We Helped Build India’s CERT-In Compliance Framework for MSMEs. 

Here’s What Your Business Actually Needs to Do. 

Most cybersecurity blogs about CERT-In compliance are written by people who read the framework. 

This one is written by a team that helped shape it. 

CERT-In compliance is now a legal requirement for every MSME in India — not a best practice, not a recommendation.  

xIoTz contributed directly to developing India’s CERT-In MSME Cybersecurity Framework — the 15 Elemental Cyber Defense Controls that every Micro, Small, and Medium Enterprise in India is now required to implement.

We didn’t read about the incidents that informed each control.

We responded to them.

We know where businesses fail audits — because we’ve watched it happen, and we’ve helped them recover. 

This is not a summary of a official PDF. This is the practitioner’s guide. 

“Small businesses aren’t ignored by attackers. They’re preferred. They’re easier. They’re faster. And they almost never survive.” 

Over 40% of all cyber incidents hit small and medium businesses — not because attackers got lucky, but because basic protections were never in place.

India’s MSMEs are the backbone of the economy. 

They’re also the most under protected segment in it. 

One breach.

That’s all it takes.

Operational shutdown. Financial damage. Customer trust gone overnight.

For most MSMEs, there is no recovery plan. There’s just the aftermath. 

What CERT-In Actually Requires of Your Business 

Before the controls — here’s what compliance means in practice. These are not optional guidelines. They are legal requirements under India’s IT Act and CERT-In directives, enforceable against your business today. 

• Implement all 15 Elemental Cyber Defense Controls in full 

• Retain system logs for at least 180 days, stored within India 

• Report major cyber incidents to CERT-In within 6 hours of detection 

• Conduct cybersecurity awareness training at least twice a year 

• Complete an independent vulnerability assessment annually 

• Undergo audits by CERT-In empaneled auditors only 

Most businesses fail audits not because of a sophisticated breach. They fail because nobody implemented the basics consistently — strong passwords, access controls, system monitoring, configuration standards. Things that should have been standard practice and weren’t. 

The Penalties 

Non-compliance is not just an audit failure. Under India’s IT Act and CERT-In directives, the consequences are direct and severe.

Responsible officers — including directors and CEOs — can face personal imprisonment for failure to report incidents or maintain required logs. 

For an MSME, a ₹1 crore penalty isn’t a setback. It’s a shutdown. 

CERT-In MSME Compliance Checklist: The 15 Controls for MSMEs 

At their core, the 15 controls focus on four things: knowing what systems your business runs on, controlling who can access them, watching for anything unusual, and being ready to respond when something goes wrong. Everything else is detail. 

xIoTz was in the room when these controls were being defined. We brought incident data from real MSME breaches — the patterns we kept seeing across sectors, the gaps that kept getting exploited, the controls that kept being skipped. The framework reflects that input. Which is also why we know exactly how auditors interpret each one.