CERT-In Compliance Checklist for Indian Businesses (2026)

Introduction

Let's clear up the most common misconception first: CERT-In does not issue a universal cybersecurity certification to ordinary companies. There is no "CERT-In certificate" that any business can simply apply for and frame on the wall.

What actually exists is a set of obligations and audit mechanisms. Depending on your industry, contracts, and customers, your business may need to:

Comply with the CERT-In directions of 28 April 2022 — mandatory incident reporting, logging, and related duties that apply to almost every organisation operating in India;
Undergo a cybersecurity audit by a CERT-In-empanelled auditor — an independent audit firm that CERT-In has vetted and listed; or
Obtain an audit or compliance report because a regulator (SEBI, RBI, IRDAI), a government tender, a customer contract, or an IPO process demands one.

This CERT-In compliance checklist walks through all three — what is legally mandatory, what is sectoral, and what is simply good practice — so founders, compliance officers, CISOs, and IT managers know exactly what to prepare.

What Is CERT-In?

The Indian Computer Emergency Response Team (CERT-In) is India's national agency for responding to cybersecurity incidents, operating under the Ministry of Electronics and Information Technology (MeitY) and designated under Section 70B of the Information Technology Act, 2000. It has been operational since 2004 (cert-in.org.in).

Three instruments matter most to businesses:

The IT (CERT-In and Manner of Performing Functions and Duties) Rules, 2013 (notified 16 January 2014), which made reporting of certain incident types mandatory.
The Cyber Security Directions of 28 April 2022 (No. 20(3)/2022-CERT-In), issued under Section 70B(6), which took effect in June 2022 — with an extended timeline to 25 September 2022 for MSMEs, per CERT-In's FAQ document published in May 2022.
The Comprehensive Cyber Security Audit Policy Guidelines (Version 1.0, released 25 July 2025), which standardise how CERT-In-empanelled audits are scoped, conducted, and evidenced (cert-in.org.in).

Non-compliance is not theoretical: under Section 70B(7) of the IT Act, failing to furnish information or comply with CERT-In directions is punishable with imprisonment of up to one year, a fine of up to ₹1 lakh, or both.

What Does "CERT-In Certification" Usually Mean?

When a tender, customer, or investor asks for "CERT-In certification," they almost always mean one of these:

A security audit report or "safe-to-host" certificate issued by a CERT-In-empanelled auditor. CERT-In empanels private audit firms — the official empanelled list is published and periodically updated. The empanelment certifies the auditor, not your company. Your company receives the audit firm's report or certificate.
Evidence of compliance with the CERT-In directions — incident-reporting readiness, log retention, a registered point of contact.
A sectoral audit mandated by SEBI, RBI, or IRDAI that must (or in practice does) use a CERT-In-empanelled firm.

If someone offers to get your company "CERT-In certified" directly by CERT-In, that is a red flag — the correct path is an audit by an empanelled firm against a defined scope.

Who May Need a CERT-In-Empanelled Cybersecurity Audit?

Government departments, PSUs, and their vendors. Websites and applications hosted on government infrastructure (e.g., with NIC) require a security audit clearance from a CERT-In-empanelled auditor before go-live and after major changes, in line with the Guidelines for Indian Government Websites (GIGW 3.0, 2023). CERT-In's Guidelines on Information Security Practices for Government Entities (June 2023) set the baseline controls.
SEBI-regulated entities. The Cybersecurity and Cyber Resilience Framework (CSCRF), issued 20 August 2024, requires cyber audits and VAPT through CERT-In-empanelled organisations; SEBI extended compliance timelines for most regulated entities to 30 June 2025 via subsequent circulars.
RBI-regulated entities. The Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, effective 1 April 2024) requires information-systems audits and VAPT; banks and NBFCs commonly engage CERT-In-empanelled firms to satisfy these.
Insurers and intermediaries. IRDAI's Information and Cyber Security Guidelines, 2023 (24 April 2023) require periodic cybersecurity audits and VAPT; Insurance Self-Network Platform approvals additionally involve CERT-In-empanelled audits.
Anyone bidding on tenders or selling to enterprises where the contract demands a CERT-In-empanelled audit report.
Companies handling personal data. The Digital Personal Data Protection Act, 2023 (11 August 2023) and the DPDP Rules, 2025 (notified 13 November 2025) require "reasonable security safeguards" — an independent audit is a strong way to demonstrate them (meity.gov.in).

