CERT-In compliance · Checklist
Every CERT-In requirement, and the proof that you meet it.
CERT-In has issued one short set of binding Directions and a growing shelf of guidelines around them. Most checklists mix the two up. This one goes line by line: what each requirement asks, who it binds, and what you would show an auditor.
Reviewed 6 November 2026 · 12 sources cited
The short answer
A CERT-In checklist has two layers. The law is the Directions of 28 April 2022: synchronise clocks to NIC or NPL time, report any of twenty listed incident types within six hours of noticing them, name a point of contact, keep 180 days of logs and, for cloud, VPN, data-centre and virtual-asset providers, keep customer records for five years. Around them sit guidelines, including the July 2025 audit policy. Start with the six-hour path.
Start here
Two kinds of CERT-In document, and only one of them is law.
When someone asks whether a company is “CERT-In compliant”, they usually mean the Directions of 28 April 2022, issued under section 70B(6) of the IT Act: six numbered directions and three annexures, binding every service provider, intermediary, data centre, body corporate and government organisation. Ignoring a direction is an offence under section 70B(7).
Everything CERT-In has published since is guidance with a narrower audience. The Comprehensive Cyber Security Audit Policy Guidelines of 25 July 2025 bind CERT-In-empanelled auditors and the auditees “covered under the relevant provisions” — in practice, organisations whose regulator, government department or contract requires an empanelled audit. The 2023 guidelines for government entities apply to ministries, departments and public sector enterprises. The 2025 controls for MSMEs are recommended: MSMEs “may” use them.
The checklist keeps the two apart: rows 1–10 are law whatever your size; the rest bind where a regulator, a government buyer or a contract brings them in. Where CERT-In’s own FAQ — “not a legal document”, it says — softens a direction, the table says so. General information, not legal advice.
What CERT-In has issued
The CERT-In documents a checklist has to cover
In date order, with what each one changed. The links are in the sources.
-
28 Apr 2022
The Directions under section 70B(6)
Six directions and three annexures; Annexure I lists twenty reportable incident types. In force 60 days after issue.
-
May 2022
FAQs on the Directions
Forty-four answers that clarify — and in places soften — the Directions. Not a legal document, by its own account.
-
27 Jun 2022
Extension for MSMEs
The Directions took effect for MSMEs on 25 September 2022, as did validated customer names and addresses for hosting, cloud and VPN providers.
-
Jun 2023
Guidelines for Government Entities
A baseline for ministries, departments and public sector enterprises: a CISO registered as point of contact, internal audits every six months, a third-party audit every year.
-
25 Jul 2025
Comprehensive Cyber Security Audit Policy Guidelines, v1.0 In force now
How empanelled audits are scoped, contracted, run and reported. It lists bill-of-materials audits among its engagement types; CERT-In’s SBOM, AIBOM and HBOM guidelines v2.0 followed on 9 July 2025.
-
May 2027
DPDP breach reporting runs alongside Coming
From about 13 May 2027 the DPDP Rules, 2025 add a second clock for personal-data breaches — a detailed report within 72 hours. It does not replace CERT-In’s six hours.
The DPDP dates are tracked in our DPDP deadlines tracker.
The full checklist
Every requirement, with the evidence to keep
Rows 1–10: the 2022 Directions and FAQ — law for everyone. Rows 11–18: the July 2025 audit policy. Rows 19–20: government entities and MSMEs. The printable PDF is this table.
