IGaaS stands for Infrastructure Governance as a Service — a proprietary readiness framework by InfraVeritas 360. It evaluates an enterprise's infrastructure readiness before formal compliance audits begin, identifying gaps across 12 governance control domains mapped to 50+ global regulatory frameworks.

Does IGaaS provide compliance?

No. IGaaS prepares enterprises for compliance — it does not audit, certify, or enforce compliance. We operate at the foundation layer: identifying infrastructure gaps and readiness shortfalls before formal regulatory processes begin.

What is infrastructure compliance readiness?

Infrastructure compliance readiness is the foundational stage where an enterprise evaluates its systems, processes, approvals, and controls to ensure it can successfully meet regulatory requirements. InfraVeritas 360's IGaaS engine operates at this layer.

Which global frameworks does IGaaS map to?

IGaaS maps to 50+ frameworks including ISO 27001:2022, GDPR, SOC 2 Type II, NIST CSF 2.0, HIPAA, DPDP Act 2023, CERT-In 2022, PDPA Singapore, MAS TRM, Essential Eight, NIS2, DORA, UAE PDPL, PIPEDA, and more. The platform automatically applies relevant frameworks based on your country.

How does the IGaaS readiness assessment work?

Step 1: Select your country — the IGaaS engine maps applicable frameworks automatically. Step 2: Enter organisation details. Step 3: Answer 12 readiness-based governance questions across infrastructure control domains. Step 4: The engine analyses your responses in real time. Step 5: Receive a governance readiness report prepared for formal compliance processes.

What are CERT-In cybersecurity directions for IT infrastructure?

CERT-In Directions 2022 mandate 6-hour breach reporting, 180-day log retention, ICT asset inventory maintenance, and annual VAPT for internet-facing systems. The CERT-In compliance checklist India applies to all organisations operating in India.

Who must comply with CERT-In directions in India?

CERT-In directions apply to all government entities, private sector organisations, intermediaries, data centres, VASPs, and cloud service providers — regardless of size or sector. The IT audit readiness checklist must include CERT-In controls.

What is the 6-hour reporting rule under CERT-In?

Organisations must report cybersecurity incidents — data breaches, ransomware, unauthorised access — to CERT-In within 6 hours. This requires mature logging and monitoring infrastructure. The logging and monitoring compliance checklist is foundational to meeting this obligation.

What are penalties for CERT-In non-compliance?

CERT-In non-compliance attracts fines up to ₹1 Crore per direction and criminal liability for responsible officers. The free IT audit checklist India must include CERT-In's 180-day log retention and ICT inventory requirements.

🌐 Serving Enterprises Across 20+ Countries· Engineered in India · Trusted Globally

Language

Measure Your Exposure

💼 NBFC · CERT-In Compliance

CERT-In Infrastructure Compliance Checklist for NBFC India

ℹ️ This self-assessment maps your NBFC infrastructure against CERT-In requirements (CERT-In Cybersecurity Directions 2022). Results are indicative — consult a certified auditor for formal compliance determination.

What is CERT-In?

The CERT-In Cybersecurity Directions 2022 mandate 6-hour breach reporting, 180-day log retention, ICT asset inventory maintenance, Virtual Asset Service Provider controls, and annual VAPT for all organisations operating in India. These directions apply to government, private sector, and intermediaries. The CERT-In compliance checklist India is non-negotiable — non-compliance attracts fines up to ₹1 Crore and criminal liability for responsible officers.

Why NBFC Needs CERT-In

NBFCs fall within CERT-In compliance scope as financial sector entities. The requirements for ICT asset inventory, log retention, and incident response capability align directly with RBI IT framework obligations — infrastructure readiness addresses both simultaneously.

Common NBFC Infrastructure Gaps

System logging not enabled — 180-day retention obligation cannot be met
No centralised log aggregation — cannot detect anomalous events at scale
ICT asset inventory incomplete — mandatory under CERT-In directions
No incident response plan — 6-hour reporting obligation would be missed

Optional context:Infra Type: Org Size: Maturity:

CERT-In · NBFC

Infrastructure Controls Assessment

Tap each control implemented in your environment — governance score updates live

/100 Score

0/25

Controls

0/ 100

Governance Score

Tap controls to see your score

Module Status

🍪

We use cookies

InfraVeritas 360 uses essential cookies for security and session management, and optional cookies for analytics. We require your consent before setting non-essential cookies. Privacy Policy

DPDP