What This Looks Like in Practice

Startup (20 people): No regulator demands an audit yet — but the 6-hour incident-reporting and 180-day logging duties already apply. One shared Google Sheet of assets and a named point of contact is the minimum.
SaaS company: An enterprise customer's procurement team asks for a VAPT report "from a CERT-In-empanelled auditor" before signing. The audit scope is your production cloud, APIs, and web app.
E-commerce business: Payment incidents and data breaches are explicitly reportable to CERT-In within six hours; expect customer contracts to require annual application security testing.
Financial-services company: SEBI's CSCRF or RBI's Master Direction makes audits and VAPT a recurring regulatory obligation with board-level reporting — not a one-off.
IPO-bound company: Bankers and auditors increasingly expect a recent independent cybersecurity audit as part of diligence; unresolved major observations become disclosure questions.

CERT-In Compliance Checklist

How to read the tables: Mandatory = required by the CERT-In Directions (28 April 2022) or the IT Act for entities in scope. Sectoral = mandatory if a regulator (SEBI/RBI/IRDAI), tender, or contract covers you — otherwise strongly recommended. Recommended = good practice that CERT-In-empanelled auditors will test and record observations against.

1. Scope, Governance and Ownership

Requirement	Mandatory?	Owner	Evidence auditors ask for	Common gap	Remediation
Identify applicable CERT-In directions and sectoral regulations	Mandatory	Legal / Compliance	Applicability assessment, regulatory register	Nobody has written down what applies	Annual applicability review, plus on every new contract
Appoint and register a CERT-In point of contact	Mandatory	CISO / IT Head	PoC designation letter, submission to CERT-In	PoC left the company; details stale	Use a role-based mailbox; update on every change
Information-security policies and governance	Sectoral	CISO	Board-approved policies, review minutes	Template policies never operationalised	Approve, assign owners, review annually
Risk assessment and risk-treatment plan	Sectoral	CISO / Risk	Risk register, treatment plan, sign-off	One-time assessment, now stale	Re-run yearly and after major changes

2. Know What You Are Protecting

Requirement	Mandatory?	Owner	Evidence auditors ask for	Common gap	Remediation
Asset, application, cloud, API and data inventories	Sectoral	IT / Engineering	Asset register, cloud account list, API catalogue, data-flow maps	Shadow SaaS and undocumented APIs	Automated discovery; quarterly reconciliation
Network and cloud-security review	Recommended	Infra / DevOps	Network diagrams, firewall and security-group reviews	Outdated diagrams; flat networks	Refresh before audit; segment critical systems

3. Security Testing

Requirement	Mandatory?	Owner	Evidence auditors ask for	Common gap	Remediation
Vulnerability assessment and penetration testing (VAPT)	Sectoral	Security	VAPT reports, retest certificates	Automated scans only; no retest	Manual, authenticated testing; fix and retest
Web, mobile, API and source-code security testing	Sectoral	Engineering	App-sec reports, SAST/DAST output	Mobile apps and APIs left out of scope	Test everything internet-facing, every release cycle

4. Identity and Access

Requirement	Mandatory?	Owner	Evidence auditors ask for	Common gap	Remediation
Identity and privileged-access management	Sectoral	IT / Security	Access-control matrix, privileged-account records, recertification reports	Shared admin credentials; no access reviews	Central IAM/PAM; quarterly access reviews
Multi-factor authentication (MFA)	Sectoral	IT	MFA policy and enforcement configuration	MFA on email but not servers, VPN or cloud consoles	Enforce MFA for all admin, remote and cloud access

5. Hardening and Operations

Requirement	Mandatory?	Owner	Evidence auditors ask for	Common gap	Remediation
Patch and vulnerability-management process	Recommended	IT Ops	Patch policy, SLA reports, exception log	No SLAs; end-of-life systems in production	Risk-based patching SLAs; documented exceptions
Secure configurations and hardening	Recommended	IT Ops	Hardening baselines (e.g., CIS), configuration-audit reports	Default credentials, unnecessary open ports	Adopt baselines; scan for drift
Endpoint, email and malware protection	Recommended	IT	EDR/antivirus coverage report, SPF/DKIM/DMARC records	Unmanaged laptops and personal devices	Full endpoint coverage; enforce email authentication

