Governance, risk, compliance and audit
in one system for government
MeitY CSA, CERT-IN and NISPG requirements, run from one system. Netra gives ministries, departments and PSUs a single record where every requirement has an owner, every audit observation becomes a dated action, and the head of the department can see where each office stands.
Government · one control, credited everywhere
Review user access to critical systems
In progress · Owner: Information Security Officer
Credited to
- MeitY CSA
- CERT-IN Guidelines
- NISPG 2019 v5.0
Illustration of how work is credited. Not client data.
- MeitY CSA
- The 282-line Comprehensive Security Audit checklist, owned and evidenced
- CERT-IN
- Obligations tracked as owned tasks
- NISPG 2019 v5.0
- Held with MHA terminology preserved
- Audit Centre
- Internal and empanelled auditors work inside Netra
What you are asked for
The government challenge
Attacks have grown while mandates have multiplied. Firewalls, SOCs and empanelled auditors are in place. What is usually missing is the layer that shows who owns each control, which findings are still open and where the evidence is.
Rising attacks
CERT-IN handled over 29 lakh cyber incidents in 2025, against about 15.9 lakh in 2023. Government portals and citizen services are among the targets.
A heavy control burden
MeitY's Comprehensive Security Audit checklist, 282 lines in 13 domains, sits on top of CERT-IN's guidelines for government entities and MHA's NISPG.
A recurring audit cycle
CERT-IN guidelines call for periodic internal security audits, alongside audits by CERT-IN empanelled auditors.
Knowledge that leaves with people
When a nodal officer is transferred, the history of who did what leaves with them.
No view from the top
The head of the department sees the present state, gaps and risks only in a compiled report.
Evidence rebuilt each cycle
The same evidence is gathered again by hand before every audit.
The difference
The missing layer: governance
Infrastructure, network security and monitoring are in place. Governance and audit still run on spreadsheets and email.
The usual way
- Who owns each control? Ownership sits in circulars and inboxes
- Which audit observations are pending? Chased by email, lost between cycles
- Where is the evidence for the next audit? Rebuilt by hand every cycle
- What is our risk posture today? No department-wide risk register
In Netra
- Every MeitY CSA, CERT-IN and NISPG requirement with a named owner and a date
- Every observation an owned, dated action, tracked to verified closure
- Evidence captured once, at the point of work, in a tamper-evident vault
- A live risk register and posture view across every office
From requirement to an inspectable record
The same structure for a department, a PSU or a technology partner.
- 1
Load the framework
MeitY CSA, CERT-IN, NISPG 2019 v5.0 and any others that apply.
- 2
Assign ownership
Each requirement to a named owner, with a due date.
- 3
Evidence the work
Attachments and notes kept with the task.
- 4
Keep the trail
Changes, approvals and reviews recorded, and kept through transfers.
- 5
Audit
Internal and empanelled auditors work from the same record.
Quiet audits. Loud confidence.
Observations should not return cycle after cycle. In Netra each one becomes an owned, dated action, with closure verified in the same system.
See the Audit CentreFrameworks
The frameworks this sector works to
Framework names and wording follow the source documents.
MeitY CSA
The Comprehensive Security Audit checklist for important government applications and databases, 282 lines in 13 domains.
CERT-IN Guidelines
Obligations for Indian organisations, including government entities.
NISPG 2019 v5.0
National Information Security Policy and Guidelines, with MHA terminology preserved.
ISO 27001:2022
A common management-system baseline.
NIST SP 800-53
A control catalogue used by many public-sector programmes.
Who uses it
Every level can show due diligence and due care
Due diligence is knowing what applies and where you stand. Due care is acting on it, with an owner, a date and evidence.
Secretary and Head of Department
Live posture across every office and framework, instead of a compiled report that is weeks old.
CISO and Nodal Officer
Every requirement mapped with a named owner. Assign, escalate and track each gap; history survives transfers.
Divisions and IT Heads
A clear list of the controls and policies their division owns, with due dates, reminders and a sign-off trail.
Internal and empanelled auditors
Evidence linked to each control before fieldwork starts. Every observation tracked to verified closure.
Cyber analysts and IT teams
One task can satisfy several frameworks together. Evidence is captured once, at the point of work.
Procurement and vendor management
Vendors and system integrators assessed before they touch government data, and monitored after.
In the platform
The modules behind this page
Every module works on the same record, so a task done once is counted wherever it applies.
Compliance Centre
Status for every framework, derived from the work.
Task Engine
Every requirement as an owned task with evidence.
Audit Centre
Internal, external, certification and regulatory audits end to end.
Risk Manager
A register where residual risk falls as work is done.
Third-Party Risk
Vendors discovered, assessed and reported to the board.
Policy Hub
Policies generated, scored and kept current.
Asset Management
Assets linked to the tasks that protect them.
Dashboard and Reports
A live posture score and one-click board reports.
The detail: reporting, third parties and what to prepare
Questions we are asked
Who owns each control?
Netra assigns each requirement to a named owner with a due date and evidence, so ownership is on the record, not in circulars. History is kept when an officer is transferred.
What is still pending?
Every audit observation and task is tracked from issue to verified closure, with owners and dates.
Where do we stand today?
The dashboard gives a live view of posture across offices and frameworks, and reports can be exported for any level.
Does Netra hold NISPG?
Yes. NISPG 2019 v5.0 is in the library, with MHA's own terminology preserved. Netra does not issue NISPG certification or government approval.
Can our technology partners work in the same system?
Yes. Technology partners work on the same record with their own access.
Can internal and CERT-IN empanelled auditors work inside Netra?
Yes. The Audit Centre runs internal, external, certification and regulatory audits, and an external auditor can be invited into the audit.
Can we keep evidence in our own storage?
Yes. Netra supports customer storage for evidence in addition to its default.
Does Netra support the MeitY Comprehensive Security Audit checklist?
Yes. The MeitY CSA checklist (version dated 27 March 2024, 282 lines across 13 domains) is a framework in Netra. Each line gets an owner and evidence, and the audit findings become tracked corrective actions. Netra organises the audit and its evidence; the vulnerability and penetration testing is done by your auditor.
How is Netra deployed for government bodies?
Netra runs on-premise in your own data centre, State Data Centre or NIC facility, on a MeitY-empanelled government cloud in Indian data centres, or as Netra Cloud managed by Cyber Soldiers. The platform and the framework libraries are the same in each model, and you choose the one your data-classification policy allows.
See it for your department
Who owns each control, what is still pending and where you stand today, answered in one walkthrough on a setup modelled on your department.