CERT-In VAPT Requirements
CERT-In VAPT Requirements
CERT-In is India's national computer emergency response team, operating under the Ministry of Electronics and Information Technology. Its directions require covered entities to report specified cyber incidents within six hours, retain logs for 180 days within India, synchronise clocks to NTP, and undergo periodic security auditing. Audits for regulatory purposes are performed by CERT-In empanelled auditors.
This is the single biggest structural driver of VAPT demand in India, and it is why security hiring here has held up better than most engineering roles. If you are new to the underlying testing itself, start with what is VAPT.
Who the directions apply to
The scope is deliberately broad. It covers service providers, intermediaries, data centres, corporate bodies and government organisations operating in India. In practice this pulls in a very wide set of companies, including many that do not think of themselves as regulated.
Certain categories carry additional obligations, notably virtual asset and exchange providers, and entities providing cloud, VPN and data centre services.
Sector regulators layer their own requirements on top. RBI frameworks apply to banks, NBFCs and payment operators. SEBI CSCRF applies to market intermediaries. IRDAI has its own guidelines for insurers. An entity can easily sit under two or three regimes at once, which is why compliance-driven testing volume in India is as high as it is.
The core obligations
| Obligation | Requirement |
|---|---|
| Incident reporting | Specified incidents reported to CERT-In within 6 hours of noticing |
| Log retention | ICT system logs retained for 180 days, within Indian jurisdiction |
| Clock synchronisation | Systems synced to NIC or NPL NTP servers |
| Point of contact | A designated PoC registered with CERT-In |
| Security auditing | Periodic audit, typically annual, plus after major change |
The six hour reporting window is the one most organisations underestimate. It is not six hours from confirmation. It is six hours from noticing. That is an incident response problem before it is a compliance problem, and most teams discover their process cannot meet it only during an actual incident.
What counts as a reportable incident
The reportable categories are wide and include targeted scanning of critical systems, compromise of critical systems, unauthorised access to data, website defacement, malicious code and ransomware, identity theft and phishing, denial of service, and attacks on infrastructure such as servers, routers and IoT devices.
The practical consequence is that many things a security team would previously have handled internally now carry a reporting obligation. Always verify current categories against the official CERT-In text rather than a summary, including this one, because directions are amended.
Empanelled auditors and why it matters
CERT-In maintains a list of empanelled information security auditing organisations. For audits performed to satisfy a regulatory requirement, the auditor generally needs to be on that list.
This is worth understanding clearly if you are buying. A technically excellent penetration test from a non-empanelled firm may be a better security outcome and still not satisfy your regulator. Conversely, an empanelment badge is not a quality guarantee. The list confirms process credentials, not the depth of any individual engagement.
So there are two different questions, and organisations conflate them constantly:
- Will this satisfy my regulator? Check empanelment.
- Will this actually find our problems? Check the methodology, the person-days of manual testing, and whether the report proves exploitation. Questions to ask a vendor are in VAPT vs penetration testing.
What a compliance-grade VAPT report must contain
Auditors and regulators look for specific things, and reports get rejected for missing them:
- Explicit scope statement listing assets tested and assets excluded, with reasons for exclusions
- Named methodology, such as OWASP WSTG, PTES or NIST SP 800-115. "Industry standard approach" is not acceptable.
- Testing window dates and the perspective used, black box, grey box or white box
- Evidence of manual testing, not scanner output alone. This is a common rejection reason.
- Severity ratings with rationale, not pasted CVSS scores
- Remediation guidance specific enough to act on
- Retest evidence confirming which findings were verified as fixed
- Auditor identification and empanelment reference where required
Full structure with a copyable template is in how to write a VAPT report.
How often
Annual is the common baseline for regulatory audit. That is a floor, not a security posture. Anything that ships code frequently is materially different eleven months after its last test.
A defensible cadence for most organisations:
| Activity | Frequency |
|---|---|
| Automated vulnerability scanning | Weekly or continuous |
| Manual penetration test | Annually, minimum |
| Test after major change | Every significant release or architecture change |
| Retest after remediation | Within 30 to 90 days of the fix |
What this means if you are building a career
Compliance-driven demand is why VAPT hiring in India is steadier than most technology roles. It does not disappear in a downturn because it is a legal requirement rather than a discretionary spend. Salary context is in VAPT engineer salary in India.
The honest trade-off: a meaningful share of this work is repetitive testing against the same checklist for compliance sign-off rather than interesting research. Testers who can also write clearly and speak to auditors move up faster than testers who only exploit, because in this market the report is what the client is actually buying.
Practise this
Take any lab machine, compromise it, then write the finding up in compliance report format with scope, named methodology, severity rationale and remediation. Hacklido is free and every challenge is reportable practice.
The TCVE VAPT program covers the testing and the reporting, including the compliance framing that Indian engagements actually require.
Note: CERT-In directions are amended periodically. Verify current requirements against the official CERT-In publication before making compliance decisions. This article is an explainer, not legal advice.
Frequently asked questions
What is CERT-In?
India's national computer emergency response team, operating under the Ministry of Electronics and Information Technology. It issues binding directions on cyber incident reporting, log retention and security auditing.
What is the CERT-In incident reporting timeline?
Specified incidents must be reported within six hours of noticing them. That clock starts at detection, not at confirmation, which is what most organisations underestimate.
Do I need a CERT-In empanelled auditor?
For audits performed to satisfy a regulatory requirement, generally yes. Empanelment confirms process credentials, not the technical depth of any individual engagement.
How long must logs be retained under CERT-In directions?
180 days, maintained within Indian jurisdiction.
How often is VAPT required for compliance?
Annually is the common baseline, plus testing after major architecture or application changes. Continuous scanning between annual tests is expected practice.