Security standards: ISO 27001, NIST CSF and CERT-In directions

In short

Security standards tell an organisation *what* good security looks like and let a customer, a regulator or an auditor verify it. ISO/IEC 27001 is the certifiable management-system standard for an Information Security Management System (ISMS); the NIST Cybersecurity Framework (CSF) is a voluntary, outcome-based framework used to assess and communicate security posture; the CERT-In Directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, are legally binding on every body corporate and service provider operating in India. Together they decide how Indian IT services, banks, fintechs and SaaS firms run their security programmes, so GRC, audit and SOC job interviews at TCS, Infosys, Wipro, Deloitte, EY, PwC, KPMG, HCLTech and the Big-4 risk practices ask about them constantly. In university syllabi they appear in "Cyber security standards / security audit / information assurance" papers and in cyber-law electives.

Explained

What a standard is, and the families a student must know

• Standard - an agreed, auditable specification ("you shall"); framework - a structured set of outcomes you map to ("you should consider"); guideline / code of practice - advice; regulation / direction - law, mandatory.
• Certifiable vs non-certifiable: only a management-system standard with "shall" requirements (ISO/IEC 27001) can be certified against. ISO/IEC 27002 is guidance, so no one is "27002 certified".
• The ISO/IEC 27000 family: 27000 (vocabulary), 27001 (ISMS requirements - certifiable), 27002:2022 (control implementation guidance), 27005 (information security risk management), 27017 (cloud services), 27018 (PII in public cloud), 27701 (privacy information management, extends 27001), 27035 (incident management), 27037 (digital evidence handling).
• Related: ISO 22301 (business continuity), ISO 31000 (risk management - guidance, not certifiable), ISO/IEC 20000-1 (IT service management), ISO 9001:2026 (quality - the current edition, often held alongside 27001 in Indian IT firms).
• NIST publications: CSF (framework), SP 800-53 (control catalogue for US federal systems), SP 800-171 (controlled unclassified information in non-federal systems), SP 800-37 (Risk Management Framework), SP 800-61 (incident handling), SP 800-30 (risk assessment), SP 800-207 (zero trust).
• Sector standards: PCI DSS v4.0.1 (card data - contractual, mandated by card networks, not a law), RBI Cyber Security Framework for banks (2016) and the Master Directions on IT Governance, Risk, Controls and Assurance Practices (effective 1 April 2024), SEBI CSCRF (Cybersecurity and Cyber Resilience Framework, 2024, for SEBI-regulated entities), IRDAI information and cyber security guidelines, NCIIPC guidance for Critical Information Infrastructure under section 70A of the IT Act.

ISO/IEC 27001:2022 - structure and how certification works

• Purpose: establish, implement, maintain and continually improve an ISMS protecting confidentiality, integrity and availability of information, driven by risk assessment and management commitment.
• Current edition: ISO/IEC 27001:2022 (plus Amendment 1:2024 adding climate-change considerations to clauses 4.1/4.2). Certificates against the old 2013 edition ceased to be valid after the transition period that ended 31 October 2025, so all live certificates are now 2022-based.
• Harmonised structure, clauses 4-10 (the auditable "shall" clauses):
  1. 4 Context - internal/external issues, interested parties, and the scope of the ISMS.
  2. 5 Leadership - policy, top-management commitment, roles and responsibilities.
  3. 6 Planning - risk assessment and risk treatment, Statement of Applicability (SoA), information security objectives.
  4. 7 Support - resources, competence, awareness, communication, documented information.
  5. 8 Operation - operational planning and control; run the risk treatment plan.
  6. 9 Performance evaluation - monitoring and measurement, internal audit, management review.
  7. 10 Improvement - nonconformity, corrective action, continual improvement.
• Annex A:2022 - 93 controls in 4 themes (the 2013 edition had 114 controls in 14 clauses):

