- Home
- Compliance
- CERT-In Security Audit
Regulatory compliance
CERT-In Security Audit
CERT-In's Cyber Security Directions apply broadly to organisations operating in India, with firm requirements on incident reporting, logging and points of contact. We assess your readiness and run security audits following CERT-In guidelines.
Why teams choose Adiroha
- Led by CISA and ISO 27001 lead auditors
- Clear scope, roadmap and timeline before we start
- Evidence organised in the Cydital platform
- Support through the external audit and beyond
Scope
What we cover
- Six-hour incident reporting readiness
- 180-day log retention within India
- NTP time synchronisation
- Designated point of contact
- Security audit following CERT-In guidelines
- VAPT across applications and infrastructure
Deliverables
What you receive
- CERT-In Directions compliance assessment
- Security audit report
- Incident reporting playbook
- Remediation roadmap
How we work
Discover. Assess. Remediate. Validate.
Discover
Understand your business, scope, stakeholders and the obligations that actually apply to you.
Assess
Gap assessment against the framework or regulation, turned into a prioritised, costed roadmap.
Remediate
Implement policies, controls and evidence with your teams, tracked in Cydital.
Validate
Internal audit before the external one, audit-day support, and continuous compliance after.
FAQ
Common questions
What must be reported to CERT-In within six hours?
Specified types of cyber incidents must be reported within six hours of noticing them, as set out in CERT-In's April 2022 Directions.
Who do the CERT-In Directions apply to?
They apply to service providers, intermediaries, data centres, body corporates and government organisations, with additional obligations for certain providers.
Are you a CERT-In empanelled auditor?
Ask us during scoping. Where a CERT-In empanelled auditor is mandatory, we confirm how the audit will be conducted to meet that requirement.
What logs must be kept for 180 days?
CERT-In requires logs of ICT systems to be maintained securely for a rolling 180 days within India. We help you identify which systems are in scope.
What happens if we don't comply with the CERT-In Directions?
Non-compliance can lead to penalties under the IT Act. More importantly, poor logging and reporting slow down your response to real incidents.
Related
Related services
SAR Compliance Audit
Readiness and support for RBI's System Audit Report on payment data localisation for payment system operators.
Learn moreDPDP Act 2023
DPDP Act 2023 readiness — data mapping, consent, notices, data principal rights, breach response and Significant Data Fiduciary obligations.
Learn moreCICRA
Compliance and information security assessment under the Credit Information Companies (Regulation) Act, 2005.
Learn moreTalk to a specialist about CERT-In Security Audit.
A free 30-minute consultation to understand your scope and timeline. We follow up with a fixed proposal.