Micro, Small and Medium Enterprises (MSMEs) form the backbone of India’s economy — but they’re also becoming prime targets for cyberattacks. Recognising this vulnerability, the Indian Computer Emergency Response Team (CERT-In) has issued a crucial directive: from September 1, 2025, all MSMEs must undergo an annual cybersecurity audit conducted by empanelled auditors.

This regulation ensures that even the smallest organisations are aligned with national cybersecurity standards — transforming digital security from a choice to a necessity.

Why This Audit Mandate Matters

According to CERT-In, India saw a 30% year-on-year increase in cyber incidents involving small and medium businesses. Attackers often exploit weaker defences in smaller firms to breach larger partners through the supply chain. The annual audit aims to strengthen every link making India’s entire digital economy more secure.

Key Requirements for MSMEs

Requirement	What It Means for You
Annual audit by CERT-In empanelled auditor	Each MSME must hire an authorised auditor to assess its security posture every year.
Cyber Defence Framework compliance	Audits will be based on 15 cyber control elements covering IT assets, patching, network security, and data protection.
6-hour incident reporting window	Cyber incidents must be reported to CERT-In within six hours of detection.
Log retention requirement	Maintain system logs for a minimum of 180 days for regulatory and investigative purposes.

How MSMEs Can Prepare for the Audit

• Perform a gap assessment — Identify areas that fall short of baseline controls.
• Implement basic defences — Use firewalls, endpoint protection, and encrypted backups.
• Train your employees — Human error remains the top cause of breaches.
• Retain security documentation — Maintain policies, logs, and access control records.
• Engage certified auditors early — Early consultation helps streamline readiness and save costs.

Not Just Compliance — A Competitive Advantage

While many MSMEs view audits as an obligation, forward-looking organisations see them as an opportunity. Being CERT-In compliant builds trust with customers, investors, and partners opening new doors to enterprise collaborations and government projects.

By investing in compliance now, you’re not only reducing risk but also future-proofing your digital credibility.

Impact at a Glance

Business Area	Benefit of Compliance
Client Trust	Enhances reputation and data-handling confidence
Legal Protection	Reduces penalties and legal risks under IT Act Section 70B
Supply Chain	Meets partner and vendor cybersecurity requirements
Operational Stability	Minimises downtime from malware or ransomware incidents