GIGW compliance explained: what the guidelines require and how a website gets certified
TL;DR: GIGW stands for Guidelines for Indian Government Websites. The current version, GIGW 3.0, covers websites and apps and is organised into four areas: quality, accessibility, cybersecurity and lifecycle management. Government bodies are expected to follow it, and the STQC Website Quality Certification checks a site against it and issues a Certified Quality Website (CQW) certificate valid for three years. Private websites can also apply. If you build, host or maintain a government site, GIGW decides what the audit will test, so plan for it from the start rather than after launch.
What GIGW is
GIGW is the set of guidelines that Indian government websites and, in version 3.0, mobile apps are expected to follow. It exists to make government sites consistent, accessible, secure and kept up to date, so a citizen can find reliable information and services whichever department runs the site.
It is a standard to build against and be audited against, not a template. A site can look completely different from another and still be compliant.
What changed in GIGW 3.0
GIGW 3.0 extended the earlier guidelines in several ways, according to the official guidelines site:
- Clearer structure. Each guideline is set out as a statement, benefits, and actions for the government organisation, developers and evaluators, so everyone knows their part.
- Stronger user experience focus. More emphasis on user-centred design and information architecture, plus a centralised monitoring dashboard for content issues.
- Platform integration. API-level integration with services such as India Portal, DigiLocker and single sign-on.
- Accessibility to WCAG 2.1 Level AA. This adds 17 new success criteria compared with earlier requirements.
- A cybersecurity chapter. Based on CERT-In guidance and drawing on ISO 27001, OWASP ASVS, the OWASP Top 10 and CIS benchmarks, covering design through deployment.
- Lifecycle management. Policies for keeping quality, accessibility and security up over time, with a senior Web Information Manager leading the team.
- Risk mapping. Each guideline lists the risks of non-conformity in the conformity matrix.
The four areas it covers
| Area | What it asks for |
|---|---|
| Quality | Clear information architecture, current and accurate content, good design, working integrations |
| Accessibility | WCAG 2.1 AA conformance so people with disabilities can use the site |
| Cybersecurity | Secure design, hardened deployment, regular testing and audit |
| Lifecycle management | Ownership, content review, update and maintenance processes |
The accessibility requirement overlaps with general accessibility law and practice, which is covered in website accessibility compliance in India. GIGW sets a specific bar for government sites on top of it.
The security chapter is the one hosting providers should read closely, because it reaches into how the server is configured and maintained.
Who needs to comply
- Government organisations. Departments and bodies running government websites and apps are expected to follow GIGW, and appoint a Web Information Manager responsible for it.
- Developers and agencies. If you build a site for a government client, the contract will usually require GIGW compliance, and your work will be evaluated against it.
- Evaluators and auditors. They test sites against the guidelines using the conformity matrix.
- Private organisations. Not obliged, but the STQC scheme is open to private websites that want an independent quality mark.
If you are unsure whether a particular site must comply, ask the commissioning department. The requirement usually appears in the tender or work order.
How certification works
The STQC Website Quality Certification checks a site against GIGW 3.0 and, if it passes, grants the Certified Quality Website mark. The certification:
- confirms compliance with GIGW 3.0,
- checks security hardening and accessibility,
- covers usability and service delivery,
- is valid for three years, with annual surveillance and possible surprise audits.
There are two routes:
- Through an STQC lab. You apply to the relevant STQC IT centre with the application form, a website quality manual, vulnerability assessment reports, network architecture, recent security clearance and data centre details. An assessor reviews the quality manual, the team tests the site with tools and by hand, and back-end processes are assessed.
- Through an STQC-empanelled lab. You apply to the lab, which seeks STQC's consent and submits the same documents. STQC appoints a validator to supervise the evaluation.
In both routes, a security audit follows once the evaluation is satisfactory, conducted by STQC, an STQC-empanelled lab, NIC or a CERT-In-empanelled agency. Only the STQC Directorate issues the certificate. Evaluation charges are set by the assigned lab and paid in advance, and security audit charges are separate. The scheme also expects a review report from an IAAP-certified accessibility auditor before GIGW evaluation.
Confirm the current steps and documents with STQC, since they can change.
What it means for the people building the site
Developers and agencies. Design to WCAG 2.1 AA from the first wireframe, because retrofitting accessibility is costly. Keep the conformity matrix open during development and tick items off as you go.
Hosting and infrastructure. The cybersecurity chapter expects a hardened deployment. That points to practices you should already follow:
- HTTPS everywhere, with a correct certificate chain. See SSL certificate types and moving from HTTP to HTTPS.
- Server hardening and key-based SSH. See SSH hardening.
- Brute-force protection and sensible rate limits. See Fail2ban.
- Up-to-date runtimes and software. Runtime flaws such as PHP2Shell matter in an audit.
- Reliable backups and monitoring, covered in uptime monitoring.
Government sites are usually hosted on government or government-approved infrastructure, so check the hosting requirements in your contract before you propose a provider.
The department. Content is part of compliance. Outdated pages, broken links and missing owners are quality failures, and no amount of good code fixes them. Name an owner for each section and schedule reviews.
A practical readiness checklist
- Identify the Web Information Manager and the content owners.
- Gather the GIGW 3.0 conformity matrix and map each item to a task.
- Run an accessibility review against WCAG 2.1 AA, including keyboard use and screen readers.
- Complete a vulnerability assessment and fix the findings.
- Document the quality manual, architecture and data centre details.
- Check links, forms, search, language options and mobile behaviour.
- Set up monitoring and a content review schedule.
- Plan the STQC application and security audit timeline before the launch deadline.
Common reasons sites fail
- Accessibility gaps, such as images with no alternative text, poor colour contrast, unlabelled forms and no keyboard access.
- Outdated content, broken links and missing dates on pages.
- Security findings left unresolved before the audit.
- Missing documentation, particularly the quality manual and architecture details.
- No clear owner for content or compliance after launch.
- Treating certification as a one-time event, then failing the annual surveillance audits.
FAQs
What does GIGW stand for?
Guidelines for Indian Government Websites. Version 3.0 extends them to cover government mobile apps as well as websites.
Is GIGW compliance mandatory?
Government organisations are expected to follow it, and it usually appears as a requirement in tenders for government websites. For private websites it is voluntary. Check the contract or ask the commissioning department.
What is the STQC certificate?
The Certified Quality Website (CQW) certificate, issued by the STQC Directorate after a site passes evaluation and a security audit against GIGW 3.0. It is valid for three years, with annual surveillance audits.
Can a private company get GIGW certified?
Yes. The STQC scheme is open to both government and private websites, although private sites are not required to follow GIGW.
How long does certification take?
It depends on the site, the lab and how ready your documentation and security fixes are. Plan for it as a project with its own timeline rather than a last-minute step before launch.
Does GIGW require a particular CMS or hosting?
The guidelines set requirements for quality, accessibility, security and lifecycle management and do not mandate a specific CMS. Your contract may specify approved hosting, so check it.
What accessibility standard does GIGW 3.0 use?
WCAG 2.1 Level AA, which adds 17 new success criteria compared with earlier requirements.
Does the certificate last forever?
No. It is valid for three years, with annual surveillance and surprise audits during that time. A site that drifts out of compliance can lose it.
Conclusion
GIGW is best treated as a build specification, not an audit hurdle at the end. Design for accessibility and security from the start, keep content owned and current, and prepare the STQC documentation early. Do that, and certification becomes a matter of evidence rather than last-minute fixes.
If you are hosting a website that must meet security and uptime expectations, HostCloud can help with a hardened, monitored setup. See our plans at https://hostcloud.in.
Sources: