CERT-In Audit Guidelines (India)
India's national requirements for cyber security audits and incident reporting.
- Audit guidelines
- Jul 2025
- Incident reporting
- 6 hours
- Log retention
- 180 days
- Issued by
- CERT-In, MeitY
What is CERT-In Audit Guidelines (India)?
The Indian Computer Emergency Response Team (CERT-In) is the national agency for cyber security incident response under the Ministry of Electronics and Information Technology. It sets directions for organisations and empanels auditors who perform cyber security audits.
In July 2025 CERT-In issued Comprehensive Cyber Security Audit Policy Guidelines. They cover compliance audits, vendor risk audits and specialised audits such as blockchain security, and include applicable regulator directions in audit scope by default.
Who needs it
- Government ministries, departments and public sector organisations
- Regulated entities whose regulator requires audits by CERT-In empanelled auditors
- Service providers, data centres, cloud and VPN providers covered by the 2022 directions
- Any organisation operating in India that must report cyber incidents to CERT-In
Key obligations
Two sets of CERT-In requirements matter most for audit readiness.
Cyber Security Audit Policy Guidelines (July 2025)
- Compliance audits against applicable policies and standards
- Vendor and third-party risk audits
- Specialised audits, for example blockchain security
- Regulator directions included in audit scope by default
CERT-In Directions (April 2022)
- Report specified cyber incidents to CERT-In within 6 hours of noticing them
- Retain ICT system logs for a rolling 180 days within Indian jurisdiction
- Synchronise system clocks with NTP servers of NIC or NPL, or traceable sources
- Nominate a point of contact to interface with CERT-In
Preparing for a CERT-In audit
A practical sequence for getting audit-ready.
01
Confirm applicability
Identify which regulator directions and CERT-In requirements apply to your organisation and systems.
02
Readiness review
Check incident reporting, logging, time synchronisation and vendor controls against the requirements.
03
Remediate
Close gaps and document processes, evidence and responsibilities.
04
Audit
Engage a CERT-In empanelled auditor where your regulator or the guidelines require one.
From gap to evidence
- Applicability assessment across CERT-In directions and sector regulator requirements
- Readiness reviews of incident response, logging and time synchronisation
- Vulnerability assessment and penetration testing ahead of the formal audit
- Remediation support and evidence preparation
Frequently asked questions
What is the 6-hour reporting rule?
Under the April 2022 directions, specified types of cyber incidents must be reported to CERT-In within 6 hours of being noticed or brought to an organisation's attention.
What logs must be retained?
Logs of all ICT systems must be maintained securely for a rolling period of 180 days, within Indian jurisdiction, and provided to CERT-In on request.
What is a CERT-In empanelled auditor?
An auditing organisation that CERT-In has evaluated and listed as eligible to perform cyber security audits. Many government and regulated entities must use one.
How do the 2025 guidelines relate to sector regulators?
The guidelines include applicable regulator directions in audit scope by default, so an audit covers both CERT-In and sector requirements.
Working towards CERT-In?
Start with a gap assessment and a clear, prioritised plan.