| Requirement | What it asks | Applies to | Evidence to keep |
|---|---|---|---|
| 1. Synchronise ICT clocks (Direction i) | Sync every ICT system’s clock to NIC or NPL NTP servers, or servers traceable to them. Multi-country entities may use another source that does not deviate from them; cloud customers may keep native cloud time. IST is not required; record the time zone. | All service providers, intermediaries, data centres, body corporates and government organisations | NTP settings for servers, network and security devices and cloud workloads; the sources used (samay1.nic.in, samay2.nic.in, time.nplindia.org or traceable); a drift check |
| 2. Report incidents within 6 hours (Direction ii) | Report any Annexure I incident within 6 hours of noticing it or being told of it — to incident@cert-in.org.in, 1800-11-4949 or fax 1800-11-6969. If the full picture is not ready, report what is known and add detail later (FAQ Q30). | All of the above; the FAQ applies the reporting duty to any entity, including foreign firms serving Indian users | A procedure naming who decides and who files at any hour; a pre-filled initial report; copies of reports with timestamps; a timed tabletop |
| 3. The 20 reportable incident types (Annexure I) | Targeted scanning of critical systems; compromise of critical systems; unauthorised access; website defacement or intrusion; malicious code incl. ransomware; attacks on database, mail, DNS servers or routers; identity theft, spoofing, phishing; DoS/DDoS; attacks on critical infrastructure, SCADA, OT, wireless; attacks on applications; data breach; data leak; IoT; digital payments; malicious apps; fake apps; social-media account takeover; cloud; big data, blockchain, virtual assets, robotics, 3D printing, drones; AI/ML. | All of the above | Triage criteria mapping each alert category to an Annexure I type; detection coverage for each type that applies to you |
| 4. The duty cannot be contracted away (FAQ Q13, Q22) | Any entity that notices an incident must report it; the obligation is “neither transferrable nor indemnified”, and it overrides confidentiality clauses in contracts (IT Act, section 81). | All entities, including outsourcers and the clients whose data they hold | Vendor contracts requiring prompt incident notice to you; a responsibility matrix for joint incidents |
| 5. Act on CERT-In orders (Direction iii) | When CERT-In orders it, take the action or provide the information asked for, in the format (up to near real-time) and timeframe set. Missing it is non-compliance. | All of the above | A procedure for CERT-In requests; a register of requests, responses and dates |
| 6. Name a point of contact (Direction iii, Annexure II) | Email info@cert-in.org.in with the contact’s name, designation, organisation, office address, email, mobile, office phone and fax, and keep it current. Service providers serving Indian users must name one even without an Indian office (FAQ Q29). | All of the above | The dated submission email; a check in the leaver and role-change process; a named deputy |
| 7. Keep logs 180 days, in Indian jurisdiction (Direction iv) | Enable logs of all ICT systems; keep them securely for a rolling 180 days within Indian jurisdiction; hand them over with an incident report or on order. FAQ Q35 says logs may also be stored outside India if produced in reasonable time; Q36 says service providers serving Indian users keep them in Indian jurisdiction. Take your reading to counsel. | All of the above | Retention settings per log source; where each store physically sits; integrity protection; a test retrieval of a 170-day-old record |
| 8. Log the right events (FAQ Q37) | Logs depend on the sector — for example firewall, IPS, SIEM, web, database, mail, proxy, critical-system event, application, SSH and VPN logs. Record failed as well as successful events. | All of the above | A log-source inventory mapped to your systems; sample failed-login and denied-connection records |
| 9. Customer records — hosting, cloud and VPN providers (Direction v) | Keep for 5 years or longer after a customer leaves: validated names, period of hire, IPs allotted, email, IP and timestamp at sign-up, purpose, validated address and phone numbers, ownership pattern. Enterprise VPNs are outside this rule (FAQ Q34). | Data centres, VPS providers, cloud service providers, and VPN providers offering proxy-like services to the public | Onboarding records and the validation method; a retention schedule |
| 10. KYC and transaction records — virtual assets (Direction vi) | Keep KYC information and transaction records for five years, so each transaction can be reconstructed: parties with IP addresses, timestamps and time zones, transaction ID, public keys, addresses or accounts, nature, date and amount. | Virtual asset service providers, virtual asset exchanges, custodian wallet providers | The KYC procedure (Annexure III documents); the transaction-record schema; a reconstruction test |
| 11. A comprehensive audit at least once a year, and after major changes | Audit all ICT systems at least once a year (regulators may require more), and periodically even without change. Classify every change as minor or major; audit major ones — overhauls, migrations, changes touching sensitive data — before implementation. | Organisations covered by the July 2025 audit policy — typically where a regulator, government department or contract requires a CERT-In-empanelled audit | An audit calendar; the last report and closure report; change records with the classification |
| 12. Scope from the asset inventory | Cover systems, apps, network, OT/ICS, cloud, APIs, databases, hosting, code and incident-response capability, across UAT, development and production, plus third-party risk and follow-up audits. Internal audit vets it with the CISO. Critical databases get configuration audits; critical apps get DAST and SAST. | As row 11 | A dated asset inventory; the signed scope; the list of critical assets |
