CERT-In 6-Hour Incident Reporting Rule: India Compliance Guide

CERT-In's April 2022 Directions require every organisation operating in India to report specified cyber incidents to the Indian Computer Emergency Response Team within 6 hours of noticing them — not 6 hours after investigation, but 6 hours after first detection. Simultaneously, organisations must maintain ICT system logs for 180 days within Indian jurisdiction, synchronise clocks to NTP servers traceable to the National Physical Laboratory or National Informatics Centre, and provide KYC information for VPN and cloud subscribers. These Directions, issued under Section 70B(6) of the Information Technology Act, 2000, are legally binding on every entity — government, private, or public sector — that uses, provides, or manages information infrastructure in India.

What the CERT-In Directions Actually Say

The CERT-In Directions dated 28 April 2022 (published by the Ministry of Electronics and Information Technology, available at cert-in.org.in) came into force on 27 June 2022. They amend the 2014 CERT-In Operating Rules and make three core compliance obligations non-negotiable:

1. 6-hour incident reporting — Covered organisations must report any of the listed incident types to CERT-In within 6 hours of becoming aware of the incident, regardless of whether the cause or scope has been established.
2. 180-day log retention — Logs of ICT systems, including servers, network devices, endpoints, and cloud infrastructure, must be maintained for a rolling 180-day window and stored within India.
3. NTP synchronisation — All ICT infrastructure clocks must sync to NPL- or NIC-traceable NTP sources to ensure log timestamps are legally defensible.
4. KYC and subscriber records — VPN service providers, virtual asset service providers, cloud service providers, and data centres must maintain accurate subscriber/customer information for 5 years, even after the customer cancels the service.

Who Must Comply

The Directions apply broadly. There is no size threshold and no sector carve-out. If your organisation:

1. Operates ICT infrastructure in India (servers, cloud workloads, SaaS, or on-premise),
2. Provides internet services, data centre services, cloud services, or VPN services to Indian customers,
3. Is a government body, public sector undertaking, or private enterprise using digital infrastructure, or
4. Handles financial services, critical information infrastructure, or e-commerce,

The 20 Reportable Incident Categories

CERT-In's Directions enumerate 20 types of incidents that must be reported within the 6-hour window. These include:

Understanding the 6-Hour Window in Practice

Six hours sounds generous until you factor in real-world constraints:

1. Detection often happens outside business hours (most ransomware activates at 2–3 AM)
2. Initial responders may not have authority to notify regulators
3. The CERT-In portal requires structured information: incident type, affected systems, estimated impact, initial containment steps taken
4. If your team is still in triage mode, you still must file — CERT-In accepts preliminary reports that can be supplemented later

What to Include in the Initial Report

CERT-In's reporting format (available at cert-in.org.in) typically asks for:

1. Organisation name, contact details, and sector
2. Date and time the incident was first noticed
3. Type of incident (from the 20-category list)
4. Affected systems and estimated scope
5. Initial containment actions taken
6. Whether law enforcement has been notified

The 180-Day Log Retention Requirement

Log retention is equally non-negotiable. The Directions require:

1. Scope: Logs from ICT infrastructure — servers, routers, switches, firewalls, endpoints, VPNs, cloud environments, and SaaS tools with API log access
2. Duration: Minimum 180 days on a rolling basis
3. Location: Stored within India (organisations using foreign cloud providers must ensure logs flow to Indian regions or a separate India-based SIEM)
4. Integrity: Logs must be tamper-evident; CERT-In can request them during an investigation
5. Clock synchronisation: All log timestamps must come from NTP sources traceable to NPL (National Physical Laboratory) or NIC

VPN and Cloud Provider KYC Obligations

Organisations that offer VPN, cloud, or data centre services to Indian customers must collect and verify subscriber identity at onboarding and retain those records for 5 years — including after service termination — making them available to CERT-In on request. The requirement targets service providers, not individual users of commercial VPN products.

Building a 6-Hour Incident Reporting Workflow

Meeting the 6-hour deadline requires process engineering, not just technology. A workflow that depends on the right person being awake, available, and knowing the CERT-In portal password will fail.

The Five Process Pillars

1. 24/7 Detection Coverage Alerts from your SIEM, EDR, or cloud monitoring must reach a human within minutes, not hours. On-call rotations and automated escalation are prerequisites, not optional.

2. Documented Classification Matrix Your team must be able to determine within 15 minutes whether an incident falls into one of CERT-In's 20 categories. A single-page classification matrix in your runbook eliminates judgment paralysis during triage.

3. Pre-designated Regulatory Reporting Contact One named person — with a backup — holds the authority and credentials to file the CERT-In report. This should not be discovered during an incident.

4. Pre-populated Report Template Maintain a partially completed incident report with your organisation's static details. When an incident occurs, you fill in the specifics, not the boilerplate.

5. Verified Log Pipeline Confirm that logs from all in-scope systems are flowing to a centralised SIEM or log management platform, that the retention window is set to at least 180 days, and that the storage sits within India. Test this quarterly.

Incident Response Time Budget

The chart below shows how the 6-hour window should be allocated across detection, triage, escalation, and filing — leaving buffer for system slowdowns or off-hours gaps.

Penalties for Non-Compliance

The CERT-In Directions are issued under Section 70B(6) of the IT Act, 2000. Non-compliance can result in enforcement action by CERT-In, including:

1. Formal directions to comply, with timelines
2. Referral to the Ministry of Electronics and Information Technology
3. Prosecution under the IT Act, which carries imprisonment and financial penalties at the discretion of adjudicating authorities
4. In cases involving critical information infrastructure, additional consequences under the National Cyber Security Policy and sector-specific regulations (RBI, SEBI, IRDAI) may apply

How VAPT Connects to CERT-In Compliance

CERT-In's Directions are reactive — they govern what you do after an incident. Proactive vulnerability management reduces how often those incidents occur and builds the documented evidence trail that regulators expect to see. Organisations that run a regular free VAPT scan identify the misconfigurations, unpatched CVEs, and weak authentication controls that attackers exploit before a breach triggers the 6-hour clock.

Bachao.AI, built by Dhisattva AI Pvt Ltd, automates vulnerability discovery so security and compliance teams have continuous visibility — not just a point-in-time audit once a year. Formal audits requiring CERT-In empanelled sign-off are handled with a CERT-In empanelled partner; Bachao.AI provides the automated scanning and evidence layer that feeds into that process.

Compliance Checklist