India Needs a National Certification Standard for Examination Platforms

The Gap the CBSE Crisis Revealed

When the CBSE on-screen marking (OSM) system failed in May 2026 — producing blurred scans, mismatched answer sheets, a portal that crashed under revaluation requests, and eventually a cyberattack that hit 1.5 million times in two minutes — public attention focused on the vendor: Coempt Eduteck, a company with no prior track record in national-scale examination technology.

The IIT Madras security audit, the parliamentary committee hearings, and the Supreme Court proceedings all drew the same conclusion: the system was not ready for national deployment. But they did not fully address why a system this unprepared was ever deployed at scale — and what prevents the same outcome from happening at any of India's 900-plus affiliating universities, 500-plus autonomous colleges, and 29 state examination boards that are now actively evaluating examination platform vendors.

The answer lies not in individual vendor failure but in a structural absence: India has no minimum certification standard for examination platforms.

What "No Standard" Means in Practice

Today, when a university's examination controller evaluates proposals from examination software vendors, they are evaluating claims — not certified capabilities. A vendor can assert that their system supports 10,000 concurrent evaluators. There is no independent body that has tested and certified this claim. A vendor can promise ISO 27001-grade security. There is no accreditation body that verifies this in the context of examination data handling. A vendor can claim VAPT (vulnerability assessment and penetration testing) compliance. The test may have been conducted by the vendor's own development team.

The result is procurement by assurance rather than by evidence. Universities sign multi-year contracts based on demonstrations, referrals, and assurances rather than independently verified capability certificates.

This is not a hypothetical risk. The CBSE Coempt Eduteck contract was awarded through a competitive tender process that evaluated proposals and conducted demonstrations. The system still failed at scale because the procurement process did not require proof of performance under actual examination conditions.

What Other Countries Have Done

India is not the first country to face this problem, and other examination bodies have developed responses worth studying.

United Kingdom: Centre Assessment Standards Scrutiny (CASS)

UK exam boards that operate digital assessment platforms must meet standards set by Ofqual, the Office of Qualifications and Examinations Regulation. Ofqual's General Conditions of Recognition require exam boards to maintain documented evidence that their digital systems meet specific reliability, accessibility, and security standards. Vendors supplying technology to UK exam boards are contractually required to provide evidence of compliance with these conditions.

Singapore: Government Technology Stack Certification

Singapore's Ministry of Education mandates that educational technology systems handling student data meet the Government Commercial Cloud security framework, with independent third-party assessments required before deployment at scale. The Singapore Examinations and Assessment Board (SEAB) operates its digital examination platforms under these standards, and any commercial vendor integrated into those systems must demonstrate compliance.

United States: FERPA and State Educational Agency Standards

While not a single national examination standard, US state educational agencies that procure digital assessment platforms must demonstrate compliance with the Family Educational Rights and Privacy Act (FERPA). Several states (California, Texas, New York) additionally require independent security audits of assessment platforms before procurement. The Student Privacy Pledge, while voluntary, provides a minimum expectations framework that most credible assessment vendors commit to publicly.

In each case, the mechanism is similar: an independent body defines minimum standards, and vendors must demonstrate compliance before being permitted to participate in public examination procurement.

What a National Examination Platform Standard for India Should Cover

A framework suitable for India needs to address five areas where the CBSE 2026 experience identified specific failures.

1. Scanning Quality Standards

Blurred and illegible scans were among the most common complaints in the CBSE 2026 crisis. A certification standard should define minimum acceptable resolution (300 DPI minimum for handwritten answer scripts), maximum acceptable blur thresholds (measurable using standard image quality metrics), and required QC pass rates before an evaluation cycle can proceed. Platforms should be required to demonstrate these standards under simulated high-volume conditions — not just in controlled demonstrations.

2. Concurrent User Load Certification

Any platform certified for deployment in an examination with more than 1,000 evaluators should be required to demonstrate load-tested performance at 1.5 times the maximum expected concurrent user count. The IIT Madras audit of CBSE's system found that the portal was not stress-tested before the revaluation window opened — a basic step that load certification would have mandated.

3. Cybersecurity and Penetration Testing

Certification should require an annual VAPT conducted by a CERT-In empanelled organisation — not the platform vendor or their affiliates. Results should be submitted to the certifying body, with critical vulnerabilities resolved before the certificate is issued. The CBSE portal suffered a significant cyberattack during the revaluation period. Independent VAPT certification would have surfaced these vulnerabilities before deployment.

4. Audit Trail Completeness

Every action in a certified examination platform — scan upload, evaluator assignment, mark entry, score modification, moderation, result publication — must be logged with timestamps and user identities in an immutable audit trail that is exportable for RTI responses and regulatory audits. This is not a technically demanding requirement. It is a basic data governance standard. But without certification requirements, some platforms omit it entirely or implement it in ways that are easy to modify.

5. Data Portability and Continuity

One of the least visible failures in the CBSE 2026 crisis was the difficulty of accessing historical data when the primary vendor's system became unavailable. A certification standard should require that all examination data — scanned images, mark records, audit logs — be exportable in a standard format that can be read by any other certified platform. This prevents vendor lock-in from creating an impossible situation when a contract is terminated or a vendor fails.

Who Should Issue the Certification

Two existing organisations are well-positioned to issue a national examination platform certification.

STQC (Standardisation, Testing and Quality Certification) is a directorate under the Ministry of Electronics and Information Technology (MeitY) that already certifies IT products and systems for government deployment. STQC has the technical infrastructure to develop and administer an examination platform certification programme, and government examination bodies procuring certified platforms would be on strong ground from a compliance standpoint.

BIS (Bureau of Indian Standards) has existing IS standards for software quality and information security management. An IS standard specifically for examination management software — covering the five areas above — would create a publicly referenced framework that private universities, state boards, and regulatory bodies could reference in procurement criteria.

The most practical near-term path is a joint MeitY-MoE working group that defines minimum standards and empowers STQC to issue certificates, with a phase-in period of 18-24 months before certification becomes mandatory for public examination procurement.

What Universities Can Do Right Now

A national certification framework does not exist yet. That does not leave examination controllers without recourse.

The gap can be partially filled through procurement requirements. Universities evaluating examination platform vendors can write the equivalent of certification requirements into their RFP (request for proposal) documentation — requiring vendors to provide:

This is not a substitute for national certification, but it elevates procurement beyond the current norm of vendor demonstrations and unverifiable claims.

The Systemic Argument

India processes over 50 crore examination scripts annually across boards and universities. This is high-stakes infrastructure. A student's ability to access higher education, employment, and professional licences depends on the accuracy and integrity of examination results.

The market for examination software in India has grown rapidly in the post-2020 period, with dozens of vendors now competing for contracts. Most of this competition is healthy. Some of it is not — underprepared vendors winning contracts at institutions that lack the technical expertise to evaluate platform readiness.

National certification would not end competition. It would set a floor below which no platform may operate in public examination procurement. Everything above that floor remains a competitive market where platforms differentiate on features, usability, scale, and price.

After the CBSE 2026 OSM crisis — with its parliamentary committee hearings, Supreme Court proceedings, IIT audit, and 4 lakh revaluation requests — the case for that floor has been made clearly enough. The question is whether the institutional response will match the scale of the failure.

Related Reading