GIGW 3.0 Guidelines Checklist: What Indian Government Websites Must Meet

By Sonal Jain Published November 2, 2026 9 min read

The GIGW guidelines (Guidelines for Indian Government Websites and Apps) set the quality, accessibility, security and lifecycle requirements for government websites and apps in India; GIGW 3.0, released in March 2023, is the current version. It has 88 guidelines in four chapters: Quality (25), Accessibility (50), Cybersecurity (3) and Lifecycle management (10). The accessibility bar is WCAG 2.1 Level AA. Every website and app owned by a government organisation must comply, from central ministries to district administrations and local governments. The STQC Directorate certifies compliance under its Website Quality Certification Scheme.

Part of Vervali's accessibility cluster: this is the India government websites spoke under our WCAG 3.0 accessibility compliance guide, alongside the guide to accessibility standards and guidelines for the banking sector and the accessibility testing services guide.

STQC's transition plan of 23 May 2023 records the March 2023 release and the chapter counts, and its memorandum of 24 November 2025 sets the current rule on who writes the accessibility review report each GIGW evaluation needs.

What You'll Learn

What GIGW is and who must comply

The GIGW 3.0 checklist by chapter, with what to test

How STQC certifies a site, and how GIGW differs from IS 17802

What is GIGW 3.0?

What does GIGW stand for?

GIGW stands for Guidelines for Indian Government Websites and Apps. The National Informatics Centre (NIC) formulated the first version in 2009 as Guidelines for Indian Government Websites, and the GIGW portal explains that when version 3.0 added detailed guidance on apps, "and Apps" joined the title and the acronym stayed.

What is the latest version of GIGW?

GIGW 3.0 is the latest version. STQC dates its release to March 2023 and began accepting certification applications against it on 1 October 2023. It was formulated jointly with STQC, a directorate of the Ministry of Electronics and Information Technology (MeitY), and CERT-In; STQC's scheme page describes it as adopted by the Department of Administrative Reforms and Public Grievances (DARPG).

Who must follow the GIGW guidelines?

The scope page says "all the websites/apps owned by government organisations must comply with these guidelines", and recommends the same for browser-based intranet applications.

A private company is bound only where another instrument adopts GIGW. SEBI's circular of 31 July 2025 requires its regulated entities' digital platforms to follow the accessibility guidelines in the latest GIGW, and the Department of Financial Services standards for insurers, dated 20 August 2024, say the GIGW website standard "shall be followed". Banks answer to separate banking-sector standards.

What changed in GIGW 3.0 from GIGW 2.0?

Accessibility moved from WCAG 2.0 to WCAG 2.1 Level AA. The portal counts 17 new success criteria, all that WCAG 2.1 added; W3C's list puts 12 of them at Level A or AA, and those 12 all appear in the checklist.
A cybersecurity chapter formulated by CERT-In covers websites, web portals, web applications and mobile apps, and CERT-In advisories issued from time to time count as updates to it.
GIGW 3.0 extends the mobile app guidance that GIGW 2.0 introduced and adds API integration with India Portal, DigiLocker, Aadhaar-based identity, single sign-on and MyGov.
Each guideline is written as a statement and its benefit, with separate actions for the government organisation, the developer and the evaluator, and is mapped to the risks of non-conformity.
A dedicated Web Information Manager, a senior official from the department.

What is on the GIGW 3.0 checklist?

The official GIGW 3.0 checklist is Annexure II, the matrix to check conformity on the GIGW portal: one row per guideline, with its risk codes and, for accessibility, its WCAG 2.1 success criterion. In the matrix, the Cybersecurity chapter of the full guidelines appears as Security Guidelines.

Chapter	What it covers	Guidelines	What to test
Quality	Identity, ownership, current content, contact and help pages, domain, responsive layout, platform integration	25	Emblem or logo in proper ratio and colour; last updated date on the homepage; title, size and format of downloads; outdated notices archived; a nic.in or gov.in domain; regional fonts across browsers; A4 printing
Accessibility	WCAG 2.1 Level A and AA, one row per success criterion from 1.1.1 to 4.1.3	50	Text alternatives and captions; 4.5:1 contrast; 200 percent resize; reflow at 320 CSS pixels; keyboard access with visible focus; titles, labels and error messages; name, role and value
Cybersecurity	Security audit, secure hosting, security and privacy policies, contingency plan	3	Audit clearance from NIC, STQC or a CERT-In empanelled auditor; a Web Application Firewall at the host; ICT logs kept for a rolling 180 days
Lifecycle management	Web Information Manager (WIM), policies, links, languages, document formats	10	A WIM nominated; ten policies and plans approved by the WIM; no broken links or links to "under construction" pages; a bilingual site in Unicode

App requirements run through the chapters: rows are written for the "website/app" and the "homescreen", and the cybersecurity chapter names mobile apps. Performance is not a chapter.

