CERT-In Guidelines for Businesses (2026): Annual Audit, 6-Hour Incident Reporting & Compliance Checklist

If you run a website, app, SaaS product, or IT systems in India, three sets of rules now land on your desk: CERT-In's 6-hour incident reporting directions, CERT-In's annual cyber security audit guidelines, and the DPDP Act and Rules on personal data. They overlap, they are often confused with each other, and missing them can be expensive. This guide explains each in plain language and finishes with a practical compliance checklist.

This article is a practical summary written in October 2026, not legal advice. CERT-In updates its guidance from time to time, so confirm the current text on cert-in.org.in and with your legal counsel or sector regulator.

The Three Rule Sets at a Glance

What Is CERT-In?

CERT-In is the Indian Computer Emergency Response Team, India's national agency for cyber security incidents. It operates under the Ministry of Electronics and Information Technology (MeitY) and has statutory powers under Section 70B of the Information Technology Act, 2000 to collect incident information, issue alerts, and issue directions and guidelines on cyber security practices and incident response. When CERT-In issues a direction under Section 70B(6), it carries legal force.

The 2022 Directions: 6-Hour Reporting and Log Retention

The directions issued on 28 April 2022 apply to service providers, intermediaries, data centres, body corporates, and government organisations. Their five headline requirements are:

1. Report incidents within 6 hours

Cyber incidents must be reported to CERT-In within 6 hours of noticing them or being made aware of them. Reports go to incident@cert-in.org.in, following the format and channels CERT-In publishes. The clock starts when you notice or are told, not when your investigation finishes, so you should report with what you know and add detail as the investigation progresses.

Reportable incident types include, among others:

• Unauthorised access to IT systems or data, and data breaches or data leaks
• Compromise of critical systems or attacks on servers and network devices
• Website defacement, or intrusion with unauthorised changes such as injected malicious code
• Malicious code attacks such as ransomware, trojans, botnets, and spyware
• Phishing, spoofing, and identity theft attacks
• Denial-of-service and distributed denial-of-service attacks
• Attacks on applications such as e-commerce and e-governance platforms
• Attacks involving malicious or fake mobile apps, cloud systems, IoT devices, and digital payment systems

2. Keep ICT logs for 180 days, inside India

Logs of all ICT systems must be enabled and maintained securely for a rolling period of 180 days, and kept within Indian jurisdiction. They must be producible to CERT-In when requested.

3. Synchronise system clocks

ICT system clocks must be synchronised to the Network Time Protocol servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to servers traceable to them, so that logs from different systems line up during an investigation.

4. Designate a point of contact

Name a person or role who interfaces with CERT-In and can act when a report is due. At 3 a.m. on a Sunday, that contact needs to be reachable.

5. Extra record-keeping for specific providers

Data centres, virtual private server providers, cloud service providers, and VPN service providers must maintain accurate subscriber or customer registration information for five years, even after the subscription ends.

Failure to comply with a Section 70B(6) direction is punishable under Section 70B(7) of the IT Act with imprisonment of up to one year, a fine of up to ₹1 lakh, or both.

The 2025 Audit Guidelines: Annual Cyber Security Audits

On 25 July 2025, CERT-In issued the Comprehensive Cyber Security Audit Policy Guidelines. They set common standards for how audits are conducted, for both organisations being audited and the audit firms that perform them. The points most relevant to a business are:

• Annual audits. Organisations are expected to carry out a comprehensive cyber security audit of their ICT systems at least once a year.
• Audit after major changes, such as technology migrations and significant configuration changes.
• Broad scope. The guidelines cover risk assessments, information security testing including source code review, regulatory compliance checks, and even blockchain security audits. Requirements from CERT-In and your sector regulator are in scope by default.
• A control checklist for sensitive systems. For critical applications that handle sensitive personal data, the guidelines point to CERT-In's Comprehensive Audit Program Checklist covering 282 control points.
• Management ownership. Top management is expected to review and approve the audit programme, scope, and remedial measures.
• Reporting to CERT-In. Auditors are required to submit audit reports and metadata to CERT-In within five days, and must tell the auditee this up front.
• Vetted auditors. Organisations are guided to choose from CERT-In's list of empanelled auditing organisations and to verify the credentials of the people assigned to the audit.

