What are the CERT-In Directions?
CERT-In is India’s national agency for cyber incident response. Under section 70B(6) of the Information Technology Act, 2000, it issued Directions in April 2022 that set some of the world’s tightest cyber incident reporting duties, along with logging and record-keeping requirements.
Who does it apply to?
Service providers, intermediaries, data centres, body corporates and government organisations, which in practice means most organisations operating ICT systems in India. Additional duties apply to data centres, VPS providers, cloud service providers, VPN providers, virtual asset service providers and exchanges.
Key duties
- Report within 6 hours: report specified types of cyber incidents to CERT-In within six hours of noticing them or being notified. Listed types include targeted scanning, compromise of critical systems, unauthorised access, website defacement, malicious code, attacks on servers, identity theft, data breaches and leaks, attacks on IoT devices and attacks affecting digital payment systems.
- Point of contact: designate one for communication with CERT-In.
- Clock synchronisation: synchronise ICT system clocks with the NTP servers of the National Informatics Centre or the National Physical Laboratory, or with servers traceable to them.
- Log retention: keep logs of all ICT systems for a rolling 180 days within India and provide them to CERT-In when asked.
- Subscriber records: certain providers, including data centres, cloud, VPS and VPN providers, must keep verified customer information for five years or longer if the law requires.
In practice
Six hours is too short for a full investigation, so organisations prepare a lightweight initial report, then follow up. Incident response plans should include the CERT-In reporting format and contacts.
How does it relate to other frameworks?
Sector regulators such as RBI, SEBI and IRDAI set their own reporting rules on top. Personal data breaches also trigger duties under the DPDP Act and its Rules.
Sources and official references
- CERT-In — Indian Computer Emergency Response Team (official source)
- Ministry of Electronics and Information Technology — MeitY (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with Indian Computer Emergency Response Team (CERT-In), Ministry of Electronics and Information Technology.