The Digital Brand Identity Manual (DBIM), the government's guide to a common visual identity across its digital platforms, is a separate document with its own STQC certification, to be implemented in conjunction with the latest GIGW.

Who can audit GIGW compliance, and how does STQC certify a website?

An IAAP Certified Auditor or an STQC Certified Accessibility Tester prepares the accessibility review report. NIC, STQC, an STQC empanelled test laboratory (SETL) or a CERT-In empanelled auditor issues the security audit clearance. An STQC IT centre or an SETL runs the evaluation, and only the STQC Directorate issues the certificate; the scheme page says labs and SETLs "can only perform evaluation and shall not issue certificates".

STQC's memorandum of 24 November 2025 withdrew a memo of 30 June 2025 that had required a review report from an IAAP Certified Auditor, citing the "limited availability of such certified professionals", and made a report by an IAAP Certified Auditor or an STQC Certified Accessibility Tester "mandatory for all GIGW evaluation requests". The scheme page still links the withdrawn June notice, so confirm the rule with your lab.

Applicants go to an STQC IT centre, to an SETL through their own procurement, or online through the STQC lab portal, with a website quality manual, vulnerability assessment reports, the network architecture and a recent security clearance report. The assessment team "evaluates the website using test tools and manually", a security audit follows if required, and STQC issues the certificate and the Certified Quality Website (CQW) mark. The certificate is valid for three years, with annual and surprise surveillance audits. STQC's scheme page publishes no fee schedule or turnaround time. The assigned STQC lab asks for the charges, paid in advance through the Bharatkosh portal, and the security audit is charged separately.

On eligibility, the scheme page's paragraph on e-Voting systems, added under Ministry of Corporate Affairs guidelines, ends: "Both government and private websites may apply for the same."

How is GIGW different from the RPwD rules and IS 17802?

GIGW is a set of guidelines for government-owned sites, with a certification scheme run by STQC. The Rights of Persons with Disabilities (RPwD) Act, 2016 and its rules are law, and IS 17802 is the Bureau of Indian Standards (BIS) standard that Rule 15 points to.

	GIGW 3.0	RPwD Act and Rule 15	IS 17802
What it is	Quality, accessibility, cybersecurity and lifecycle guidelines	The Act and the accessibility rules under its section 40	BIS standard in two parts (2021, 2022), adopted from EN 301 549 v3.2.1
Who it binds	Websites and apps owned by government organisations	Service providers "whether Government or private" (section 46)	Websites, apps and other ICT, listed in Rule 15(1)(c)(iii)
Web accessibility bar	WCAG 2.1 Level AA	IS 17802	WCAG 2.1 Level AA counts as conformance for web content (clause 9.0(b))
Proof or penalty	STQC certificate, valid three years	Fines under section 89: up to Rs 10,000, then Rs 50,000 to Rs 5 lakh	Part 2 sets how conformance is determined

GIGW and IS 17802 meet on web accessibility: GIGW requires WCAG 2.1 Level AA and IS 17802 accepts it for web content, so one WCAG 2.1 AA test serves both. GIGW itself names the RPwD Act among its bases. On 8 November 2024 the Supreme Court held Rule 15(1) ultra vires for being recommendatory, and ordered progressive compliance with its standards to continue.

How do you test a website against GIGW 3.0 before the audit?

Test against the checklist first; commission the formal reports once defects are fixed. The MeitY and NIC deck on GIGW 3.0 sets the same order: checklist, gaps, fixes, certification, then monitoring.

