What does the SuperClue CERT-In scan check?
The CERT-In scan runs 18 modules against your public website. Each one makes external checks (headers, TLS, DNS, public pages, exposed files) and maps them to a part of the CERT-In Directions of 28 April 2022. Most CERT-In duties are internal, so every module also lists what needs internal evidence.
Incident response and reporting (6 checks)
| Check | What it looks at from outside |
|---|---|
| 6-Hour Incident Reporting | Looks for a privacy policy, terms, cookie policy, security.txt and public health or status endpoints. |
| 180-Day Log Retention | Looks for health endpoints and monitoring headers (NEL, Server-Timing, Report-To, request ID). It cannot see how long you keep logs. |
| NTP Time Synchronisation | Reads the server Date header and flags clock drift of more than 60 seconds from UTC. |
| 24x7 Security Contact | Checks security.txt for Contact and Expires fields, and looks for public policy pages. |
| Breach Disclosure Readiness | Looks for policy pages, security.txt and health or status endpoints. |
| CTSO / Security Officer | Searches your homepage for mentions of a CISO, DPO, CTSO or compliance officer, and checks policy pages. |
SBOM and supply chain (6 checks)
| Check | What it looks at from outside |
|---|---|
| SBOM Compliance | Looks for a published SBOM file (for example sbom.json or cyclonedx.json) and flags exposed dependency files such as package.json or lockfiles. |
| Vendor BOM | Counts third-party scripts and stylesheets on your homepage, flags more than 10, and tests your CORS policy. |
| Patch Management | Audits security headers and reads Server and X-Powered-By headers for end-of-life versions such as PHP 5 or Apache 2.2. |
| Genuine Software | Fingerprints your technology stack from headers and page content. It cannot detect unlicensed software. |
| Third-Party Risk | Lists external script sources, checks them for Subresource Integrity hashes, and tests your CORS policy. |
| Change Management | Audits security headers, checks error pages for stack traces, and notes deployment headers such as ETag or a version header. |
VAPT and audit (6 checks)
| Check | What it looks at from outside |
|---|---|
| VAPT Coverage | Audits security headers, the TLS certificate and DNS records (SPF, DMARC, CAA). This covers your public web surface only. |
| CVSS/EPSS Scoring | Runs a security header audit. Scoring of your own vulnerability programme needs internal data. |
| Empanelled Auditor | Searches your homepage for words such as "CERT-In", "auditor" or "ISO 27001". It cannot confirm that an auditor is empanelled. |
| Audit Frequency | Audits security headers and the TLS certificate. It cannot see when your audits took place. |
| Remediation Tracking | Audits security headers and probes for exposed sensitive files and admin paths. |
| CERT-In Report Submission | Looks for policy pages and security.txt. Report format and submission channel need internal review. |
How should I read the results?
A passed check means the public signal is in place. It does not prove the underlying control. Modules that need internal records can finish as "requires access". The scan is not a CERT-In audit and SuperClue is not an empanelled auditor.
The default cost is 0.25 credits per module, so all 18 come to 4.5 credits. See the CERT-In overview or all 14 framework scans.
Run the 18 CERT-In checks on a domain you have verified.
Request access