ISECURION delivers ABDM WASA (Web Application Security Assessment) across all applicable milestones - M1, M2, M3, M4 and other ABDM tracks - including API security assessment, VAPT, and NHA-ready audit reporting for HIPs, HIUs, PHR and health locker providers, EHR vendors, hospitals, and all digital health application developers seeking ABDM certification. Conducted by CERT-In empanelled auditors with specialized digital health security expertise. Pan-India coverage.
Tell us about your digital health application and the ABDM milestones you are certifying, and get a customized WASA testing quote. We respond within 24 hours.
The Ayushman Bharat Digital Mission (ABDM), led by the National Health Authority (NHA), is India's nationwide initiative to build an integrated digital health infrastructure. At its core is the ABHA (Ayushman Bharat Health Account) system - enabling citizens to link and share health records securely across hospitals, labs, pharmacies, and insurers.
Any digital health application that integrates with ABDM - whether as a Health Information Provider (HIP), Health Information User (HIU), PHR / Health Locker, or any other ABDM role - must pass a WASA (Web Application Security Assessment) conducted by a CERT-In empanelled auditor before going live on the ABDM production environment. Security assessment applies across every milestone your application implements - M1, M2, M3, M4 and beyond.
ISECURION's ABDM WASA testing delivers comprehensive security assessment of your application and its ABDM integration - covering OWASP Top 10, API security, authentication controls, data encryption, and patient consent flows. We deliver an NHA submission-ready audit report and support you through the security side of the certification journey.
A digital health application cannot go live on the ABDM production environment without a successful WASA security audit - it is a hard NHA gate
Health records contain the most sensitive personal data. ABDM WASA testing ensures patient data is protected against unauthorized access, breaches, and API vulnerabilities
ABDM's consent architecture must be securely implemented - WASA testing verifies that consent flows cannot be bypassed or manipulated
ABDM relies on a rich API ecosystem - WASA testing validates that every API endpoint is secure, authenticated, and free from injection and logic flaws
A clean WASA report signals to hospitals, insurers, and patients that your platform meets NHA's security standards for digital health data
Every organization building on the ABDM ecosystem must complete WASA security testing before accessing the NHA production environment
Hospitals, clinics, diagnostic labs, and pharmacies that generate and share patient health records over the ABDM network
Insurance companies, doctors, and healthcare platforms that request and consume patient health records via ABDM consent
Personal Health Record (PHR) applications that store and manage patient health records linked to ABHA IDs
Electronic Health Record and Electronic Medical Record software vendors integrating their systems with ABDM
Online consultation platforms that generate prescriptions and health records and push them to ABDM
Digital pharmacies and health insurance platforms that access or contribute patient health data through the ABDM ecosystem
ABDM certification is milestone-based. ISECURION conducts the WASA security assessment for each milestone your application implements - M1, M2, M3, M4 and other tracks
Objective: Assess the security of your ABHA creation, verification, login, and linking flows. Our testing covers OTP handling, account enumeration, Aadhaar / mobile data leakage, rate limiting, session and token management, and protection against identity manipulation attacks - along with OWASP Top 10 assessment of the application.
Objective: Assess the security of how your application links care contexts and shares health records as a HIP. Our testing covers IDOR on care contexts and patient records, callback and webhook security (SSRF, replay, spoofing), health record transfer and payload encryption, malformed bundle / XML entity attacks, and authorization controls on data push.
Objective: Assess the security of how your application requests, receives, and stores health data as an HIU. Our testing covers consent request and artefact handling (forgery, replay, bypass), access to records without valid consent, key exchange and decryption handling, secure storage of received records, and access control on data display.
Objective: Assess the security of additional ABDM integrations your platform implements - such as Healthcare Professional and Health Facility Registry (HPR / HFR) connectivity and digital claims exchange (NHCX). Our testing covers API authentication, authorization, credential and secret handling, and protection of sensitive professional, facility, and claims data.
Objective: Assess the security of PHR and Health Locker applications, Scan & Share flows, notification subscriptions, and government or programme integrations - including mobile applications, local data storage, deep link handling, and consent management by the patient.
End-to-end security assessment aligned with NHA's ABDM requirements - applied to every milestone in your scope
Security testing of ABHA ID creation, verification, login, and linking flows - OTP abuse, enumeration, rate-limit bypass, and protection against identity manipulation attacks
Security testing of consent request, grant, revoke, and expiry flows - including bypass attempts, consent artefact forgery and replay, and unauthorized data access scenarios
Security assessment of health data push and fetch APIs - authentication, authorization, injection testing, malformed FHIR payloads, XML entity attacks, and data integrity tampering
Comprehensive OWASP Top 10 assessment of the application - injection flaws, broken authentication, sensitive data exposure, broken access control, security misconfiguration, XSS, insecure deserialization, and more
Test OAuth 2.0 / token implementation, ABDM gateway token handling, session expiry, token refresh flows, and protection against token hijacking and replay attacks
Validate TLS configuration, health data encryption at rest and in transit, FHIR payload encryption, and key management practices meeting NHA and MeitY data protection requirements
Deep API security testing including rate limiting, IDOR (Insecure Direct Object Reference), mass assignment, parameter tampering, and ABDM-specific business logic abuse scenarios
Security testing of ABDM-integrated mobile applications (Android / iOS) - local data storage, deep link handling, certificate pinning, reverse engineering resistance, and ABHA SDK implementation review
Review security policies, data handling procedures, and technical controls against NHA's ABDM compliance requirements - preparing the security documentation package for NHA submission
The security checks ISECURION performs for each ABDM milestone and flow. Select only the milestones relevant to your application.