| 13. Top management owns the programme | Top management approves the audit programme, scope and time-bound remediation; the head of the organisation signs risk acceptances. The process cannot be delegated, though specialists may help. Annual reports state audit frequency and broad scope. | As row 11 | Board or management minutes; signed risk acceptances; the annual-report extract |
| 14. Choose and verify the auditor | Shortlist from CERT-In’s empanelled list and its published skills snapshot. Interview the proposed team; check credentials and identity documents. No freelancers, interns, freshers, moonlighters, third-party consultants or staff serving notice; no sub-letting. | As row 11 | Selection notes; identity and credential checks for each auditor |
| 15. Contract for independence | Fees must not depend on the outcome or on closure. The same firm should not implement and audit, or audit and remediate. Sign an NDA first; name the audit standards, such as the national Cyber Security Audit Baseline Requirements — not short lists like the OWASP Top 10; add a revalidation clause and an escalation matrix. | As row 11 | Signed contract and NDA; a conflict-of-interest declaration |
| 16. Reports, certificates and closure | Findings rated by CVSS severity and EPSS likelihood; reports signed by the auditors, an independent reviewer and the firm’s head; hashes, versions and timestamps of what was audited recorded; follow-up audits confirm closure. | As row 11 | Final report; certificate with hashes and versions; closure report |
| 17. Audit data stays in India | The auditor keeps your data only on systems in India, encrypted on laptops, wiped after the project with a deletion certificate, and reports the audit to CERT-In within 5 days of completion. | CERT-In-empanelled auditors; auditees should check it happens | The data-handling clause; the deletion certificate |
| 18. Remote access and basic hygiene | Remote access is tunnelled, encrypted and logged, with mandatory multi-factor authentication. Inventory authorised assets, patch, harden defaults, apply least privilege. | As row 11 | MFA enforcement report; asset inventory; patch status |
| 19. Government entities | A CISO registered with CERT-In as point of contact; internal audit at least every 6 months; third-party audit at least yearly; audits before and after major implementations; perimeter and SIEM logs for 180 days. | Ministries, departments, their offices, government institutions, public sector enterprises and agencies | CISO nomination; audit calendar and reports; log retention settings |
| 20. MSME baseline (recommended) | Fifteen controls and 45 recommendations. MSMEs “may” self-assess and “may” have an empanelled auditor check them once a year. | MSMEs under the MSME Act — recommended, not mandatory | A dated self-assessment; any baseline audit report |
Penalty for failing to provide information or comply with a direction: section 70B(7) of the IT Act — up to one year’s imprisonment, a fine of up to ₹1 lakh, or both. CERT-In’s FAQ says the power “will be exercised reasonably and on occasions when the non-compliance is deliberate”. Not legal advice.
14-question self-check
Could you show it today?
Tick only what you could show an auditor or CERT-In now. Questions 1–9 cover the Directions, which are law for everyone; 10–14 cover the audit guidelines.
Where SemperWise fits
Readiness, testing and evidence — not the empanelled audit itself.
Services are people doing the work; SemperWise One is the platform. Each row says which.
“Would we really meet six hours on a Saturday night?”
A gap review against each direction — logs, clocks, point of contact, reporting path — checked in configuration, then a timed tabletop with the people who would be on call.
CERT-In Directions readiness“The empanelled audit is in three months.”
Testing of your apps, APIs, network and cloud before the auditor arrives, every finding confirmed by a person, retest included. You appoint the empanelled auditor directly.
VAPT“Last year’s findings are still open.”
Fix verification between audits, so findings reach the closure report with evidence — and releases are tested as they ship.
Continuous testing“The auditor wants a complete asset inventory.”
Continuous discovery of your domains, cloud services and exposed logins, kept as an inventory the scope can be drawn from.
Attack surface management“We need dated evidence on file before anyone asks.”
The programme run on a subscription: evidence for each requirement collected in SemperWise One with its collection date and expiry, audit dates in its compliance calendar.
Compliance as a service“Nobody owns CERT-In here.”
A named senior practitioner a few days a month, with an incident response retainer carrying a defined commitment.
Virtual CISOPrintable version
Take the checklist into the meeting.
The full checklist is on this page — the requirements table above is the PDF, row for row. We email the printable version so that when CERT-In issues or revises a direction, we can send you the updated copy.
- All 20 requirements: what each asks, who it binds and the evidence to keep
- The twenty reportable incident types and CERT-In’s reporting contacts
- An updated copy when CERT-In changes a direction or guideline
We reply within 24 business hours. Your email is used only to send the checklist and its updates.
Thank you
We have emailed you the CERT-In Directions compliance checklist. You can also download it now.
If it is urgent, call +91-95851-60363.
Questions
What people ask about CERT-In next.
The follow-up questions this subject raises, answered in full.
What are the CERT-In guidelines for companies?
The binding part is the Directions of 28 April 2022 under section 70B(6) of the IT Act: synchronise clocks to NIC or NPL time, report twenty listed incident types within six hours, act on CERT-In orders, name a point of contact, keep 180 days of logs, and — for hosting, cloud, VPN and virtual-asset providers — keep customer records for five years. Around them sit guidelines, chiefly the July 2025 audit policy. Our CERT-In Directions page covers the readiness work.