• 11 new controls in 2022: threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, secure coding.
• Attributes attached to each control in 27002:2022 - control type (preventive/detective/corrective), information security property (C/I/A), cybersecurity concept (aligned to the CSF functions), operational capability, security domain.
• Statement of Applicability: lists all 93 Annex A controls, whether each is applicable, its justification for inclusion or exclusion, and implementation status. Exclusions are allowed with justification; clauses 4-10 can never be excluded.
• Certification route: gap analysis → scope and risk assessment → implement controls → internal audit → management review → Stage 1 audit (documentation and readiness) → Stage 2 audit (effectiveness, on site) → certificate valid 3 years with annual surveillance audits and a recertification audit in year 3.
• Findings: major nonconformity (systemic failure or total absence of a required process - blocks certification until cleared), minor nonconformity (isolated lapse - corrective action plan), observation / opportunity for improvement.
• Who certifies: an accredited certification body (e.g. BSI, DNV, TUV, BV, Intertek, or an Indian body) accredited by a member of the IAF; in India accreditation is through NABCB under the Quality Council of India. The organisation is certified, not a person - individuals are only "Lead Auditor qualified".
• Advantages: customer and tender eligibility (most Indian IT/BPO RFPs ask for it), a repeatable risk process, legal and contractual mapping, PDCA-style improvement.
• Limitations: certifies that a *management system* exists in a defined scope, not that the company cannot be breached; scope can be drawn narrowly (one delivery centre); it is point-in-time and document-heavy; costs money (audit fees plus consultant plus internal effort).

NIST CSF - functions, tiers and profiles

• Nature: voluntary, free, outcome-based; no certification. Built for communicating risk to management and across supply chains; widely used in India by GCCs and firms serving US clients. CSF 2.0 was published in February 2024 and applies to organisations of all sizes and sectors (CSF 1.1 was framed around critical infrastructure).
• Six functions in CSF 2.0 (CSF 1.1 had the last five only):
  1. GOVERN (GV) - organisational context, risk management strategy, roles, policy, oversight, cybersecurity supply chain risk management. New in 2.0 and wraps the other five.
  2. IDENTIFY (ID) - asset management, risk assessment, improvement.
  3. PROTECT (PR) - identity management and access control, awareness and training, data security, platform security, technology infrastructure resilience.
  4. DETECT (DE) - continuous monitoring, adverse event analysis.
  5. RESPOND (RS) - incident management, analysis, reporting and communication, mitigation.
  6. RECOVER (RC) - incident recovery plan execution, recovery communication.
• Hierarchy: Function → Category (e.g. PR.AA Identity Management, Authentication and Access Control) → Subcategory (the actual outcome statement, e.g. PR.AA-05) → Informative References (mappings to ISO 27001 Annex A, SP 800-53, COBIT, CIS Controls).
• Implementation Tiers (1-4) describe how rigorous the risk-management practice is: 1 Partial (ad hoc), 2 Risk Informed (approved practices, not organisation-wide), 3 Repeatable (formal policy, updated regularly), 4 Adaptive (continuous improvement, predictive). Tiers are *not* maturity certificates and a higher tier is not automatically the target.
• Profiles: a Current Profile ("as-is" outcomes achieved) and a Target Profile ("to-be"), with the gap between them driving the action plan; Community Profiles are sector templates.
• Five-step Organizational Profile process in CSF 2.0: scope the Organizational Profile → gather the information needed → create the Current and Target Profiles → analyse the gaps and create an action plan → implement the action plan and update the Profile.
• Advantages: free, flexible, maps to other standards, good language for board reporting, scales down to small firms (CSF 2.0 has small-business quick-start guides).
• Limitations: not certifiable, so it cannot satisfy a contract clause that demands a certificate; outcomes are deliberately non-prescriptive ("establish access control"), so two firms can both claim CSF alignment at very different quality.

