Using CERT-In Baseline Cyber Defence Controls to Plan Security Work

Published by Anvexa Security Solutions.

CERT-In has published a baseline set of cyber defence controls for organisations. Its main value is that it turns a vague goal like "be more secure" into a list you can measure yourself against.

A simple way to use it is to score every control as implemented, partially implemented or missing. Be strict about "implemented". If you can't produce a screenshot, a configuration export or a log that proves it, it is partial at best. A control with no evidence is an assumption, not a control.

The gaps tend to cluster in the same places. Identity and access management is a common one: shared admin accounts, no MFA on email, and leavers whose access was never revoked. Patch management is another, and so are backups that have never been test-restored.

Don't try to close everything at once. Start with the controls that reduce the most risk for the least effort, which for most teams means MFA, patching and backups. Then turn the rest into a remediation plan where every item has an owner and a due date.

Repeat the scoring after three months. The second pass shows whether the fixes are holding or old gaps are creeping back, and it gives you something concrete to show a customer or auditor who asks how you manage security.