CERT-In Aligned VAPT for Indian Organisations — Methodology + Incident Reporting Support

What 'CERT-In aligned' means at Bachao.AI

We use the CERT-In Vulnerability Reporting and Responsible Disclosure framework as the spine of our methodology — severity bands, report taxonomy, evidence requirements, and remediation language all mirror CERT-In conventions. Our incident response service provides the Form C narrative template, the 22-category incident taxonomy reference, and the 6-hour response runbook so that when a finding becomes an actual incident, your team is not drafting from scratch under deadline pressure. We are intentionally up-front: 'CERT-In aligned' is a methodology claim, not an empanellment claim. If your procurement explicitly requires an empanelled firm, engage one — and use us in parallel for continuous interim coverage between their engagements.

The 6-hour incident reporting obligation — who it applies to

CERT-In's April 2022 Direction mandates incident reporting within 6 hours of awareness for any reportable cyber incident impacting Indian users or infrastructure. Scope is broad:

• Service providers — anyone offering ICT services in India, including foreign SaaS with Indian users
• Intermediaries — social platforms, marketplaces, payment gateways, messaging services
• Data centres + cloud service providers + content delivery networks operating in India
• Body corporates — every company registered in India regardless of size or sector
• Government organisations — central, state, PSUs, autonomous bodies
• Virtual asset service providers — exchanges, custodians, brokers
• Sectoral overlay — banks (RBI), capital market entities (SEBI), insurers (IRDAI) have additional reporting obligations on top of CERT-In

The 22 reportable incident categories

CERT-In's Direction lists 22 incident categories that trigger the 6-hour reporting obligation. Highlights:

• Unauthorised access to ICT systems / data — the broadest catch-all category
• Data breach / data leak — including accidental exposure (e.g. misconfigured S3 bucket)
• Ransomware / cryptojacking — both encryption-for-ransom and stealth crypto-mining
• Identity theft, spoofing, phishing — including business email compromise affecting Indian users
• DDoS attacks — even attempted ones meeting the threshold
• Attacks on critical information infrastructure as notified
• Fake mobile apps impersonating Indian organisations or services
• Attacks on IoT devices and associated networks
• Attacks on systems related to e-Governance, e-Commerce or digital payments
• Supply chain attacks via third-party software / hardware components
• Attacks on or attempts to compromise AI / ML systems

India-located scanning + logging infrastructure

Per the April 2022 Direction's logging clause: ICT system logs must be retained for 180 rolling days within Indian jurisdiction. Our scanning infrastructure runs on AWS Mumbai (ap-south-1), our scan logs are India-resident, and our report storage uses the bachao-reports S3 bucket in Mumbai. For organisations that need to attest in-jurisdiction logging in their CERT-In disclosures, our scan evidence + log retention satisfies that data-residency requirement without additional vendor controls.

Pre-built CERT-In Form C narrative template

Form C is the standard CERT-In incident reporting form. The 6-hour clock means the form gets filed before the forensic scope is fully resolved — most teams either underreport (treated as concealment) or overreport (creates regulator follow-up overhead). Our pre-built template covers the seven Form C fields with placeholders aligned to common incident categories. Where a Bachao.AI VAPT finding becomes an active incident, the report sections (CVSS, CWE, evidence, business impact, remediation status) lift directly into the Form C narrative. Read our incident response service description at /incident-response.

How CERT-In alignment compares with international frameworks

If you're selling to US/EU enterprise, your buyer asks about SOC 2 and ISO 27001 — not CERT-In. If you're selling to Indian enterprise, PSUs, regulated entities, or Govt, CERT-In language appears in every vendor security questionnaire. The two are not in conflict. A single VAPT engagement can produce evidence aligned to SOC 2 CC7.1 (see /vapt-for-soc2-compliance), ISO 27001 A.8.8 (see /vapt-for-iso27001-compliance), and CERT-In severity bands — three documentation tracks from one assessment. DPDP Act 2023 requires the same incident response posture (72-hour Board notification on top of the 6-hour CERT-In clock — see /dpdp-breach-notification-checklist).