CERT-In and the 28 April 2022 Directions - the mandatory Indian layer

• CERT-In (Indian Computer Emergency Response Team) is the national nodal agency for cyber incident response, appointed under section 70B of the IT Act, 2000, functioning under MeitY. Section 70B(6) empowers it to call for information and give directions; section 70B(7) makes non-compliance punishable with imprisonment up to one year or fine up to ₹1 lakh, or both.
• Who is covered: service providers, intermediaries, data centres, body corporates, and government organisations - including those outside India that provide services to users in India.
• Core obligations of the 2022 Directions (in force from 27 June 2022, 60 days after issue; MSME compliance for some clauses was deferred to 25 September 2022):
  1. Report cyber incidents within 6 hours of noticing or being notified, to incident@cert-in.org.in (or the helpdesk/web portal), for the incident types in Annexure I.
  2. Enable and securely maintain logs of all ICT systems for 180 days rolling, kept within India, and produce them to CERT-In when ordered.
  3. Synchronise all ICT system clocks to NTP servers of NIC or NPL (National Physical Laboratory), or an NTP source traceable to them.
  4. Appoint a Point of Contact for CERT-In interaction and keep the details current.
  5. Data centres, VPS, cloud and VPN service providers must register and retain subscriber/customer records - validated names, addresses, contact details, period of hire, IPs allotted, ownership pattern - for 5 years or longer as mandated, and after cancellation/withdrawal of registration.
  6. Virtual asset service providers, exchanges and custodian wallet providers must maintain KYC and financial transaction records for 5 years.
• Annexure I incident types (20 listed) include targeted scanning/probing of critical networks, compromise of critical systems, unauthorised access to IT systems/data, website defacement, malicious code and ransomware attacks, identity theft and phishing, DDoS, data breach and data leak, attacks on IoT devices, attacks on servers and network devices, attacks on applications (SQLi, XSS), attacks on critical infrastructure/SCADA/operational technology, and incidents affecting digital payment systems.
• Related CERT-In instruments: the SBOM/QBOM/CBOM and AI-BOM guidelines (2024) for software transparency, the Comprehensive Cyber Security Audit Policy Guidelines (2025) governing empanelled auditors, and CERT-In empanelment of IT security auditing organisations - the list an Indian entity must pick from for regulatory audits (VAPT, RBI/SEBI mandated audits).
• Other Indian bodies: STQC (Standardisation Testing and Quality Certification, MeitY) for product and e-governance testing; CCA (Controller of Certifying Authorities) under section 17 of the IT Act for digital signature CAs; BIS for Indian Standards (including IS/ISO/IEC 15408), while the Indian Common Criteria Certification Scheme (IC3S) is operated by STQC; NCIIPC for Critical Information Infrastructure; NSDL/NPCI audits in the payments chain.
• Interaction with privacy law: the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 add a separate personal-data breach intimation duty to the Data Protection Board and to affected data principals - but those Data Fiduciary duties (notice, consent, breach intimation, erasure) and the omission of IT Act section 43A take effect only from 13 May 2027; until then section 43A and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply. The CERT-In 6-hour reporting duty is independent and already in force - a single incident can trigger both.
• "Reasonable security practices" under section 43A: the 2011 SPDI Rules expressly recognise IS/ISO/IEC 27001 and approved industry codes of practice as a compliant standard - which is why ISO 27001 certification has direct legal weight in India today.

