Empanelment Documents: A Folder Structure

A bid lead in Noida searched Slack for 'GST certificate latest' at 14:10 on a Friday close. Four files came back, three of them wrong, one of them a photograph of a notice. The pack went in with the photograph. The cell asked for a clarification. The clarification window ended while the CA was in a wedding. That is not a document problem. That is a structure problem.

This template is a folder tree. It is the physical form of the compliance calendar and the Thursday red-team. It works for empanelment RFEs, for many advertised bids, and for GeM offline packs. It does not replace the live RFE's annexure list. Always map their list onto this tree. If they want a form in their numbering, put a copy in 99-rfe-forms with their filename.

Keep a master that is never submitted. Clone it for each opportunity. Nobody edits the master except to replace a stale master document. That one rule is the difference between a factory and a junk drawer.

Not legal advice. Some documents should not be in a widely shared drive — board resolutions with personal mobiles, unredacted financials. Restrict those subfolders.

The tree

00-calendar — monthly screenshots of the compliance sheet, plus a README of owners.

01-identity — CIN/MCA master, PAN, GST, cancelled cheque, registered-office proof, Udyam (fresh PDF + verify screenshot), DPIIT (certificate + submitted innovation text), GeM seller profile screenshots, authorised-signatory IDs, board resolution template, PoA template.

02-financials — ITR acks, audited statements, CA turnover certificate templates, GST returns the RFEs usually ask, solvency letters with expiry, PBG and EMD instrument templates (blank), bank contact.

03-people — org chart, key CVs in a boring format, labour affidavits if you use them, POSH or other HR certificates a buyer has asked before. Redact home addresses by default.

04-security — ISO certificate + scope + SoA extract you are willing to share, pen-test executive summaries, CERT-In contact tree, isolation-drill reports, no-training policy, processor list.

05-architecture — one-page drawing, outbound schedule (even if empty), media SOP, model-provenance note, language and eval note. No customer data. No internal IP you would not put on CPPP.

06-experience — work-order covers, completion certificates, redacted SOWs, permission to name the customer or a rule that you will not. A spreadsheet index.

07-affidavits — blacklisting, non-litigation, MSME, make-in-India, local-office, integrity-pact templates. Dated empties, not last year's signed copies.

08-partners — SI teaming, OEM MAF templates, C-DAC or other instruments only if real, iDEX/TDF letters only if real.

09-insurance-bg — policies, PBG copies, claim contacts.

10-renewals — each panel in its own subfolder: RFE, submission hash, letter, end date, work orders.

99-rfe-forms — empty in the master. In a clone, this holds their annexures named as they asked.

Clone ritual for one RFE

Step	Folder action	Owner
1. Clone	Copy master to /bids/YYYY-MM-dd-buyer-shortname/	Bid lead
2. Map	Build a sheet: RFE annexure → file path. Gaps in red	Bid lead
3. Refresh	Replace anything older than the RFE's currency rule; re-download Udyam/GST	COO / CA
4. Write	Architecture and experience tailored; no price in technical	CTO + bid lead
5. Sign	Affidavits dated this week; DSC check	Signatory
6. Red-team	Thursday checklist against the map sheet	Someone who did not build the zip
7. Freeze	Zip, hash, upload, store receipt in the clone's /submission/	Bid lead

Naming so humans can see

Use ASCII, dates as YYYY-MM-DD, and the instrument number. Example: 01-identity/UDYAM_UDYAM-MH-00-0000000_2026-08-16.pdf. Not final2_latest_really.pdf.

Put the legal entity name once in the README, exactly as PAN shows it. Every generated letterhead pulls from that README. This kills Pvt. versus Private deaths.

Keep a CHANGELOG in each clone: what you altered from the master and why. When a clarification asks 'why does Annex C differ from last year', you have a sentence.

• No WhatsApp screenshots as official papers.
• No passworded PDFs unless the RFE demands a password, in which case put the password in the submission note they specified — not in the filename.
• No customer personal data in 05 or 06. Redact.
• No scanned books of 200 pages when they asked for the certificate page. They will not find the page.

