CERT-In's 15 cyber defence controls for MSMEs, explained for owners

On 1 September 2025 CERT-In, India's national cyber incident response agency, published a guideline titled 15 Elemental Cyber Defense Controls for Micro, Small, and Medium Enterprises (reference CISG-2025-03). It sets out 15 controls and 45 recommendations that together form a baseline of cyber hygiene a small business can reach without a security team. The language throughout is “CERT-In recommends”. It is guidance, not a legal duty, and it adds that MSMEs “may conduct Baseline Audits” through CERT-In empanelled auditing organisations “at least once in a year”. Nothing in the guideline makes that audit a requirement.

That does not make it optional reading. The guideline is the clearest statement yet of what CERT-In expects a careful small business to have in place, it overlaps heavily with the reasonable security safeguards the DPDP Rules require from 13 May 2027. Below, each control in the order of the PDF: what it means in plain words, what CERT-In recommends, and what an auditor would ask to see.

1. Effective Asset Management (EAM)

You cannot protect what you have not listed. Write down every laptop, phone, server, software subscription and important data set the business uses, who holds it, and which items carry customer, staff or financial data. The first pass usually turns up devices nobody remembered. Every other control leans on this list: you cannot patch, back up or collect back what is not on it.

What CERT-In recommends

• EAM.1: One central, continuously updated inventory of all hardware, software and information assets, with sensitive assets identified, labelled and classified so they are handled and accessed appropriately.
• EAM.2: Tracking each asset from purchase through deployment, use and secure disposal, updating the record whenever its location, status or condition changes.

What an auditor would ask to see

• Asset inventory sheet or tool export listing hardware, software and data assets, with a 'last updated' date and a sensitivity/classification column
• Asset register with acquisition date, assigned user, location and disposal date columns

2. Network and Email Security (NES)

Close the doors into the office network and stop strangers from sending email in your name. For most small offices this comes down to router and Wi-Fi settings, a VPN for anyone working from home, and three DNS records for your email domain that your email provider can help you set.

What CERT-In recommends

• NES.1: A firewall where the business network meets the internet, plus the built-in firewall switched on on every computer, both properly configured.
• NES.2: Wi-Fi with WPA2 or WPA3 encryption, strong passwords and hidden network names, no factory-default router credentials, a separate guest network, and devices set not to auto-join open or public Wi-Fi.
• NES.3: Staff working remotely connect through an encrypted VPN that also asks for a second login factor (MFA).
• NES.4: Setting up SPF, DKIM and DMARC records for the business email domain so that others cannot easily send fake emails in its name.

What an auditor would ask to see

• Screenshot of router/firewall admin page
• Screenshot of Windows or macOS firewall status on a sample laptop
• Router Wi-Fi settings screenshot showing WPA2/WPA3 and a separate guest network
• VPN admin console screenshot showing MFA enforced
• DNS records screenshot or output from a free SPF/DKIM/DMARC checker for your domain

3. Endpoint & Mobile Security (EMS)

Every device used for work needs protection that is switched on and current, only licensed software, and a rule about USB drives. Pirated software and shared admin rights are the two most common ways malware lands on small-business machines.

What CERT-In recommends

• EMS.1: Licensed antivirus or endpoint protection on every device, kept updated, with built-in operating system protections such as Windows Defender and Windows Firewall left switched on.
• EMS.2: Using only licensed, authorised software and allowing only authorised people to install software on company devices.
• EMS.3: Registering with its Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) to receive alerts and advisories about malware and botnet infections.
• EMS.4: Restricting or controlling the use of USB drives and other removable media on company devices, and considering switching off autorun so malware cannot spread from them.

What an auditor would ask to see

• Device security policy, including lines on USB use and installation rights
• Endpoint protection dashboard screenshot showing all devices covered
• Antivirus licence invoice and software licence list
• CSK registration confirmation email or screenshot

4. Secure Configurations (SC)

Devices and software ship with settings chosen for convenience, not safety. Agree one written set of secure settings, switch off what you do not use, and change every default password before anything goes into use.

What CERT-In recommends

• SC.1: A written baseline of approved security settings for server and endpoint operating systems, network devices, browsers and off-the-shelf software, applied and maintained on every device.
• SC.2: Switching off features, ports, services, protocols and default applications that the business does not need, to reduce the ways an attacker can get in.
• SC.3: Removing unused software and system functions, and changing every default password and setting before a device or system goes into use.