How the three fit together, and the implementation lifecycle

• Mental model: CERT-In = the floor you must meet by law in India; ISO 27001 = the management system you can prove to a customer; NIST CSF = the measuring stick you use internally and in board reporting.
• A typical Indian enterprise programme: adopt CSF 2.0 as the assessment lens → build the ISO 27001 ISMS and get certified for the in-scope delivery units → hard-wire CERT-In duties (6-hour reporting playbook, 180-day log retention in Indian storage, NIC/NPL NTP, named PoC) → layer sector rules (RBI, SEBI CSCRF, PCI DSS) → add ISO 27701 if privacy/DPDP readiness is needed.
• Risk process (ISO 27005-style, examinable): asset identification and valuation → threat and vulnerability identification → likelihood × impact → risk level against risk acceptance criteria → risk treatment choice.
• Four risk treatment options: modify/mitigate (apply controls), avoid (stop the activity), share/transfer (insurance, outsourcing - note residual accountability stays), retain/accept (document and sign off). Accepting a risk needs risk-owner approval.
• Control classification (asked in vivas): by nature - administrative/organisational, physical, technical; by function - preventive, detective, corrective, deterrent, compensating, recovery.
• PDCA mapping: Plan = clauses 4-6, Do = 7-8, Check = 9, Act = 10. ISO 27001:2022 does not name PDCA explicitly but the cycle is still the way it is taught and audited.
• Key records an auditor will ask for: ISMS scope, information security policy, risk assessment and treatment plan, SoA, asset register, internal audit reports, management review minutes, incident register, training records, supplier assessments, corrective action records.

Key points

• ISMS - a documented, risk-driven management system for information security; ISO/IEC 27001 states its requirements.
• ISO/IEC 27001:2022 - the only certifiable standard of the family; clauses 4-10 are mandatory, Annex A controls are selected via the SoA.
• 93 controls / 4 themes - organisational 37, people 8, physical 14, technological 34; the 2013 edition had 114 in 14 clauses.
• Statement of Applicability - the document justifying inclusion or exclusion of every Annex A control; the auditor's first stop.
• Certification cycle - Stage 1 + Stage 2 audit, 3-year certificate, annual surveillance, recertification in year 3.
• Major vs minor nonconformity - systemic failure blocking certification vs an isolated lapse needing corrective action.
• ISO 27002 is guidance - you implement it, you are never certified to it; ISO 27005 covers risk, ISO 27701 privacy, ISO 22301 continuity.
• NIST CSF 2.0 - voluntary and non-certifiable; six functions GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER.
• GOVERN - added in CSF 2.0 (Feb 2024); it covers strategy, roles, policy, oversight and supply-chain risk and wraps the other five functions.
• Tiers and Profiles - Tiers 1-4 (Partial → Adaptive) describe rigour; Current vs Target Profile drives the gap-closure plan.
• CERT-In - nodal agency under section 70B of the IT Act, 2000, under MeitY; empanels IT security auditors.
• 6 hours - the mandatory window to report a listed cyber incident to CERT-In from noticing it.
• 180 days - rolling log retention, maintained within India; 5 years for data-centre/VPS/VPN/cloud subscriber records and for VASP KYC records.
• NTP - clocks must be synchronised to NIC or NPL servers (or a traceable source) so logs correlate.
• Penalty - section 70B(7): up to 1 year imprisonment or ₹1 lakh fine, or both, for non-compliance.
• Section 43A + SPDI Rules, 2011 remain the operative security-practice law until 13 May 2027, and they name IS/ISO/IEC 27001 as a recognised standard.
• Sector overlays - RBI Master Directions on IT Governance (from 1 April 2024), SEBI CSCRF (2024), IRDAI guidelines, PCI DSS v4.0.1 (contractual).
• Scope matters - a 27001 certificate covers only the stated scope, locations and services; always read the certificate's scope statement.

Formulas and examples

Example 1 - ALE and whether a control pays for itself. A Pune SaaS firm values its customer database at ₹4,00,00,000. A ransomware event would destroy 25% of that value (EF = 0.25) and is judged to occur once in 5 years (ARO = 0.2).

• SLE = 4,00,00,000 × 0.25 = ₹1,00,00,000
• ALE(before) = 1,00,00,000 × 0.2 = ₹20,00,000 per year
• Immutable backups + EDR + awareness training cut the ARO to 0.05: ALE(after) = 1,00,00,000 × 0.05 = ₹5,00,000 per year
• Annual cost of controls = ₹9,00,000. Net benefit = 20,00,000 − 5,00,000 − 9,00,000 = +₹6,00,000 per year → implement. Residual risk = ₹5,00,000/year, to be formally accepted by the risk owner.

