How do Indian startups prepare for a security audit in India?
Key takeaways
- Providing named test accounts and a staging environment removes the most common cause of audit delay, which is waiting on access.
- Evidence packs typically take 3 to 5 days to assemble: architecture diagram, asset inventory, prior test reports, MFA and access-review records.
- CERT-In's 6-hour incident reporting requirement is checked by asking who is accountable, so a named escalation list matters more than a policy document.
- A CERT-In empanelled auditor's report is accepted for many compliance purposes and is the standard choice for Indian formal assessments.
- Budget 2 to 4 weeks of engineering time for remediation before the audit window, because fixes cannot be applied during the assessment itself.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What evidence should I assemble before the audit starts?
Nine items, most of which already exist somewhere. The architecture diagram, with data flow showing where personal data travels. The asset inventory, listing every host, container, cloud resource, SaaS tool and third-party integration. The data inventory, naming what personal data you hold and where. Access review records showing when permissions were last reviewed. MFA enforcement evidence for code, cloud and admin consoles. Log retention configuration proving 180 days. The previous test report with remediation status. The incident-response plan with named owners. And the third-party vendor register. Assemble them into one folder with a table of contents and a date on each artefact, because a missing document during the audit window costs more than a weak document prepared in advance.
How do I give auditors access without giving away the keys?
Give time-boxed, scoped access, and never give a shared administrator account. Provide individual named accounts with the minimum role needed for the test window, a staging URL and API collection rather than production data where possible, and a VPN or bastion for infrastructure testing. State the window in writing with start and end times, and make sure logs capture the auditors' activity so there is no ambiguity later. Put a named engineer on call during the first two days, because the questions that stall an audit are usually small: which environment is this, which role performs this action, is this field in scope. Someone who can answer in two minutes saves a day of waiting.
What should I fix before the auditor arrives?
Fix what an auditor will find in the first hour. Default and shared credentials on any system. Cloud IAM policies with wildcard actions or wildcard resources. Secrets, API keys or database passwords committed to a repository. Databases or admin panels exposed to the public internet. Endpoints without authentication. Logging disabled on critical paths. Long-lived access keys that should be short-lived. Test accounts left active after a previous engagement. Each of these is found quickly and each creates a finding that damages the credibility of everything else in the report. Aim to have a clean, repeatable build pipeline, an enforced secrets manager and a documented deprovisioning process before the audit, rather than patching symptoms the week before.
How do I rehearse the 6-hour incident reporting path?
Run it as a tabletop, once, before the audit. Pick a realistic scenario: a laptop with customer data stolen, a bucket exposed publicly, or an executive impersonation fraud. Then ask the questions the auditor will ask. Who is the incident owner at 2 a.m. on a Sunday, and what is their mobile number. How do you reach the legal or compliance owner. What is the log evidence you would collect, and where is it. Who notifies the CERT-In and the affected customers, and what is the template. Then time the rehearsal against the 6-hour CERT-In reporting requirement, which is a hard deadline, not a target. A startup that can produce a name, a number and a filled template in the room usually passes the compliance portion of the audit comfortably.
| Day | Task | Owner |
|---|---|---|
| Day 1-2 | Assemble the evidence pack: architecture, assets, data, MFA, logs | Engineering lead |
| Day 3-5 | Fix default credentials, wildcard IAM, exposed databases, secrets in repos | Backend engineer |
| Day 6-7 | Create named auditor accounts, staging access and the escalation list | IT and founder |
| Day 8-10 | Tabletop the CERT-In 6-hour incident reporting path and time it | Founder and security owner |
| Day 11-14 | Rehearse the audit walkthrough and freeze changes during the window | Security owner |
What are the frequently asked questions?
Get a straight answer on this
Send us your audit date and the scope, and we will run a pre-audit readiness check with a named gap list two weeks before it starts.
Send us the details See pricing