MSMEs Face Mandatory Annual Cyber Audits: CERT-In's Bold Move

In a significant move to bolster India's digital security, the Indian Computer Emergency Response Team (CERT-In) has announced a new mandate making annual cybersecurity audits compulsory for Micro, Small, and Medium Enterprises (MSMEs). This regulation, which came into effect recently, marks a pivotal shift from a voluntary to a mandatory compliance framework, underscoring the government's commitment to safeguarding this critical sector of the economy.

Need and Importance

MSMEs, often operating with limited resources and less sophisticated IT infrastructure, have become increasingly attractive targets for cybercriminals. Their vulnerabilities are exploited for various malicious activities, including data theft, financial fraud, and as entry points to larger supply chains.

The repercussions of a cyberattack on an MSME can be devastating, leading to significant financial losses, reputational damage, and operational disruption. CERT-In's new directive aims to proactively address these risks by ensuring that MSMEs regularly assess their cyber resilience and rectify any weaknesses.

What Does the Mandate Entail?

Under the new regulations, all MSMEs are required to conduct a comprehensive cybersecurity audit at least once a year. This audit must be carried out by CERT-In empaneled auditors who will evaluate the organization's security posture against a predefined set of guidelines. The audit scope includes:

• Network Security: Assessing firewalls, intrusion detection systems, and network access controls.
• Application Security: Reviewing web and mobile applications for vulnerabilities.
• Data Security: Checking data encryption, access permissions, and data backup procedures.
• Incident Response Plan: Evaluating the readiness of the organization to handle a cyber incident.

Following the audit, the MSME must submit a report to CERT-In, detailing the findings and the measures taken to address any identified vulnerabilities.

Framework

Instead of hitting small businesses with a complex, overwhelming list of rules, CERT-In's September 1 guidelines are more of a guided tour into the world of cybersecurity. They've crafted a blueprint built on 15 fundamental defense principles, each with a few simple, actionable steps, adding up to a total of 45 clear recommendations.

Conclusion

India's cybersecurity landscape is undergoing a significant transformation, with the Indian Computer Emergency Response Team (CERT-In) now making annual cybersecurity audits mandatory for all Micro, Small, and Medium Enterprises (MSMEs). This landmark directive, which became effective on September 1, 2025, extends a broader framework introduced in July 2025 that initially applied to large public and private organizations. The goal is to establish a cybersecurity baseline for MSMEs, which have become prime targets for cyberattacks due to their often limited resources and less mature IT security practices.

Disclaimer: Every effort has been made to avoid errors or omissions in this material. In spite of this, errors may creep in. Any mistake, error or discrepancy noted may be brought to our notice which shall be taken care of in the next edition. In no event the author shall be liable for any direct, indirect, special or incidental damage resulting from or arising out of or in connection with the use of this information.