Whether a CERT-In empanelled auditor is strictly mandatory for your organisation depends on your sector and regulator, so check that point specifically.

Technically, much of an audit comes down to security testing. A properly scoped vulnerability assessment and penetration test, plus configuration review and source code review where applicable, produces the evidence an audit needs. Our guide to what VAPT is and how it works explains each piece.

DPDP Rules 2025: How They Overlap

The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 and give practical effect to the DPDP Act, 2023. Obligations are being phased in over about 18 months: the Data Protection Board came first, consent manager registration follows from 14 November 2026, and the main duties on notice, consent, security, breach notification, and children's data apply from 14 May 2027.

The overlap with CERT-In matters in three ways:

• Reasonable security safeguards. Failing to maintain them, resulting in a breach, carries the highest penalty tier under the Act, up to ₹250 crore. Regular testing and audits are your best evidence that you took reasonable steps.
• Two reporting tracks. A personal data breach may need to be reported to CERT-In within 6 hours and also to the Data Protection Board and affected individuals, with a detailed report to the Board within 72 hours. Plan for both from one incident response process.
• Same evidence, different audience. Logs, test reports, and fix records serve CERT-In audits, DPDP defence, ISO 27001, and customer reviews alike.

CERT-In Compliance Checklist

1. Name a CERT-In point of contact with a backup, and write down their contact details in your incident plan.
2. Write an incident response runbook with a 6-hour reporting step, the CERT-In reporting address, and a template for what to include.
3. Enable logging on all ICT systems: servers, applications, firewalls, VPNs, databases, and cloud services.
4. Retain logs for 180 days within India, stored securely and protected from tampering.
5. Synchronise all system clocks to NIC or NPL time sources.
6. Maintain an asset inventory of applications, servers, APIs, and cloud accounts so audit scope is clear.
7. Schedule an annual comprehensive audit, and an extra one after major migrations or changes.
8. Run penetration testing and a vulnerability assessment on critical applications, with fixes retested.
9. Get management sign-off on the audit programme, scope, and remediation plan.
10. Test your incident process with a tabletop exercise at least once a year.
11. Align with DPDP: map personal data flows, set up breach notification steps, and review security safeguards before May 2027.
12. Keep evidence organised: logs, reports, retest results, and approvals in one place for auditors.

Choosing an Auditor

• Verify on the official list. Confirm any claim of CERT-In empanelment on CERT-In's website rather than relying on a logo.
• Check independence. The firm that builds or manages your systems should not be the one auditing them.
• Ask about methodology. Look for OWASP, PTES, NIST, and ISO 27001 alignment and genuine manual testing.
• Agree confidentiality and data handling in an NDA, and understand what the auditor must report to CERT-In.
• Make sure a retest is included, so fixes are verified before the audit closes. For pricing context, see the penetration testing cost guide for India.

Common Mistakes

• Waiting for a root cause before reporting. The 6-hour clock runs from awareness, not from conclusion.
• Short log retention or logs held abroad, for example default 30-day cloud log settings or overseas log storage.
• No named point of contact, or one who cannot be reached out of hours.
• Treating a scan as an audit. An automated scanner output with no manual validation will not satisfy a serious audit.
• Untested incident plans. A runbook nobody has rehearsed tends to fail on the day.
• Assuming small size means exempt. The 2022 directions are written to cover body corporates generally, so confirm your position with counsel rather than assuming.

Frequently Asked Questions About CERT-In Compliance

Need Help Preparing?

If you want help scoping an audit, running the penetration testing that supports it, or checking your logging and incident response against CERT-In's requirements, get in touch and I will walk through your environment and tell you where the gaps are.