What an auditor would ask to see

• Secure configuration checklist or hardening standard approved by the business
• Screenshot of disabled services/ports on a sample device or router
• Deployment checklist with 'default password changed' step signed off
• Change approval record

5. Patch Management (PM)

Most attacks on small businesses use weaknesses that already have a fix. Turn on automatic updates wherever you can, and make one person responsible for reading vendor and CERT-In advisories so nothing important slips past.

What CERT-In recommends

• PM.1: Regularly applying security patches and updates to operating systems, applications and device firmware.
• PM.2: Someone follows vendor notifications, CERT-In advisories and other relevant sources so the business knows about new patches and vulnerabilities that affect its systems.

What an auditor would ask to see

• Patch policy with timelines
• Screenshot showing automatic updates on, or update history from a sample device or router
• CERT-In advisory mailing list subscription confirmation
• Named person responsible for tracking advisories

6. Incident Management (IM)

Decide before an incident who does what, write it down, and practise it. This control also points to the binding six-hour CERT-In reporting duty, so the plan should name who reports and how.

What CERT-In recommends

• IM.1: A written Incident Response Plan that covers how incidents are reported, contained, investigated, recovered from and communicated.
• IM.2: Testing the Incident Response Plan regularly, for example with a practice drill, so it works when a real incident happens.
• IM.3: Following its Directions issued under section 70B(6) of the IT Act, 2000, including reporting cyber incidents to CERT-In within 6 hours of noticing or being told about them. The 6-hour reporting duty itself comes from the Directions, which are binding on MSMEs; this recommendation simply points back to it.

What an auditor would ask to see

• Incident Response Plan covering reporting, containment, investigation, recovery and communication
• Incident contact list with names and phone numbers
• Incident plan clause naming CERT-In reporting within 6 hours and the person who will do it
• Record of a tabletop exercise or drill with date, participants and lessons learned

7. Logging and Monitoring (LM)

Logs are the record of who did what on your systems. Without them you cannot work out what happened in an incident, and you cannot hand CERT-In what it asks for. Turn logging on, keep it long enough, and have someone or something watch it.

What CERT-In recommends

• LM.1: Turning on full logging on all key IT systems and keeping system and application logs securely for at least 180 days, stored within India.
• LM.2: Continuously watching network activity and the actions of admin or privileged users to spot suspicious behaviour and unauthorised access attempts.
• LM.3: Using monitoring security tools that analyse logs, detect threats and help respond to them.

What an auditor would ask to see

• Logging settings screenshot
• Log retention setting showing 180 days or more
• Hosting location of log storage (India)
• Monitoring dashboard or alert screenshot, and an admin activity review record

8. Awareness and Training (AT)

Most incidents start with a person clicking a link or reusing a password. Short, regular training for everyone, contractors included, is the cheapest control on the list.

What CERT-In recommends

• AT.1: Basic cybersecurity awareness training at least twice a year for every employee and contractor, covering phishing, password hygiene, social engineering, personal-device risks, safe internet use, acceptable use, handling sensitive information and responsible email use.
• AT.2: Taking part in its awareness workshops, capacity-building programmes and national cybersecurity exercises and drills to improve preparedness and response.

What an auditor would ask to see

• Training attendance log with dates, names and topics covered
• Training deck or module outline
• Certificate, invitation or attendance record for a CERT-In workshop, programme or exercise

9. Third Party Risk Management (TPRM)

Your IT support firm, cloud provider, payroll vendor and software suppliers can bring risk in with them. Check them in proportion to the harm they could cause and put security terms in the contract.

What CERT-In recommends

• TPRM.1: Checking each vendor or third party carefully, with more scrutiny for those whose failure or compromise would hurt the business most.
• TPRM.2: Holding every third-party provider to at least the same security standards the business applies to itself, at minimum this baseline, so the whole supply chain stays consistent.

What an auditor would ask to see

• Vendor list with risk rating
• Completed due-diligence checklist or questionnaire per vendor
• Vendor contract clause requiring security standards at least equal to this baseline

10. Data Protection, Backup and Recovery (DPBP)

Take regular encrypted backups, keep at least one copy away from the main network, and prove from time to time that you can actually restore. Wipe or destroy old drives and phones before they leave the building.

