CERT-In: Definition, Role, and Why It Matters
CERT-In (Indian Computer Emergency Response Team) is India's national nodal agency for responding to cyber security incidents. It was established under section 70B of the Information Technology Act, 2000 and operates under the Ministry of Electronics and Information Technology (MeitY). CERT-In's remit covers incident response, vulnerability coordination, early warnings, and the empanelment of information security auditing organisations.
What CERT-In Does
- Incident response: Coordinates response to cyber security incidents reported by government bodies and the private sector. Issues advisories and alerts.
- Empanelment: Maintains the official list of information security auditing organisations authorised to perform audits for government and regulated entities. See CERT-In empanelled auditor directory for the current list.
- Directives: Issues binding directions under section 70B(6) of the IT Act. The best-known is the CERT-In Directions, April 2022 on cyber security incident reporting.
- Advisories and bulletins: Publishes vulnerability notes, security advisories, and threat intelligence.
Why Indian Organisations Deal With CERT-In
Several regulators require that security audits be performed by a CERT-In empanelled auditor, including the RBI (for banks and payment system operators), SEBI (for market intermediaries), IRDAI (for insurers), and UIDAI (for AUA/KUA entities working with Aadhaar). The empanelled auditor's report is the acceptable form of attestation for these audits.
Separately, the CERT-In 2022 Directions require all service providers, intermediaries, data centres, body corporate, and government organisations to report specified cyber security incidents to CERT-In within 6 hours of noticing or being brought to notice about them.
How CERT-In Relates to Other Frameworks
- RBI Cyber Security Framework: Banks must report CERT-In-notifiable incidents within 6 hours and may be required to engage a CERT-In empanelled auditor for VAPT and compliance audits.
- DPDPA 2023: While CERT-In is distinct from the Data Protection Board, a personal data breach typically also triggers CERT-In reporting under the 2022 directions.
- SEBI CSCRF: Market intermediaries must engage CERT-In empanelled auditors for the mandated vulnerability assessment and penetration testing.
Related
- VAPT — the audit activity most commonly procured from a CERT-In empanelled firm.
- CERT-In Empanelment — the authorisation that lets a firm perform CERT-In-approved audits.
- Browse CERT-In empanelled auditors →