a governance failure. A properly constructed service agreement includes the vendor's obligation to notify the university within a defined timeframe — typically 72 hours under most breach notification frameworks — of any security incident that may have affected the platform or the data it holds.

How to Evaluate Vendor Security Responses

When a university asks a vendor for security documentation, vendor responses reveal a lot about their actual security posture. The following response patterns are warning signs:

"Our platform is secure" without documentation. Any vendor can assert security. The question is what evidence they can produce. A vendor that responds to a security questionnaire with assurances rather than documentation does not have the documentation.

Security audits conducted by the vendor's own team. An internal security review is not equivalent to an independent third-party audit. Exam platforms for high-stakes examinations require independent assessment.

Certifications that do not cover the relevant scope. An ISO 27001 certification for a vendor's internal IT systems does not cover the exam platform they are selling. Ask specifically what scope the certification covers.

"We will remediate that before go-live." Vendors asked about known vulnerabilities sometimes commit to remediation before deployment. This commits them to nothing verifiable unless the university requires a post-remediation audit by an independent party before deployment.

Reluctance to provide contractual data residency and breach notification commitments. A vendor that resists putting these commitments in writing has calculated that the contract terms are disadvantageous to them. Universities should understand why.

The Procurement Process Is the Control Point

The CBSE situation involved a vendor that won a contract over stronger competitors, including Tata Consultancy Services, with questions raised about how the procurement criteria were written. A student testified to the Parliamentary Standing Committee on Education that the tender documents contained 15 discrepancies that appeared to favour the eventual winner.

Universities do not face the same political procurement dynamics as a national board, but they face their own pressures around cost and speed. The temptation to accept the lowest bidder's assurances at face value is real, particularly when examination deadlines are approaching and a platform needs to be operational.

The only remedy is a procurement process that builds security validation into the evaluation criteria before price is considered. A vendor that cannot produce a current independent security audit, ISO 27001 certification for the relevant scope, contractual data residency commitments, and documented MFA implementation should not advance to price comparison regardless of what they quote. The cost of a security failure — revaluation applications, student harm, regulatory scrutiny, leadership accountability — dwarfs any saving on the platform contract.

The Nilekani task force's recommendations, which include mandatory security audits and standardised technical requirements for examination platforms, point in this direction. Universities that build these requirements into their procurement standards now will be positioned ahead of the regulatory requirements that are emerging from the post-2026 examination crisis.

---

Related Reading