# CERT-In Audit Explained: Requirements, 6-Hour Reporting & Empanelment

> Updated 2026-06-01 - 9 min read

CERT-In (the Indian Computer Emergency Response Team) sets security-audit and incident-reporting expectations that flow through many Indian regulations - RBI, SEBI, ministries and beyond. Whether you need a CERT-In-style security audit for a regulator, or must comply with CERT-In's 2022 directions, this guide explains what's required.

## What is a CERT-In audit?

A CERT-In audit is a security assessment - typically VAPT plus configuration and compliance review - performed and documented in the format CERT-In and downstream regulators expect. Many Indian mandates (RBI, SEBI, government tenders) require a CERT-In-style audit report as evidence of security posture.

CERT-In maintains a panel of empanelled auditors. Where a mandate specifically requires a CERT-In empanelled auditor, that credential matters; in other cases, a CERT-In-aligned methodology and report format is what's needed.

## The 6-hour incident-reporting rule

CERT-In's 2022 directions require specified entities to report listed cyber incidents within six hours of noticing or being informed of them. This is a demanding timeline - it means your detection, triage and escalation runbook must be built and rehearsed for six-hour reporting, not next-business-day.

## Log-retention and other obligations

- Retain specified logs within India for a rolling 180-day period
- Synchronize system clocks to NTP (NIC / NPL) for reliable forensics
- Maintain reachable points of contact for CERT-In coordination
- Report the listed categories of incidents within the 6-hour window

## How CERT-In connects to other regulators

CERT-In requirements are woven through RBI's cyber framework, SEBI's CSCRF, and government procurement. A single, well-run CERT-In-aligned audit and incident-response capability therefore supports compliance across several regulators at once - which is why it's a smart foundation to build first.

## FAQ

**Do I need a CERT-In empanelled auditor specifically?**
It depends on the mandate. Some regulators or tenders require a CERT-In empanelled auditor; others accept a CERT-In-aligned methodology and report format. We help you determine what your specific obligation requires.

**What incidents must be reported within 6 hours?**
CERT-In's directions list categories including targeted scanning/probing of critical systems, compromise of critical systems, unauthorized access, data breaches, and attacks on infrastructure, among others - reportable within six hours of detection.