CERT-In Guidelines for Businesses: What You Must Know

• Offensium Vault
• November 4, 2026
• No Comments

India’s national cyber security agency, CERT-In, has steadily tightened expectations on how organisations prepare for, detect and report cyber incidents. For founders, CTOs and IT managers, understanding the CERT-In guidelines is no longer optional: missing a reporting deadline or failing to keep the right logs can create legal exposure on top of the damage from the incident itself.

This guide summarises the key CERT-In guidelines for businesses, including the April 2022 directions and the 2025 cyber security audit policy guidelines, and explains the practical steps to get ready. It is general information, not legal advice, so confirm the details that apply to you with your legal and compliance advisers.

What Is CERT-In?

The Indian Computer Emergency Response Team (CERT-In) is the national agency for responding to cyber security incidents, under the Ministry of Electronics and Information Technology. It operates under Section 70B of the Information Technology Act, 2000, which allows it to issue directions and guidelines on information security practices, incident reporting and prevention.

The April 2022 CERT-In Directions: Key Requirements

On 28 April 2022, CERT-In issued directions that came into effect on 27 June 2022. They apply to “covered persons”, which include service providers, intermediaries, data centres, body corporates and government organisations. The main requirements are:

The directions list a wide range of reportable incidents, including targeted scanning of critical systems, compromise of systems, unauthorised access, malicious code such as ransomware, phishing, data breaches and data leaks, and attacks on cloud, payment and other critical services.

The 2025 Comprehensive Cyber Security Audit Policy Guidelines

In July 2025, CERT-In issued comprehensive cyber security audit policy guidelines that set expectations for both auditing organisations and the organisations being audited. Key points include:

• Organisations are expected to have a comprehensive audit of their ICT infrastructure at least once a year, with additional audits when risks or compliance needs arise.
• Audits under the guidelines should be conducted by CERT-In empanelled auditing organisations.
• Audits can cover areas such as vulnerability assessment and penetration testing, source code review, cloud, IoT and OT security, red team exercises and more.
• Top management is expected to define and approve the audit scope, and the auditee must prevent unauthorised changes to systems after the audit.
• Privileged access given to auditors should be temporary, and high-risk tests require explicit permission.

If a regulator, auditor or customer requires an audit by a CERT-In empanelled organisation, confirm the provider’s current empanelment before engaging them.

How CERT-In Guidelines Affect Everyday Security Operations

Detection Has to Be Fast

A six-hour reporting window only works if you can spot incidents quickly. That means centralised logging, alerting on suspicious activity and clear ownership of who reviews alerts.

Logs Must Be Complete and Accurate

Retaining logs for 180 days is not enough on its own. They must cover the right systems, have synchronised timestamps and be protected from tampering so they are useful in an investigation.

Response Must Be Planned in Advance

Teams need to know who decides whether an incident is reportable, who files the report and how evidence is preserved. A documented incident response plan with roles, escalation paths and templates makes the six-hour deadline realistic.

Regular Testing Reduces Incidents

Many reportable incidents start with known weaknesses: unpatched systems, misconfigured cloud storage or exposed admin panels. Regular VAPT and configuration reviews find and fix these before they turn into incidents.

CERT-In Readiness Checklist for Businesses

1. Confirm whether your organisation is a covered person and record the decision.
2. Appoint and register a point of contact for CERT-In.
3. Map all ICT systems and confirm that logging is enabled for each.
4. Store logs securely within India for at least 180 days.
5. Synchronise clocks with NIC/NPL NTP servers or traceable sources.
6. Write an incident response plan with a clear six-hour reporting workflow.
7. Run a tabletop exercise to test the plan with your team.
8. Schedule regular VAPT, configuration reviews and remediation.
9. Check whether any regulator or customer requires an annual audit by a CERT-In empanelled auditor.
10. Review this checklist at least once a year and after major changes.

CERT-In requirements also overlap with India’s data protection law. When personal data is involved, the Digital Personal Data Protection framework adds its own security and breach notification obligations.

Frequently Asked Questions

Do the CERT-In directions apply to small businesses?

The April 2022 directions apply to “covered persons”, which include service providers, intermediaries, data centres, body corporates and government organisations. Many ordinary companies fall within this, so most businesses operating ICT systems in India should assume the six-hour reporting and log retention requirements apply and take legal advice if unsure.

What is the deadline for reporting a cyber incident to CERT-In?

Covered persons must report specified cyber security incidents to CERT-In within six hours of noticing the incident or being informed about it.

Does every security test need a CERT-In empanelled auditor?

Not necessarily. The 2025 audit policy guidelines state that audits carried out under them should be done by CERT-In empanelled auditing organisations, and some regulators require empanelled auditors for specific audits. Other testing, such as internal assurance, pre-release testing or customer-requested assessments, may not have this requirement. Always check what your regulator, auditor or customer specifies.

Conclusion

The CERT-In guidelines require Indian businesses to detect incidents quickly, keep reliable logs, report within six hours and test their defences regularly. Organisations that treat these as part of good security practice, rather than paperwork, end up both more compliant and harder to breach.

Need help preparing? Offensium Vault can support you with VAPT, configuration reviews and incident response planning. Contact our team or explore all our cybersecurity services.