CERT-In's 6-hour incident reporting rule: what Indian businesses need in place

In April 2022, the Indian Computer Emergency Response Team (CERT-In) issued directions under Section 70B of the IT Act that apply widely to organisations operating in India, including service providers, data centres, companies and government bodies. The best-known requirement is short: report specified cyber incidents to CERT-In within six hours of noticing them.

This article is a practical overview, not legal advice. Check the current text of the directions and CERT-In's FAQs, or ask your legal adviser, for how they apply to your organisation.

The key requirements

• 6-hour reporting: specified types of incidents must be reported to CERT-In within six hours of being noticed or brought to your attention. The list includes compromise of systems or data, unauthorised access, website defacement, malware and ransomware attacks, data breaches and data leaks, and attacks on servers, applications and cloud systems, among others.
• Log retention: logs of ICT systems must be kept securely for a rolling 180 days, within Indian jurisdiction, and provided to CERT-In on request.
• Time synchronisation: system clocks must be synchronised to the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to servers traceable to them, so logs line up across systems.
• Point of contact: organisations must designate a point of contact to liaise with CERT-In.

Why six hours is hard

Reporting quickly means first detecting quickly. Many organisations discover breaches days or weeks later, usually from a customer or a third party. Meeting the rule in practice needs:

1. Visibility: centralised logging from servers, cloud accounts, identity providers and key applications.
2. Alerting: someone, or a service, watching those logs and alerts around the clock.
3. A plan: a written incident response procedure that names who decides an incident is reportable, who reports it, and what information to collect.
4. Practice: a tabletop exercise so the first time you follow the plan isn't during a real incident.

A quick readiness check

• Do you keep at least 180 days of logs, and are they stored in India?
• Are your servers synced to NIC or NPL time sources?
• Is there a named CERT-In point of contact, and do they know it?
• Could you produce a timeline of a suspicious login from last month?

We help organisations with CERT-In readiness reviews and provide 24/7 monitoring that makes six-hour reporting realistic. Request a quote.