Home / Knowledge hub / CERT-In directions
Knowledge hub
CERT-In directions
Indian rules requiring certain incidents to be reported within six hours.
What it means
The CERT-In directions are rules issued on 28 April 2022 by the Indian Computer Emergency Response Team under section 70B of the Information Technology Act. They require certain organisations to report listed types of cyber incident to CERT-In within six hours of noticing them.
They apply to service providers, intermediaries, data centres, body corporates and government organisations. The directions also set rules on log retention and on the time sources your systems use, so they reach beyond reporting. Read the official text for the exact scope and the list of reportable incidents.
Why it matters
Six hours is short, and it counts from when you notice the incident, not from when you finish investigating. A team that has to find the right contact, agree who may report and gather the facts will not make it unless it has practised.
The directions are separate from the DPDP Act and do not replace other duties. A single event can trigger several notices at once, for example one to CERT-In and, where personal data is involved, one under privacy law. Missing a duty can bring legal consequences under the IT Act.
How it shows up
The directions list incident types that must be reported, including attacks on servers and applications, data breaches and data leaks, unauthorised access to systems or data, and defacement of websites. Check the current official text for the full list, as it is specific.
They also require you to keep logs of your ICT systems for 180 days, within Indian jurisdiction, and to synchronise system clocks to the NTP servers of NIC or NPL. Name a point of contact for CERT-In. Build the six-hour step into your incident response plan so it is not discovered on the day.
Questions people ask
CERT-In directions, answered
Who has to follow the CERT-In directions?
They are addressed to service providers, intermediaries, data centres, body corporates and government organisations. In practice, most companies running software or services for users in India should assume that they apply and check the text.
If unsure, get legal advice.
What counts as a reportable incident?
The directions include a list: for example targeted scanning, compromise of systems, unauthorised access, data breach and data leak, attacks on applications and servers, and malicious code. The list is specific and has been updated by CERT-In from time to time.
Read the current official list.
Does the six hours start when the incident happens?
It starts when you notice the incident, or when it is brought to your notice. That is why detection and logging matter.
Report with what you know and send more detail later.
How long must logs be kept?
The directions require logs of all ICT systems to be maintained securely for a rolling 180 days, within Indian jurisdiction. They can be produced to CERT-In when asked.
This affects your hosting choices as well as your policy.
How is this different from the DPDP Act?
CERT-In directions concern reporting cyber incidents to a government agency, regardless of whether personal data is involved. The DPDP Act concerns personal data and duties to the Data Protection Board and to the people affected.
One event can need both.
Related
Terms that sit next to this one
Incident response plan
A written plan for who does what in the first hours after a security incident.
Breach notification
Telling regulators and affected people about a data breach within a set time.
Log retention
How long you keep logs, which decides whether you can investigate old incidents.
DPDP Act 2023
India's law on how organisations may collect, use and protect personal data.
Security incident
An event that actually harms, or threatens to harm, your data or systems.
Could you report within six hours?
We can evidence which application weaknesses exist, with the request, response and code that prove them, and findings can be checked again after a fix. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.