6. Logging, Monitoring and Time — the Mandatory Core

Requirement	Mandatory?	Owner	Evidence auditors ask for	Common gap	Remediation
Enable and retain ICT system logs for 180 days, within India	Mandatory	IT / Security	Retention configuration, log-storage evidence	Logs rotated out after days	Central log store with 180-day rolling retention
Synchronise clocks to NIC/NPL NTP servers	Mandatory	IT Ops	NTP configuration, time-sync verification	Systems pointed at random public NTP pools	Standardise on NIC/NPL (or traceably synced) time
Security monitoring, detection and response capability	Recommended	SOC / Security	Incident-response plan, alerting runbooks, drill records	Plan exists but has never been exercised	Tabletop exercises at least twice a year

7. Incidents, Resilience and Third Parties

Requirement	Mandatory?	Owner	Evidence auditors ask for	Common gap	Remediation
Report covered incidents to CERT-In within 6 hours	Mandatory	CISO / PoC	Incident log, submitted reports, acknowledgements	Teams don't know the 6-hour clock exists	Pre-filled reporting template; on-call escalation path
Data protection, encryption, backup and recovery	Mandatory for personal data (DPDP)	IT / Data owners	Encryption standards, backup logs, restore-test results	Backups exist but restores never tested	Quarterly restore tests; encrypt at rest and in transit
Business-continuity and disaster-recovery testing	Sectoral	IT / Business	BCP document, DR-drill reports, RTO/RPO definitions	DR exists on paper only	Annual DR drill with a written report
Third-party and supply-chain risk management	Sectoral	Procurement / Security	Vendor register, contract security clauses, assessments	No security or incident-notification clauses	Add clauses; assess critical vendors annually
Employee awareness training and phishing simulations	Recommended	HR / Security	Training completion records, phishing-simulation metrics	One annual slideshow	Quarterly simulations; role-based training
Evidence collection and audit documentation	Mandatory for audits	Compliance	Indexed evidence repository, previous audit reports	Evidence scattered across inboxes	Single evidence repository mapped to controls
Remediation, retesting and management sign-off	Mandatory for audits	CISO / Management	Closure report, retest certificate, sign-off	Findings marked closed without retest	Fix → retest → formal management closure

Your CERT-In Audit Tracker

Copy this table into your project tracker and update the status column weekly.

Checklist Item	Mandatory/Recommended	Owner	Evidence Required	Status
Applicability of directions and sector rules mapped	Mandatory	Compliance	Applicability memo	☐
CERT-In point of contact appointed and registered	Mandatory	CISO	PoC letter and submission	☐
Asset, app, cloud, API and data inventories	Sectoral	IT	Registers and data-flow maps	☐
Security policies approved and reviewed	Sectoral	CISO	Policy set, review minutes	☐
Risk assessment and treatment plan current	Sectoral	Risk	Risk register	☐
Network and cloud configuration reviewed	Recommended	DevOps	Review reports, diagrams	☐
VAPT completed, findings fixed, retested	Sectoral	Security	VAPT and retest reports	☐
Web/mobile/API/source-code testing done	Sectoral	Engineering	App-sec reports	☐
IAM and privileged access controlled	Sectoral	IT	Access matrix, review records	☐
MFA enforced on admin, remote and cloud access	Sectoral	IT	Enforcement configuration	☐
Patch management with SLAs operating	Recommended	IT Ops	Patch reports	☐
Hardening baselines applied	Recommended	IT Ops	Configuration audits	☐
Endpoint, email and malware protection deployed	Recommended	IT	Coverage reports	☐
Logs retained 180 days in India	Mandatory	Security	Retention configuration	☐
Clocks synced to NIC/NPL NTP	Mandatory	IT Ops	NTP configuration	☐
Detection and response plan tested	Recommended	SOC	Drill records	☐
6-hour CERT-In reporting procedure ready	Mandatory	CISO / PoC	Template, escalation path	☐
Encryption, backup and restore tests	Mandatory (DPDP)	IT	Restore-test results	☐
BCP/DR documented and drilled	Sectoral	IT / Business	Drill reports	☐
Vendor and supply-chain risk managed	Sectoral	Procurement	Vendor assessments	☐
Awareness training and phishing simulations	Recommended	HR / Security	Training metrics	☐
Evidence repository complete and indexed	Mandatory for audit	Compliance	Evidence index	☐
Remediation, retest and sign-off closed	Mandatory for audit	Management	Closure report	☐

