How to prepare for a CERT-In audit
CERT-In's 2022 directions and its July 2025 audit policy guidelines set clear expectations for Indian organisations. A practical preparation checklist.
· 5 min read
The Indian Computer Emergency Response Team (CERT-In) sets national requirements for incident reporting and cyber security audits. Two documents matter most when preparing: the directions issued in April 2022 and the Comprehensive Cyber Security Audit Policy Guidelines issued in July 2025.
What the 2022 directions require
- Report specified cyber incidents to CERT-In within 6 hours of noticing them.
- Keep logs of all ICT systems securely for a rolling 180 days, within Indian jurisdiction.
- Synchronise system clocks with NTP servers of NIC or NPL, or sources traceable to them.
- Nominate a point of contact to interface with CERT-In.
What the 2025 audit guidelines add
The guidelines cover compliance audits, vendor risk audits and specialised audits such as blockchain security, and include applicable regulator directions in audit scope by default. In practice an audit checks both CERT-In requirements and your sector regulator's expectations.
A preparation checklist
- List which regulators and directions apply to your organisation and systems.
- Test your incident reporting path: who decides, who reports, and can it happen within 6 hours, including at night and weekends.
- Check log retention and storage location for every ICT system in scope, including cloud services.
- Verify time synchronisation across servers, network devices and cloud workloads.
- Review vendor contracts for security obligations and audit rights.
- Run a vulnerability assessment and penetration test, and close critical findings before the audit.
- Engage a CERT-In empanelled auditor where your regulator or the guidelines require one.
Read the source documents on the CERT-In website for the exact wording that applies to you; this article is a summary, not legal advice.