Building an Empanelment Evidence Pack

The night before a NICSI-style closing, four people were exporting bank statements, hunting a work order from a campus that had paid in cash-like haste and never issued a completion certificate, and converting a pitch deck into 'Form 7 — Approach and Methodology'. They had done almost this work nine months earlier for a state RFE, then scattered the files across personal drives.

Empanelment evidence is repetitive on purpose. Issuers want to compare firms on the same templates. Your advantage is not originality. It is a pack that is already named, dated, and legally consistent, so that Form-X becomes a mapping exercise rather than an archaeological dig.

This template is the folder we ask founders to keep warm all year. It is not a substitute for any RFE’s mandatory forms. If their annexure fights your naming, their annexure wins. You still win time.

A folder tree that a stranger can upload from

Create a top folder Empanelment-Pack and a dated snapshot folder each time you submit (2026-08-NICSI-AI or similar). Never edit the snapshot after upload. New work happens in working folders, then a new snapshot.

Inside: 01-entity, 02-finance, 03-people, 04-experience, 05-security, 06-product, 07-declarations, 08-identities (DPIIT, Udyam, GeM, GST), 09-consortium, 00-index. The index is a spreadsheet: document, date, expiry, owner, last verified.

File names are boring: 01-COI-LLP-agreement.pdf, 08-DPIIT-2026-08-16.pdf. No FINAL-final. A committee does not work for your version control feelings.

What each drawer holds — and what it must not hold

Entity: incorporation, PAN, GST, cancelled cheque, registered address proof, authority to sign, DSC identity match. Must not hold a brand kit.

Finance: audited statements for the years RFEs usually ask (often three), CA certificates in a reusable format you can retitle, ITR acknowledgements if asked. Must not hold management accounts you would not sign.

People: CVs in a single format, offer or employment proof if the RFE is harsh, role tags (lead architect, SDC engineer, DPO contact). Must not hold a LinkedIn dump with clients you cannot name.

Experience: work orders, completion or phase certificates, invoices if allowed, a cover slip for each project stating client type, value, period, your role, and whether personal data was processed. Must not hold logos without paper.

Security: current CERT-In audit reports if you have them, ISO certificates with scope, pen-test summaries without exploitable detail, architecture one-pagers. Must not hold a promise to 'get STQC if required' as if it were a certificate.

Product: deployment diagram, no-training statement, update path, sample deletion certificate, gold-set description. Must not hold customer data.

A warm pack is a calendar, not a heroic night.

Drawer	Minimum warm set	Refresh clock
01 entity	COI, PAN, GST, cheque, signatory letter	On every corporate change; GST as amended
02 finance	Last three audited years + CA format	After each audit sign-off
03 people	6–12 CVs in one template	Quarterly, and on every resignation of a named role
04 experience	Every government-like paper you own, indexed	When a new completion certificate arrives
05 security	Latest audit + certificate pack + architecture	When an audit expires; do not let a bid discover the expiry
08 identities	DPIIT, Udyam, GeM profile extract	Monthly screenshot or download while a window is open

Mapping onto their forms, not rewriting your company

When an RFE drops, duplicate the snapshot, then fill their forms using your pack as the source. Do not draft Form-X from memory. Memory invents turnover numbers that disagree with the CA certificate.

If they want experience on their table, copy from your cover slips. If a project cannot survive their definition of similar work, leave it out. Padding is how affidavits become dangerous.

If they want a presentation, export from 06-product. Do not open a new narrative that contradicts the architecture you will sign.

1. Read their checklist. Add any document you do not have to a gap list with an owner and a drop-dead date.
2. Regenerate dated downloads (DPIIT, Udyam, GST, PAN) the week of upload.
3. Fill their forms. Cross-check every number against 02-finance and 04-experience.
4. Second person reads only for contradictions and name mismatches.
5. Snapshot, hash, upload, archive the acknowledgement beside the snapshot.

