Directions gap review
Your incident reporting, logging, time sync and record-keeping compared with each clause of the Directions that applies to you.
// CERT-IN DIRECTIONS · AUDIT READINESSMeet the CERT-In Directions
Meet the CERT-In Directions
and pass the empanelled audit.
Two things Indian organisations get asked for: compliance with CERT-In's Directions of 28 April 2022, and a clean security audit by a CERT-In empanelled organisation for a regulator, a government client or a tender. We get you ready for both.
CERT-In Directions 20226-hour incident reporting180-day log retentionEmpanelled-audit readiness
6 hrsTo report a listed cyber incident to CERT-In
180 daysICT system logs kept, within India
Jul 2025CERT-In audit policy guidelines issued
// TWO DIFFERENT REQUIREMENTS
The Directions apply to you. The audit is asked of you.
CERT-In's Directions, issued under section 70B(6) of the IT Act and in force since June 2022, apply to service providers, intermediaries, data centres, body corporates and government organisations: report listed cyber incidents within 6 hours, keep ICT system logs for 180 days in India, synchronise clocks to Indian time sources and name a point of contact. Separately, regulators, government departments and tenders often require a security audit by a CERT-In empanelled organisation, now governed by CERT-In's July 2025 audit policy guidelines. We prepare you so that audit finds as little as possible.
// DELIVERY STANDARD
Built for decisions, evidence and accountable execution.
Whether this is a commercial engagement or a government program, the work is structured so technical teams can act and leadership can verify progress.
Close the gaps
Logging, retention, NTP and the incident runbook set up in your environment, with evidence that each one works.
Find issues first
Internal assessment and VAPT of the audit scope, with remediation and retesting before the official audit.
Work with your auditor
Scope and evidence prepared for the CERT-In empanelled organisation you appoint, and help closing anything they report.
// PROJECT OUTPUTS
What your team can take into the next review.
- CERT-In Directions gap report
- Cyber incident reporting runbook and contact sheet
- Log retention and clock synchronisation configuration, with evidence
- Pre-audit vulnerability and VAPT report with retest results
- Audit scope document and evidence pack for the empanelled auditor
// BUILT FOR
Designed around the people who own the outcome.
- IT heads of companies covered by the Directions
- Cloud, hosting, VPN and data-centre providers
- Banks, NBFCs, insurers and market intermediaries facing regulator-mandated audits
- Vendors to government departments and PSUs
6-hour incident reporting
A runbook that decides quickly whether an event is a reportable incident, who reports it to CERT-In, and what the report contains, rehearsed with your team so six hours is achievable.
180-day log retention in India
Which ICT systems must log, what to keep, where it is stored and for how long, set up on your servers or cloud accounts and checked, not just written into a policy.
Clock synchronisation
Servers, network devices and cloud services synchronised to the Indian time sources the Directions name, so log timestamps hold up during an investigation.
Point of contact and records
A designated point of contact registered with CERT-In, and, for VPN, cloud, VPS and data-centre providers, the subscriber records the Directions require you to keep.
Pre-audit assessment
An internal assessment before the empanelled auditor arrives: vulnerability scanning, configuration review and a VAPT of the systems in scope, using the methods empanelled auditors follow.
Remediation and retest
Findings fixed with your team and retested, so the official audit report shows a closed position rather than a list of open vulnerabilities.
// PRICING
Scoped to you, priced in writing.
Every engagement is scoped to your frameworks, your team and how much help you want — you get a written proposal before anything starts.
Directions gap review
Talk to us
A clause-by-clause review with a written remediation plan.
Audit readiness programme
Talk to us
Gap review, remediation and pre-audit VAPT. The official audit is performed and billed separately by the CERT-In empanelled organisation you appoint.
Scope depends on how many systems, sites and cloud accounts are covered and whether you also need a pre-audit VAPT. Talk to us and we'll send a written proposal.
Frequently Asked Questions
Is Bitkosh a CERT-In empanelled auditor?
No. We are not on CERT-In’s list of empanelled auditing organisations, so we cannot issue a CERT-In empanelled audit report. We prepare you for that audit, run an internal pre-audit and fix the findings, and you appoint an empanelled organisation for the official audit.
Who do the CERT-In Directions apply to?
The Directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporates and government organisations. Some clauses, such as keeping subscriber records, apply only to VPN, cloud, VPS and data-centre providers. If you run IT systems in India for a business, assume they apply and check the detail with us.
What counts as a reportable incident?
The Directions list the types of cyber incident that must be reported within 6 hours of noticing them, including targeted scanning, compromise of critical systems, unauthorised access, website defacement, malware and ransomware attacks, data breaches and data leaks. The list is broad, which is why a quick decision process matters.
When is a CERT-In empanelled audit required?
It is usually required by someone else: a sector regulator, a government department you supply, or a tender. Their rules decide the scope and how often it happens, so we start from their written requirement rather than a generic checklist.
Can this work count towards ISO 27001 or the DPDP Act?
Yes. Logging, incident response and vulnerability management are also ISO 27001 controls and part of the DPDP Act’s security safeguards. The Bitkosh Readiness Platform maps the same evidence across all three.
Let's build together
Six hours goes quickly. Be ready before the first incident.
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.