What CERT-In recommends

• DPBP.1: A fixed backup schedule (daily or weekly) with encrypted copies kept away from the main network, combining an offsite copy and an offline copy such as a USB drive or tape.
• DPBP.2: Periodically testing that data can actually be restored from backups, so the business knows recovery works.
• DPBP.3: A basic Business Continuity Plan for the applications the business cannot run without, so operations can be recovered in time.
• DPBP.4: Wiping or physically destroying old hard drives, USB sticks, phones and paper records before they are disposed of, so data cannot be recovered from them.

What an auditor would ask to see

• Backup schedule and a screenshot of backup job history
• Proof that one copy is offsite or offline and encrypted
• Backup restore test record with date, what was restored and the result
• Business Continuity Plan naming critical applications and recovery steps
• Media disposal policy and a disposal or destruction log

11. Governance and Compliance (GC)

Someone has to own security. Name a person, approve a short written policy sized to the business, review it when things change, and follow CERT-In's and your sector regulator's directions.

What CERT-In recommends

• GC.1: Naming one security in-charge who oversees all information security work and is the single contact for CERT-In and regulators.
• GC.2: A formally approved Information Security Policy sized to the business, covering data protection, access control, incident response, passwords, third-party management and audits.
• GC.3: Reviewing and updating security policies from time to time, and whenever the business, its technology or the rules change in a big way.
• GC.4: Following the guidelines and directions issued by CERT-In and by the business's own sector regulators.

What an auditor would ask to see

• Name and contact details of the security in-charge, recorded in the policy or org chart
• Signed or approved Information Security Policy covering the listed topics
• Policy version history showing review dates
• Policy clause committing to CERT-In directions and sector regulator rules, with a list of applicable regulators

12. Robust Password Policy (RPP)

Strong, unique passwords, a lockout after a few wrong attempts, and a second login step for email, admin accounts and remote access. If you build software that stores passwords, store them hashed, never as plain text.

What CERT-In recommends

• RPP.1: Strong, unique passwords on every system, at least 8 to 12 characters mixing upper and lower case letters, numbers and symbols, with expiry intervals, no reuse and staff told never to share logins.
• RPP.2: Locking an account for a while after 3 to 5 wrong password attempts, to stop attackers guessing passwords.
• RPP.3: A second login step (MFA, such as an OTP or authenticator app) for all critical systems, every admin account and every remote-access tool.
• RPP.4: Any system the business runs which stores passwords keeps them using secure encryption and hashing, never in plain text.

What an auditor would ask to see

• Password policy text
• Screenshot of password and lockout rules enforced in email, Windows or Google Workspace admin
• MFA enforcement screenshot from your email or cloud admin console
• Developer or vendor confirmation of the hashing method used for stored passwords

13. Access Control and Identity Management (ACIM)

One login per person, access by job role and no more, a review every quarter, and accounts closed the day someone leaves. Keep admin rights rare and split admin, finance and data duties between different people.

What CERT-In recommends

• ACIM.1: A separate user ID for every person, with no shared accounts, so every action on a system can be traced to one individual.
• ACIM.2: Giving each person access according to their job role, and no more than the minimum they need.
• ACIM.3: Reviewing who has access to what at least every three months, and immediately when someone changes role, transfers or leaves, using a formal offboarding checklist.
• ACIM.4: Giving admin rights only when truly needed, and keeping admin, finance and data duties with different people.

What an auditor would ask to see

• User list from email or cloud admin console showing one account per person
• Access matrix showing who can access what, by role
• Quarterly access review record
• Offboarding checklist with sign-off for recent exits
• List of admin accounts and why each needs admin

14. Physical Security (PS)

Lock the server cupboard or network rack, watch who goes in, and get every laptop, ID card and USB drive back when someone leaves.

What CERT-In recommends

• PS.1: Strong physical controls, such as guards, electronic badges and biometric locks, for server rooms, network equipment and other sensitive areas, with CCTV watching entry and exit.
• PS.2: A full asset-return checklist (ID cards, laptops, USB drives and other equipment) completed for every employee who leaves, so data and devices do not walk out.