Which incidents must be reported to CERT-In within six hours?
Annexure I of the Directions lists twenty types, including targeted scanning of critical systems, unauthorised access, website defacement, ransomware and other malicious code, attacks on mail, database or DNS servers, phishing, DDoS, data breaches and data leaks, attacks on IoT, payment and cloud systems, fake or malicious apps, and social-media account takeover. The clock starts when you notice the incident or are told about it. CERT-In’s FAQ allows a first report with what you know and detail later.
Do CERT-In logs have to be stored in India?
The Direction says logs of all ICT systems must be kept for a rolling 180 days and “maintained within the Indian jurisdiction”. CERT-In’s May 2022 FAQ then says logs may also be stored outside India as long as they can be produced to CERT-In in reasonable time, while service providers serving users in India must keep them in Indian jurisdiction. Keep a copy you control and can hand over within hours, and have counsel confirm your reading.
Is a CERT-In audit mandatory for private companies?
Not under the Directions. An empanelled audit becomes mandatory when a sector regulator, a government buyer or a contract requires one. CERT-In’s audit policy guidelines of 25 July 2025 then apply: a comprehensive audit of all ICT systems at least once a year, audits after major changes, scope drawn from the asset inventory, and a closure report. SEBI-regulated entities should read our SEBI CSCRF checklist for the audit rules that apply to them.
How do I choose a CERT-In-empanelled auditor?
Start from CERT-In’s published list and each firm’s snapshot. The 2025 guidelines tell auditees to interview the proposed team, check credentials and identity documents, and refuse freelancers, interns, freshers, moonlighters and staff serving notice. Tie fees to scope and deliverables, never to the outcome. Empanelled firms may not sub-let. Contract for an NDA, named standards and follow-up audits.
What is the penalty for not following CERT-In directions?
Section 70B(7) of the IT Act: imprisonment of up to one year, a fine of up to ₹1 lakh, or both, for failing to provide information CERT-In calls for or to comply with a direction. CERT-In’s FAQ says the power will be used reasonably and where non-compliance is deliberate. Sector regulators and, from about 13 May 2027, the DPDP Act carry separate penalties. Pages quoting a ₹1 crore CERT-In penalty are wrong.
Do the CERT-In Directions apply to foreign companies, startups and MSMEs?
CERT-In’s FAQ says the Directions apply to “any entity whatsoever, in the matter of cyber incidents”, so a foreign company serving Indian users owes the reporting duty and must name a point of contact even without an Indian office. Startups are body corporates like any other. For MSMEs the Directions took effect on 25 September 2022; CERT-In’s fifteen MSME controls are recommended, not mandatory — see our MSME page.
Can SemperWise carry out our CERT-In audit?
No. SemperWise is not CERT-In empanelled, so we cannot issue an empanelled audit report or certificate — and because empanelled auditors may not sub-let audits, we cannot do the work behind someone else’s name either. We do the work around the audit: readiness against each direction, testing before and between audits, fix verification so findings reach closure, and the evidence pack. You appoint the empanelled auditor directly; we say so in the first call.
Sources
Checked by our research desk on 6 November 2026. Regulations and figures move; where a number here matters to a decision, follow it to the source.
- Directions under sub-section (6) of section 70B of the IT Act, 2000 (No. 20(3)/2022-CERT-In) — CERT-In, 28 April 2022
- Frequently Asked Questions on Cyber Security Directions of 28.04.2022 — CERT-In, May 2022
- Extension of timelines for enforcement of the Cyber Security Directions for MSMEs and for validation of subscriber details — CERT-In, 27 June 2022
- Guidelines on Information Security Practices for Government Entities — CERT-In, June 2023
- CERT-In issues “Guidelines on Information Security Practices” for Government Entities — Press Information Bureau, 30 June 2023
- Comprehensive Cyber Security Audit Policy Guidelines, v1.0 — CERT-In, 25 July 2025
- Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, v2.0 — CERT-In, 9 July 2025
- 15 Elemental Cyber Defense Controls for MSMEs, v1.0 — CERT-In, 1 September 2025
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), Rules 1 and 7 — MeitY, 13 November 2025
- Incident Reporting Form — CERT-In
- List of CERT-In empanelled information security auditing organisations, with snapshots — CERT-In
- Cyber Security Audit Baseline Requirements (NSCS-46-16) — National Security Council Secretariat, October 2020
Next step
Find your gaps before the auditor does.
Thirty minutes, no charge. Bring your self-check result. You leave knowing which CERT-In lines you can evidence, which you cannot, and what to fix first — and, if work makes sense, a written scope and a fixed price.