Example 2 - CERT-In 6-hour clock. A SOC analyst in Bengaluru confirms unauthorised access to a production database at 23:40 IST on 7 November.

• Clock starts on *noticing*, not on confirming root cause → deadline = 23:40 + 6 h = 05:40 IST on 8 November.
• Forensics being incomplete is not a ground for delay: send the initial report with what is known (incident type from Annexure I, systems affected, time, PoC details) and supplement later.
• Logs of the affected systems for the preceding 180 days must already exist in India; if the firm only kept 30 days, that is a separate breach of the Directions, punishable under section 70B(7).
• If personal data was affected, note the separate DPDP breach-intimation duty that becomes effective on 13 May 2027; until then section 43A/SPDI Rules exposure applies.

Example 3 - Statement of Applicability arithmetic. A 40-person Hyderabad fintech excludes 6 Annex A controls (no in-house software development, no physical data centre).

• Applicable = 93 − 6 = 87; applicability = 87/93 × 100 = 93.5%.
• 61 are fully implemented, 18 partially (score 0.5), 8 not started → implementation score = (61 + 18×0.5)/87 = 70/87 = 80.5%.
• Because development is outsourced, "secure development" cannot simply be excluded - supplier controls (A.5.19-A.5.22) must cover it. Exclusions with weak justification are the commonest Stage 1 finding.

Example 4 - NIST CSF current vs target profile. A GCC scores 4 functions on 20 subcategories each and 2 functions on 10 each, on a 0-4 scale.

• Weighted current = (20×1.5 + 20×2.0 + 20×2.5 + 20×1.0 + 10×2.0 + 10×1.5)/100 = (30+40+50+20+20+15)/100 = 175/100 = 1.75
• As a percentage of the maximum: 1.75/4 × 100 = 43.75% → Tier 2 (Risk Informed) behaviour.
• Largest gap is DETECT (2.0) - monitoring and log analysis - which is also exactly what the CERT-In 180-day log and 6-hour reporting duties depend on, so it is funded first.

Comparison table

Where it is used

• IT services and GCCs (TCS, Infosys, Wipro, HCLTech, Cognizant, Accenture India, Capgemini): ISO 27001 certification per delivery centre is standard in client contracts; CSF mappings appear in client security questionnaires.
• Banking, NBFC and fintech: RBI Master Directions on IT Governance, Risk, Controls and Assurance Practices, cyber security frameworks, CERT-In empanelled auditor VAPT before go-live; PCI DSS for card processing (Razorpay, PayU, Juspay, banks).
• Capital markets and insurance: SEBI CSCRF compliance by stock brokers, depositories, AMCs and market infrastructure institutions; IRDAI cyber security guidelines for insurers.
• Cloud, hosting and VPN providers: the 5-year subscriber-record and registration duties under the CERT-In Directions directly shape onboarding and KYC design.
• Job roles: GRC analyst, ISMS implementer/internal auditor, IT risk consultant (Deloitte, EY, PwC, KPMG, Grant Thornton, Protiviti), SOC analyst (incident reporting playbooks), security compliance engineer, DPO-track roles, CERT-In empanelled auditor firms (e.g. SISA, eSec Forte, Lucideus/SAFE, Netrika).
• Government and e-governance: STQC audits, CCA-licensed certifying authorities, NCIIPC guidance for CII in power, telecom, transport, banking and strategic sectors; UIDAI and DigiLocker ecosystem security requirements.