Access and retention

Master: bid lead, founder, COO, CA (financials), security lead (04). Not the whole Slack.

Clones: the bid team for that RFE. When the bid ends, restrict. People leave. Old clones are full of bank letters.

Retention: keep submitted zips and receipts for the life of the panel plus a comfortable audit tail — talk to counsel; many firms keep seven years out of habit. Do not keep customer pilot data in this tree at all.

Backup: one live drive, one backup the founder can still open if the bid lead is on a flight. DSC tokens are physical. Write their drawer location in 00-calendar, not in Slack.

The map sheet is the real checklist

The tree is storage. The map is compliance. Columns: RFE clause, their filename, our path, owner, done (yes/no), red-team (yes/no). If a clause has no path, you are not ready to submit.

Print the map. Humans find missing rows on paper that they skip on a screen. Tick in ink. Photograph the ticked map into /submission/.

When the RFE uses a portal with a hundred upload slots, fill the map with slot numbers. Portals are where good trees go to die if you improvise.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

SharePoint / Drive search makes folders obsolete.

Search is how you find four GST files. Folders are how you have one. Use both. Submit from the folder.

Every RFE is unique so a master is wasted.

Identity, financials, ISO, Udyam, DPIIT, affidavits repeat. Uniqueness lives in 05, 06 and 99. That is why they are separate.

Consultants will bring their own structure.

They can, inside the clone. The master stays yours. If they will not work in your tree, they are not in your factory.

This is too much for a five-person firm.

A five-person firm has more to lose from a stale PAN. Shrink the tree if you must. Do not shrink 01, 02, 07 and 99.

Install the tree in two days

Do not wait for the next RFE. The next RFE is why you are late.

1. Day 1 morning: create the master folders. Write the README with the exact legal name.
2. Day 1 afternoon: import identity, financials, ISO, Udyam, DPIIT. Delete duplicates. One file per instrument.
3. Day 2 morning: affidavit templates dated blank. Partner folder only with real instruments.
4. Day 2 afternoon: access lists, backup test, pre-zip scan rule. Show the founder where the DSC lives.
5. Next RFE: clone, map, Thursday red-team, freeze.

How this shows up in the file

README sentence: 'The master is never submitted. Clones are named by close date and buyer. No customer personal data in this tree. Legal name for all letterheads: [exact]. Folder owners: [list]. Pre-zip scan is mandatory.'

If a buyer asks for your 'document system', send them the tree without the files. It is a maturity signal. It is also a way to notice you have nothing in 04.

This article is informational field guidance for Indian public institutions and their vendors, not legal, tax, procurement or engineering advice. Confirm the live circular, RFE, GCC, GeM term, state G.O. and your counsel before you file anything. Incentives, ceilings and portal screens change.

How to run the route without confusing the letterhead

“Empanelment Documents: A Folder Structure” is a route problem. A P5 Startup/Vendor should know which legal person they are talking to — NIC, NICSI, a state IT corporation, iDEX, or a GeM buyer — and which paper that person can actually issue. Searching “empanelment document checklist” is not the same as being on a panel that can receive a work order.

Most PQ fails are lost files and stale scans. Keep a master tree, clone it per RFE, and freeze it on Thursday. Here is the tree. Empanelment letters are not purchase orders. DPIIT recognition is not a technical score. Reserved startup seats, if a notice writes them, are local to that notice. IndiaAI compute empanelment is not NICSI application-software empanelment.

Keep a warm evidence pack: CIN, GST, DPIIT, Udyam, financials, work-completion letters, architecture one-pager, DPA draft. Renewals are lost by people who treat the panel as a trophy.

• Screenshot the live RFE paragraph you are relying on, dated.
• Match the bidding entity name across every certificate.
• Do not mix iDEX, TDF, NICSI and GeM clocks on one tracker cell.
• Record the validity end date 90 days before it dies.

Close this loop before the next CAB

Put “Empanelment Documents: A Folder Structure” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P5 Startup/Vendor, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “empanelment document checklist” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.