India CERT-In

Software inventory, patch management, and supply chain security requirements.


Short name	CERT-In
Region	Asia-Pacific
Country or scope	India
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CERT-In

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for CERT-In.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for CERT-In and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`IN-CERT-INV` Software Component Inventory	Entities must maintain an inventory of the software components comprising their systems as the basis for incident response and SBOM production (CERT-In SBOM Technical Guidelines, minimum elements; CERT-In Directions 2022)	Scan
`IN-CERT-VER` Component Version Element	Each SBOM component entry must include the component's version string (CERT-In SBOM Technical Guidelines, minimum data fields)	Scan
`IN-CERT-SUP` Supplier Name Element	Each SBOM component entry must name the supplier or originator of the component (CERT-In SBOM Technical Guidelines, minimum data fields)	Scan
`IN-CERT-UID` Unique Component Identifiers	Components should carry unique identifiers such as package URLs to enable correlation with vulnerability advisories (CERT-In SBOM Technical Guidelines, unique identifier field)	Scan
`IN-CERT-HASH` Component Checksums	Cryptographic hashes of components should be included to support integrity verification of delivered software (CERT-In SBOM Technical Guidelines, checksum/hash field)	Scan
`IN-CERT-DEP` Dependency Relationships	The SBOM must document the dependency relationships between components (CERT-In SBOM Technical Guidelines, dependency relationship field)	Scan
`IN-CERT-META` SBOM Author and Timestamp	The SBOM must record who authored it and when it was created (CERT-In SBOM Technical Guidelines, author and timestamp fields)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CERTIN-LOG-1`	Retain ICT System Logs for Six Months
`CERTIN-LOG-2`	Synchronise ICT Clocks to NTP
`CERTIN-IR-1`	Report Cyber Incidents to CERT-In Within Six Hours
`CERTIN-IR-2`	Maintain a Documented Incident Response Plan
`CERTIN-KYC-VPN`	Maintain KYC Records for VPN Users
`CERTIN-KYC-CRYPTO`	Maintain KYC Records for Virtual Asset Transactions
`CERTIN-VULN-1`	Conduct Regular Vulnerability Assessments
`CERTIN-ACCESS-1`	Enforce Multi-Factor Authentication for Critical Systems
`CERTIN-PATCH-1`	Patch Critical Vulnerabilities Promptly
`CERTIN-DRP-1`	Maintain and Test Disaster Recovery Capability
`CERTIN-AUDIT-1`	Conduct Annual Information Security Audits

Policy templates

Written for CERT-In:

Cyber Incident Reporting to CERT-In Policy
Vulnerability Management and Security Audit Policy (CERT-In)

And 22 from the standard set, adapted to CERT-In.