Documents and Evidence Required for the Audit

Auditors working under the July 2025 audit policy guidelines are evidence-driven. Have these ready before fieldwork starts:

Organisation chart, audit scope statement, and network/architecture diagrams
Asset, application, cloud, and API inventories with owners
Approved security policies, risk register, and previous audit reports
VAPT and application-security reports with closure evidence
Access-control matrix, MFA configuration, and privileged-access records
Log-retention configuration, sample logs, and NTP settings
Incident-response plan, incident log, and any CERT-In submissions
Backup/restore test results, DR-drill reports, vendor contracts and assessments
Training records and management review minutes

Technical Security Controls to Implement

If you are starting from zero, sequence the work this way: first the mandatory core (point of contact, 6-hour reporting readiness, 180-day logging, NTP sync), then access control (MFA, least privilege, no shared credentials), then testing and hardening (VAPT, patching, baselines), and finally resilience (backups, DR, vendor risk). The checklist tables above give the control-by-control detail — resist the temptation to buy tools before the inventories and policies exist, because auditors test whether controls operate, not whether licences were purchased.

Incident-Reporting and Logging Requirements

These are the obligations most Indian businesses miss, and they are mandatory under the 28 April 2022 directions for service providers, intermediaries, data centres, body corporates, and government organisations:

Report covered cyber incidents within 6 hours of noticing or being notified — by email (incident@cert-in.org.in), phone (1800-11-4949), or the formats CERT-In publishes.
Annexure I lists 20 reportable incident categories, including data breaches and data leaks, unauthorised access to systems or data, website defacement or intrusion, ransomware and other malicious code, attacks on servers and network equipment, identity theft and phishing, denial-of-service attacks, incidents affecting digital payment systems, malicious or fake mobile apps, and incidents affecting cloud, IoT, or AI systems.
Designate a point of contact and share their details with CERT-In in the prescribed format.
Enable logs of all ICT systems and retain them for a rolling 180 days, within India, to be produced when CERT-In orders or directs.
Synchronise system clocks to the NTP servers of NIC or NPL (or NTP servers traceably synced to them).
VPN, cloud, and data-centre providers must keep prescribed subscriber/customer records for 5 years; virtual-asset businesses must keep KYC and transaction records for 5 years.

CERT-In's FAQ document (May 2022) clarifies scope questions — including that the 6-hour clock starts when you notice the incident, and that logs must be produced on demand.

Steps in a CERT-In-Empanelled Audit

Select an auditor from the official empanelled list and check sector experience.
Agree the scope — networks, applications, APIs, cloud accounts, locations — in writing.
Pre-audit readiness — gather the evidence pack, close obvious gaps.
Fieldwork — interviews, configuration reviews, VAPT, and evidence sampling.
Draft report — findings classified by severity, with auditee comments.
Remediation window — fix findings, collect closure evidence.
Retest — the auditor verifies fixes.
Final report / certificate — issued with a validity period and scope statement; management signs off.

Common Reasons Companies Fail or Receive Major Observations

Logs kept for 7–30 days instead of 180, or stored only with a foreign SaaS with no India copy
No named CERT-In point of contact, or a contact who left the company
MFA missing on VPNs, cloud consoles, and database access
Shared administrator credentials with no accountability trail
VAPT findings "closed" without retest evidence
Backups never restore-tested; DR plans never exercised
Vendor contracts with no security or incident-notification clauses
Evidence assembled during the audit rather than maintained continuously

Expected Audit Timeline and Factors Affecting Cost

Timelines vary with scope, but as broad market practice: readiness preparation commonly takes 4–12 weeks for a small or mid-sized organisation, audit fieldwork 2–6 weeks, and remediation plus retest another 2–8 weeks. Costs are quote-based and driven by: the number of applications, APIs, and IP addresses in scope; cloud complexity and number of accounts; whether source-code review is included; the number of retest rounds; and the auditor's tier and sector specialisation. CERT-In does not publish fixed audit prices — treat any "flat-rate certification" offer with suspicion.