What an auditor would ask to see

• Photo of locked server room or badge/biometric access
• CCTV coverage of the entry, and an entry log
• Completed asset-return checklists for recent exits

15. Vulnerability Audits and Assessments (VAA)

Have someone independent test your important systems at least once a year, fix what they find, and look at your own risks from time to time. This is the control that the optional baseline audit checks for.

What CERT-In recommends

• VAA.1: An independent third-party vulnerability assessment of business-critical systems and applications at least once a year, with a plan to fix what is found in good time.
• VAA.2: Periodic risk assessments to identify the threats specific to the business and decide how to reduce them.

What an auditor would ask to see

• VAPT report from an independent firm, dated within the last 12 months
• Remediation tracker showing findings closed
• Risk assessment document or register with date, identified threats and planned mitigations

How the controls relate to the binding CERT-In Directions

The 15 controls sit on top of a smaller set of duties that are binding law. CERT-In's Directions of 28 April 2022, issued under section 70B(6) of the IT Act, apply to every body corporate, including firms and sole proprietorships, and have applied to MSMEs since 25 September 2022. Four of them matter to every small business:

• Report within 6 hours. Cyber incidents of the types listed in Annexure I of the Directions (ransomware, unauthorised access, data breach, phishing, compromised social media accounts and more) must be reported to CERT-In within 6 hours of noticing them or being told about them, at incident@cert-in.org.in or 1800-11-4949. Recommendation IM.3 repeats this duty; the duty itself does not depend on the guideline.
• Keep 180 days of logs. Logs of all ICT systems must be enabled and kept securely for a rolling 180 days within Indian jurisdiction, and handed to CERT-In with an incident report or on request. Recommendation LM.1 repeats it. CERT-In's FAQ says logs may also be kept outside India if they can be produced in reasonable time; keeping a copy in India is the safer reading.
• Name a point of contact. Every entity must designate a point of contact for CERT-In and send the details in the Annexure II format to info@cert-in.org.in. Recommendation GC.1, the security in-charge, is the natural person for this role.
• Synchronise clocks. All ICT system clocks must be synchronised with the NTP servers of NIC or NPL, or servers traceable to them. This one is not among the 15 controls, but it is binding all the same.

Failing to follow the Directions may attract section 70B(7) of the IT Act: imprisonment of up to one year, a fine of up to ₹1 lakh, or both. CERT-In's FAQ says the power will be used reasonably and where the failure is deliberate.

Where the controls meet the DPDP Rules

From 13 May 2027, Rule 6 of the DPDP Rules requires every business that handles personal data to take reasonable security safeguards, at minimum encryption or masking, access control, access logs with monitoring and review, backups for continued processing, and security terms in contracts with data processors. Controls 13 (access), 7 (logging), 10 (backups) and 9 (vendors) map almost line for line onto that list, and control 1 (asset inventory) is where a DPDP data inventory starts. Work done on the CERT-In baseline now counts towards DPDP readiness later. Our page on DPDP and CERT-In dates lists what applies when. For the DPDP side of the same work, see our DPDP compliance checklist for Indian small businesses.

Frequently asked questions

Do I have to follow CERT-In's 15 controls for MSMEs?

No. The 15 controls published on 1 September 2025 are advisory: CERT-In recommends them. What you do have to follow are the CERT-In Directions of April 2022, which have applied to MSMEs since 25 September 2022: 6-hour incident reporting, 180 days of logs, clock synchronisation and a named point of contact.

Do I need a CERT-In empanelled auditor every year?

Not as a legal requirement. The guideline says MSMEs may conduct baseline audits through CERT-In empanelled auditing organisations at least once a year. An audit is useful evidence for customers and insurers, but the guideline does not require it.

Where should a 10-person business start?

Start with the asset list (control 1), MFA and unique logins on email and admin accounts (controls 12 and 13), automatic updates (control 5), backups with one offline copy (control 10), and a one-page incident plan that names who reports to CERT-In within 6 hours (control 6).

Do the controls help with DPDP readiness?

Yes. Rule 6 of the DPDP Rules, in force from 13 May 2027, requires encryption or masking, access control, logs and monitoring, backups and security terms in processor contracts. Controls 1, 7, 9, 10 and 13 cover much of that ground.

General information, not legal advice. Last reviewed 14 October 2026 against the official texts linked on this page. Readiness information only; for a formal audit speak to a CERT-In empanelled auditing organisation, and for legal advice speak to an advocate.