Coempt Provided CBSE Expired Cyber Certificates Tied to Another Client | Hindustan Times (IN)

The Central Board of Secondary Education (CBSE) accepted cybersecurity certificates from Coempt Edu Teck that were nearly two years old and related to a different client's software deployment. These certificates were part of the documentation for the controversial on-screen marking (OSM) platform, which processed nearly 10 million student answer scripts.

Documents reviewed by HT reveal that one certificate, issued in November 2023 for bput.onmark.co.in (a deployment for Biju Patnaik University of Technology in Odisha), was almost two years old when submitted for a tender in August 2025. This certificate's validity clause stated it expired upon application changes or after one year. The second certificate, issued in October 2025 by A3S Tech & Company, audited an application called OneX, not OnMark, against a pre-production staging URL for BPUT. It explicitly noted that production server hardening was still required, indicating the tested environment was not the live production system.

Significantly, neither certificate specified a URL or deployment linked to CBSE. The platform these certificates were meant to validate was later found to have critical security flaws. Cybersecurity researchers reported a series of vulnerabilities between February and May 2026, potentially allowing unauthorized access to student marks, answer scripts, and critical databases. CERT-In has acknowledged some of these disclosures to a parliamentary panel.