Copy the 88 rows of Annexure II into a tracker and mark each pass, fail or not applicable.
Vervali tests the 50 accessibility rows as a WCAG 2.1 Level AA audit: an automated scan, then keyboard-only and screen reader passes through the main user flows. A WCAG 2.2 AA plan covers 49 of them. The exception is row 48, criterion 4.1.1 Parsing, which WCAG 2.2 removed and W3C's current WCAG 2.1 treats as always satisfied for HTML; the GIGW matrix still lists it, so check the markup for duplicate IDs and broken nesting.
Vervali checks the Quality and Lifecycle rows as content and process items: dates, downloads, archived notices, contact details, regional fonts, A4 printing, broken links and policies.
Get the security audit clearance before you apply, since the application asks for a recent one, and check hosting against current CERT-In advisories.
Before a surveillance or transition audit, STQC expects an internal audit and management review, a gap analysis, documentation changes, a review of security audit corrective actions and of the website quality manual, and staff training.
Retest every fix, then commission the accessibility review report.

Vervali's accessibility testing services in India cover the accessibility part of this pre-audit pass: WCAG 2.1 AA checks, manual testing with the NVDA, JAWS, TalkBack and VoiceOver screen readers on real devices, remediation guidance for your developers, and a retest once the fixes ship.

Sources

STQC, MeitY (2023). Transition Plan from GIGW: 2018 to GIGW: 2023, 23 May 2023.
STQC, MeitY (2025). Office Memorandum on accessibility review reports, 24 November 2025.
STQC Directorate. Website Quality Certification; DBIM Compliance Certification.
NIC, MeitY. GIGW portal pages, 2026 (live pages, undated): Introduction, New features, Scope, Annexure II, Guidelines.
MeitY and NIC. GIGW 3.0: New Features, undated deck.
W3C. What's New in WCAG 2.1; WCAG 2.1, 6 May 2025; WCAG 2.2, 12 December 2024.
SEBI (2025). Circular SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/111, 31 July 2025.
Department of Financial Services (2024). Insurance sector accessibility standards, 20 August 2024.
RPwD Act, 2016, section 46 and section 89; DEPwD, RPwD (Amendment) Rules, 2023 and IS 17802.
Supreme Court of India (2024). Rajive Raturi v. Union of India, 8 November 2024.

Frequently Asked Questions

Quick answers to common questions about this article.

GIGW is written for government organisations: its scope page says all websites and apps owned by them must comply. A private company is bound only where another instrument adopts GIGW, such as SEBI's circular of 31 July 2025 for its regulated entities or the Department of Financial Services insurance standards of 20 August 2024. STQC's scheme page, in its paragraph on e-Voting systems, adds that both government and private websites may apply for its certification.

The GIGW portal at guidelines.india.gov.in links the full manual as Download GIGW Manual 3.0 on its introduction page, next to a Compliance HandBook PDF. The official checklist, Annexure II (the matrix to check conformity), is a page on the same portal.

STQC's Website Quality Certification page publishes no fee schedule and no turnaround time. The STQC lab assigned to the testing asks for the charges, which are paid in advance through the Bharatkosh portal, and a security audit, if required, is charged separately. The certificate is valid for three years, with annual and surprise surveillance audits.

Since STQC's office memorandum of 24 November 2025, the report must be prepared by an IAAP Certified Auditor or an STQC Certified Accessibility Tester, and it is mandatory for every GIGW evaluation request under the Website Quality Certification Scheme. That memo withdrew one of 30 June 2025, which had required a report from an IAAP Certified Auditor. The STQC scheme page still links the earlier June memo, so confirm the current rule with the STQC lab before you engage an auditor.

GIGW 3.0 requires conformity with WCAG 2.1 Level AA, up from WCAG 2.0 in GIGW 2.0. Its 50 accessibility guidelines are the 30 Level A and 20 Level AA success criteria of WCAG 2.1, one checklist row each, from 1.1.1 to 4.1.3.

GIGW 3.0 has 88 guidelines: 25 on Quality, 50 on Accessibility, 3 on Cybersecurity and 10 on Lifecycle management. STQC's transition plan of 23 May 2023 lists the four counts, and the Annexure II conformity matrix on the GIGW portal has one row for each guideline.

DBIM, the Digital Brand Identity Manual, is a separate document that sets a common visual identity for the government's websites, apps and social media, and STQC certifies it under its own DBIM Compliance Certification. STQC says DBIM must be implemented in conjunction with the latest version of GIGW.