What the 2022 Directions Say
Issued on 28 April 2022 under section 70B(6) of the IT Act, 2000 and effective from 27 June 2022, the directions apply to every service provider, intermediary, data centre, body corporate, and Government organisation that uses computer resources in India. They impose four operational obligations: incident reporting, log retention, time synchronisation, and point-of-contact nomination.
The 6-Hour Reporting Clock
Specified incidents must be reported to CERT-In within 6 hours of noticing or being brought to notice. "Noticing" is read broadly — detection by any team (SOC, product, legal, support) starts the clock.
Reportable Incidents (Non-Exhaustive)
- Targeted scanning / probing of critical networks
- Compromise of critical systems, information, or networks
- Unauthorised access to IT systems or data
- Defacement of websites and intrusions into web applications
- Malicious code attacks (ransomware, info-stealers, cryptominers)
- Attacks on servers (database, mail, DNS) and network devices
- Identity theft, spoofing, phishing attacks
- Denial-of-Service (DoS) / Distributed DoS attacks
- Attacks on IoT devices and associated systems
- Data breaches and data leaks
- Attacks on applications, especially cloud computing, big-data, blockchain, AI/ML, robotics
- Fake mobile apps impersonating your brand
If in doubt, report. Under-reporting carries direct exposure; over-reporting does not.
Reporting Mechanism
- Primary:
[email protected] - Portals and fax: as published on the CERT-In website
- Format: use CERT-In's reporting form (incident type, date/time, affected system, impact, action taken, contact)
Additional Compliance Obligations
Log retention — 180 days (rolling), stored within India. Logs covered include ICT systems, applications, and network devices. Logs must be produceable to CERT-In when requested.
Time synchronisation. Clocks on all ICT systems must be synchronised to NTP of NIC or NPL (or NTP servers traceable to these).
Point of Contact (PoC) nomination. Every covered entity must nominate a PoC to interface with CERT-In. The PoC's details must be filed with CERT-In in the prescribed format.
Data centre, VPS, cloud and VPN providers. Must maintain customer KYC and transactional records for 5 years (name, address, contact, email, IP allotted, period of hire). This is the obligation that drew the most industry pushback.
Crypto exchanges / custodians. Must maintain KYC and financial transaction records for 5 years.
Internal Readiness Checklist
- CERT-In PoC designated and PoC form filed
- 6-hour reporting runbook with named owners (SOC lead, legal, comms)
- 24/7 incident intake channel staffed
- Incident classification map (which detections trigger CERT-In reporting)
- Log retention: 180 days, India-resident storage, access control
- NTP sources configured to NIC / NPL servers
- Templates: initial report (6-hour), follow-up report, final report
- Tabletop exercise run at least annually to validate the 6-hour SLA
- Vendor contracts updated with CERT-In reporting support clause
- Data centre / cloud provider contracts confirm India-resident log retention
Penalties
Non-compliance can be prosecuted under section 70B(7) of the IT Act, carrying imprisonment up to one year or a fine up to ₹1 lakh, or both. In practice, enforcement has focused on repeat offenders and high-impact incidents.
How This Interacts With Other Obligations
- DPDPA: personal data breaches also need notification to the Data Protection Board under the DPDPA regime. Run both pipelines in parallel.
- RBI: banks must report to RBI within 2–6 hours (CSITE Cell), AND to CERT-In within 6 hours.
- SEBI: market intermediaries have additional SEBI incident reporting that works alongside CERT-In.
For Audits of This Posture
Hire a CERT-In empanelled auditor with declared capabilities in compliance_audits and rbi_sebi_irdai_compliance (and data_privacy if DPDPA is also in scope). Scope the audit to cover: PoC nomination, 6-hour process, log retention, time sync, tabletop evidence.