Cybersecurity Compliance
CERT-In Audit Explained: Requirements, 6-Hour Reporting & Empanelment
CERT-In (the Indian Computer Emergency Response Team) sets security-audit and incident-reporting expectations that flow through many Indian regulations - RBI, SEBI, ministries and beyond. Whether you need a CERT-In-style security audit for a regulator, or must comply with CERT-In's 2022 directions, this guide explains what's required.
What is a CERT-In audit?
A CERT-In audit is a security assessment - typically VAPT plus configuration and compliance review - performed and documented in the format CERT-In and downstream regulators expect. Many Indian mandates (RBI, SEBI, government tenders) require a CERT-In-style audit report as evidence of security posture.
CERT-In maintains a panel of empanelled auditors. Where a mandate specifically requires a CERT-In empanelled auditor, that credential matters; in other cases, a CERT-In-aligned methodology and report format is what's needed.
The 6-hour incident-reporting rule
CERT-In's 2022 directions require specified entities to report listed cyber incidents within six hours of noticing or being informed of them. This is a demanding timeline - it means your detection, triage and escalation runbook must be built and rehearsed for six-hour reporting, not next-business-day.
Log-retention and other obligations
- Retain specified logs within India for a rolling 180-day period
- Synchronize system clocks to NTP (NIC / NPL) for reliable forensics
- Maintain reachable points of contact for CERT-In coordination
- Report the listed categories of incidents within the 6-hour window
How CERT-In connects to other regulators
CERT-In requirements are woven through RBI's cyber framework, SEBI's CSCRF, and government procurement. A single, well-run CERT-In-aligned audit and incident-response capability therefore supports compliance across several regulators at once - which is why it's a smart foundation to build first.
Need help with this in practice?
A5 Cyber Nexus audits, remediates and certifies against these frameworks.
Frequently asked questions
Do I need a CERT-In empanelled auditor specifically?
It depends on the mandate. Some regulators or tenders require a CERT-In empanelled auditor; others accept a CERT-In-aligned methodology and report format. We help you determine what your specific obligation requires.
What incidents must be reported within 6 hours?
CERT-In's directions list categories including targeted scanning/probing of critical systems, compromise of critical systems, unauthorized access, data breaches, and attacks on infrastructure, among others - reportable within six hours of detection.
Make it accessible.
Make it attack-ready.
Prove both before launch.
Bring us your app, audit deadline, or security concern. We'll map the fastest path to WCAG conformance, VAPT coverage, and regulator-ready evidence.