| Milestone | ABDM Flow / Area | Security Assessment Coverage | In Scope |
|---|---|---|---|
| M1 | ABHA creation & verification (Aadhaar / mobile OTP) | OTP bypass, enumeration, Aadhaar data leakage, rate limiting | ✔ |
| M1 | ABHA login, profile & token management | Token leakage and replay, session fixation, insecure storage of secrets | ✔ |
| M2 | Care context discovery & linking (HIP) | Unauthorized linking, patient record spoofing, IDOR on care contexts | ✔ |
| M2 | Health record push / data transfer (HIP) | Malformed FHIR payloads, unauthorized push, XML entity attacks, payload encryption | ✔ |
| M2 | Callbacks, notifications & subscriptions | SSRF via callback URLs, notification replay and spoofing, webhook authentication | ✔ |
| M3 | Consent request & artefact handling (HIU) | Consent forgery, unauthorized consent, artefact replay, purpose-scope violation | ✔ |
| M3 | Health record fetch & storage (HIU) | Access without valid consent, key exchange and decryption handling, FHIR injection, secure storage of received data | ✔ |
| M4 | Registries & claims integrations (HPR / HFR / NHCX, as applicable) | API authentication and authorization, credential handling, exposure of professional, facility and claims data | ✔ |
| PHR / Locker | Scan & Share, health locker, consent management by patient | Consent bypass, expired consent abuse, local storage, deep link hijacking, IPC data leakage | ✔ |
| All | Application & infrastructure baseline | OWASP Top 10, TLS configuration, verbose error disclosure, security misconfiguration, business logic abuse | ✔ |
Security findings and evidence from every milestone in scope are packaged into a single WASA audit report for NHA submission.
A structured end-to-end security assessment process from scoping to an NHA-ready WASA report
Understand your application architecture, the ABDM milestones you are implementing (M1, M2, M3, M4 or other tracks), your role (HIP / HIU / PHR), tech stack, and target test environment. Define the testing scope, API inventory, and user flow map. Confirm test credentials and test data availability.
Review your ABDM integration design, API implementation, token and secret handling, FHIR payload handling, and consent flow architecture from a security perspective. Identify design-level weaknesses before active testing begins - saving remediation time.
Conduct OWASP Top 10 web application testing and ABDM-specific API security tests for every milestone in scope - IDOR, authentication bypass, consent manipulation, callback SSRF, FHIR injection, and key handling - along with infrastructure-level checks. Mobile application security testing is conducted in parallel where applicable.
Report all security vulnerabilities with clear evidence, CVSS risk ratings, and step-by-step remediation guidance. Our team supports your developers in closing critical and high issues before the final NHA audit report is issued.
Re-test all remediated findings to confirm fixes are effective and have not introduced new issues. Issue a formal closure letter for remediated vulnerabilities as part of the WASA submission.
Deliver the complete ABDM WASA audit report, milestone-wise security evidence, findings summary, closure letter, and NHA submission documentation pack - signed by a CERT-In empanelled auditor and ready for submission to NHA.
Everything your digital health application needs on the security side of NHA submission and ABDM certification
Comprehensive ABDM WASA audit report covering security assessment results and compliance status for all milestones in scope - formatted for NHA submission, signed by a CERT-In empanelled auditor
Evidence of security tests performed for each ABDM milestone - screenshots, API request/response logs, and test results organized by milestone (M1, M2, M3, M4 and others)
Detailed VAPT report covering all identified vulnerabilities - OWASP Top 10, API security gaps, and ABDM-specific issues - with CVSS risk ratings and remediation guidance
Developer-friendly remediation recommendations with code-level guidance where applicable - helping your team fix issues fast and efficiently
Formal re-test confirmation letter for all remediated findings - a component of the NHA WASA submission package
Complete security documentation bundle formatted for NHA submission - audit report, evidence, closure letter, and auditor certificate in one submission-ready package
India's digital health companies trust ISECURION for ABDM WASA testing - from Bangalore's health-tech startups to Mumbai's insurance platforms and Delhi's hospital networks
Extend your security and compliance posture beyond ABDM WASA with these related ISECURION services
Common questions from digital health companies across Bangalore, Mumbai, Delhi, and pan-India about ABDM WASA requirements for M1, M2, M3, M4 and beyond
Partner with ISECURION - CERT-In empanelled, ISO 27001:2022 certified - for ABDM WASA testing across M1, M2, M3, M4 and beyond that is thorough, NHA submission-ready, and delivered on time.
Serving digital health companies, hospitals, EHR vendors & health-tech startups in Bangalore, Mumbai, Delhi, Hyderabad, Chennai, Kolkata and across India.