Evidence you wish you had started the year you did the work

Completion certificates are harder than work orders. Ask for them while the officer who loved you is still in the chair.

If a campus paid against an invoice without a WO, you may have a weak exhibit. For the next campus, insist on a PO shape you can file.

Redacted before/after samples of drafts — with no personal data — are gold in AI categories. Produce them under a script, store them in 06-product.

What not to forge by accident

Do not backdate a CV. Do not inflate a contract value. Do not call a private pilot a government work order. Do not reuse a CA certificate that names last year’s entity status.

Do not include another client’s personal data in a sample. That is not evidence. That is an incident.

Do not let a consortium partner drop their documents into your tree without a cover slip that says whose they are.

Why firms refuse to keep the pack warm

These excuses are how closing week becomes archaeology.

Every RFE wants different formats, so a pack is wasted work.

Sources are stable; formats change. CA-certified turnover is CA-certified turnover whether it sits in Form 3 or Annexure D. Keep sources. Map formats.

We will hire a bid shop the week it opens.

Bid shops cannot invent completion certificates. They can only typeset what you already own. Hire them to map, not to time-travel.

Security reports are confidential, so we keep them off the pack.

Keep a public summary and a controlled full report. RFEs that ask for the full report need a sharing path, not a panic.

We are too early for experience drawers.

Then your pack is entity, identities, people, product, and honest empty experience. Empty and honest still uploads. Fiction does not.

Thirty days to a warm pack from a cold drive

One drawer every few days. Do not start with the pitch deck.

1. Days 1–3: 01-entity and 08-identities. Fix name mismatches now.
2. Days 4–8: 02-finance with your CA. Agree a reusable certificate format.
3. Days 9–12: 03-people template and the first six CVs.
4. Days 13–20: 04-experience. Write cover slips. Request missing completion certificates.
5. Days 21–25: 05-security and 06-product. Kill customer data in samples.
6. Days 26–28: 07-declarations templates (non-blacklisting, integrity) for counsel to approve as reusable drafts.
7. Days 29–30: 00-index, access control on the folder, and a quarterly calendar invite named 'refresh the pack'.

What goes in the file — the pack is the file

The snapshot you uploaded, the index as-on that day, the portal acknowledgement, and a short memo of any document you stretched (there should be none) or omitted. That is the entire archaeology a later diligence will need.

If you are a buyer evaluating packs, write which forms were mandatory and keep the scoring sheet that mapped evidence to marks. A warm vendor pack plus a cold evaluation sheet is how challenges start.

Each RFE’s forms govern. This template is a vendor hygiene practice, not an official NICSI or state form and not legal advice. Do not submit leftover documents that contradict the live annexure.

How to run the route without confusing the letterhead

“Building an Empanelment Evidence Pack” is a route problem. A P5 GovTech Founder should know which legal person they are talking to — NIC, NICSI, a state IT corporation, iDEX, or a GeM buyer — and which paper that person can actually issue. Searching “empanelment documentation” is not the same as being on a panel that can receive a work order.

Empanelment is won in folders, not in adjectives. Build a dated evidence pack once, then map it onto each RFE’s forms instead of inventing PDFs the week of closing. Empanelment letters are not purchase orders. DPIIT recognition is not a technical score. Reserved startup seats, if a notice writes them, are local to that notice. IndiaAI compute empanelment is not NICSI application-software empanelment.

Keep a warm evidence pack: CIN, GST, DPIIT, Udyam, financials, work-completion letters, architecture one-pager, DPA draft. Renewals are lost by people who treat the panel as a trophy.

• Screenshot the live RFE paragraph you are relying on, dated.
• Match the bidding entity name across every certificate.
• Do not mix iDEX, TDF, NICSI and GeM clocks on one tracker cell.
• Record the validity end date 90 days before it dies.

Close this loop before the next CAB

Put “Building an Empanelment Evidence Pack” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P5 GovTech Founder, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “empanelment documentation” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.