Interview questions

• Q: What is the difference between ISO 27001 and ISO 27002? A: 27001 states the auditable "shall" requirements of an ISMS and is certifiable; 27002 is a code of practice giving implementation guidance for the Annex A controls and cannot be certified against.
• Q: How many controls are in ISO/IEC 27001:2022 and how are they grouped? A: 93 controls in four themes - organisational (37), people (8), physical (14) and technological (34) - replacing the 114 controls in 14 clauses of the 2013 edition.
• Q: What is a Statement of Applicability? A: The document listing every Annex A control with a decision on applicability, the justification for inclusion or exclusion, and implementation status; exclusions are permitted only with justification, and clauses 4-10 can never be excluded.
• Q: Does an ISO 27001 certificate mean a company cannot be breached? A: No. It evidences that a risk-based management system exists and operates within a stated scope at the time of audit; it says nothing about residual risk outside that scope or about future incidents.
• Q: Name the functions of NIST CSF 2.0 and what changed from 1.1. A: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER - GOVERN was added in CSF 2.0 (February 2024) to cover strategy, roles, policy, oversight and supply-chain risk, and the scope widened from critical infrastructure to all organisations.
• Q: Are NIST CSF Implementation Tiers the same as maturity levels? A: No. Tiers 1-4 describe how rigorous and integrated the risk-management practice is; they are not certifications, and Tier 4 is not automatically the right target for every firm.
• Q: Under the CERT-In Directions, when must an incident be reported, and from when does the clock run? A: Within 6 hours of noticing the incident or being notified about it - not from completing the investigation, so a preliminary report is sent and supplemented later.
• Q: What log and time requirements do the CERT-In Directions impose? A: Logs of all ICT systems must be maintained securely for a rolling 180 days within India and produced on demand, and all system clocks must be synchronised to NIC or NPL NTP servers or a traceable source.
• Q: What is the penalty for not complying with a CERT-In direction? A: Section 70B(7) of the IT Act, 2000 provides imprisonment up to one year or a fine up to ₹1 lakh, or both.
• Q: A ransomware attack hits an Indian SaaS firm and customer personal data is exfiltrated. Which reporting duties apply? A: The CERT-In 6-hour report is due immediately; sectoral regulators (RBI/SEBI/IRDAI) may require their own notification; the DPDP Act's breach-intimation duty to the Data Protection Board and data principals takes effect from 13 May 2027, with section 43A and the SPDI Rules, 2011 applying until then.
• Q: How would you run an ISO 27001 and NIST CSF programme together without duplicating work? A: Use the CSF profiles to assess and report posture, then map each subcategory to Annex A controls through the CSF informative references so one set of evidence satisfies both.
• Q: What are the four risk treatment options, and who signs off acceptance? A: Modify (apply controls), avoid, share/transfer and retain/accept; acceptance must be documented and approved by the risk owner, and transferring a risk does not remove accountability.

Common mistakes

• Saying a company is "ISO 27002 certified" or that a person is "ISO 27001 certified" - only an organisation is certified, and only against 27001.
• Quoting the 2013 figures (114 controls, 14 clauses, PDCA named in the standard) for the current 2022 edition.
• Ignoring the certificate's scope statement and assuming the whole company, all sites and all services are covered.
• Treating NIST CSF as certifiable, or confusing the CSF with SP 800-53 (a control catalogue) or SP 800-37 (the Risk Management Framework).
• Starting the CERT-In 6-hour clock from root-cause confirmation instead of from first noticing, and confusing 180 days (logs) with 5 years (subscriber and VASP records).
• Assuming the DPDP Act has already displaced section 43A and the SPDI Rules - those changes operate only from 13 May 2027.
• Writing a risk register without asset values, risk owners or acceptance criteria, so no treatment decision can actually be justified in an audit.

Related topics

• IT governance, risk and compliance · Cyber law and the IT Act · Digital Personal Data Protection Act 2023 and privacy by design · Cyber security careers and certifications: CEH, OSCP, Security+ and CISSP · Security auditing and VAPT · Incident response and digital forensics · Business continuity and disaster recovery.