How to Prepare Employees and Vendors

Brief every employee on what counts as a reportable incident and the internal escalation path — the 6-hour clock leaves no room for "we'll mention it Monday."
Run phishing simulations and short role-based training for engineering, finance, and support teams.
Give the audit team a single coordinator so auditor requests don't stall in inboxes.
For vendors: add security and incident-notification clauses to contracts, collect their audit reports or questionnaires annually, and know which vendors store your data and where.

Post-Audit Remediation and Closure Process

Treat the draft report as a project plan: assign every finding an owner and a deadline, fix high-severity items first, and collect closure evidence (configuration screenshots, retest scans, updated policies) as you go. The auditor then retests and issues the final report or certificate. Two habits keep the next cycle cheap: file all evidence in one indexed repository, and have management formally accept any residual risks in writing. Audit reports and certificates have a validity period — most organisations re-audit annually or after major infrastructure changes.

How Adaptive Helps with CERT-In Compliance

Most major observations in a CERT-In-empanelled audit trace back to the same root causes: nobody can say who accessed a database or server, credentials are shared, MFA stops at email, and logs can't reconstruct a session. Adaptive closes these at a single access layer — an agentless, container-based gateway in front of your databases, servers, clusters, and cloud infrastructure — so the controls exist everywhere at once instead of being retrofitted resource by resource.

Checklist item	How Adaptive helps
MFA on admin, remote and cloud access (item 10)	Enforces SSO and MFA on every database, server, and Kubernetes access — including tools that don't support it natively
Identity and privileged-access management (item 9)	Replaces shared credentials with identity-based, just-in-time access; approvals and auto-expiry built in
180-day log retention and evidence (items 14, 22)	Session-level audit trails — every query and command attributable to a person, exportable as auditor evidence
6-hour incident reporting (item 17)	Attributable session logs let you establish who did what, where fast enough to meet the reporting clock
Data protection (item 18)	Data masking keeps sensitive fields hidden from users and tools that don't need them
Third-party and vendor access (item 20)	Time-bound, recorded vendor access without VPNs or standing accounts

Because the gateway deploys agentlessly in your own environment, it narrows the audit scope rather than expanding it — and typically stands up in days, not months.

Frequently Asked Questions

Q: Does CERT-In certify companies directly? No. CERT-In empanels audit firms. Your company engages an empanelled firm and receives that firm's audit report or certificate — there is no universal "CERT-In certification" for businesses.

Q: Do the CERT-In directions apply to my small business? The 28 April 2022 directions apply to service providers, intermediaries, data centres, body corporates, and government organisations — which covers virtually every company operating IT systems in India. MSMEs were given time until 25 September 2022 to comply; the obligations are in force for everyone now.

Q: Which incidents must be reported within 6 hours? The 20 categories in Annexure I of the directions — including data breaches, data leaks, unauthorised access, website defacement, ransomware, denial-of-service attacks, and incidents affecting payment systems, cloud, IoT, or AI systems.

Q: How long must we keep logs, and where? ICT system logs must be enabled and retained for a rolling 180 days within India, and produced when CERT-In directs.

Q: How do we choose a CERT-In-empanelled auditor? Start from the official list on cert-in.org.in, then shortlist by sector experience, testing depth (manual vs. purely automated), retest terms, and references — the list is updated periodically, so verify the firm's current empanelment status.

Conclusion and Next Step

CERT-In compliance is not a certificate you buy — it is a small set of mandatory duties (6-hour incident reporting, 180-day logging, NTP sync, a registered point of contact) plus an audit discipline that regulators, tenders, and enterprise customers increasingly demand. Companies that treat the checklist as infrastructure — not paperwork — walk into a CERT-In-empanelled audit with evidence already in hand.

Preparing for a CERT-In-empanelled audit? Contact info@adaptive.live or book a demo to close the access, authentication, and audit-trail items on this checklist before the auditor arrives.

This article is for general informational purposes and does not constitute legal, regulatory or cybersecurity advice. Requirements may vary according to the organisation's industry, systems, data, contracts and regulatory status. Organisations should verify current requirements through official CERT-In publications and qualified legal and cybersecurity advisers.

CERT-In Compliance Checklist: A Practical Guide for Indian Businesses