The CERT-In directions say organisations must enable logs of all their ICT systems and maintain them securely for a rolling 180 days, within Indian jurisdiction, and hand them over with an incident report or on direction. The FAQ softens the location point: logs may sit outside India if you can produce them to CERT-In reasonably fast.
What the text says
Direction (iv) of the 28 April 2022 document covers "all their ICT systems", which is wider than production servers. The period is rolling, so every day you drop the oldest day and keep the latest 180. The logs must be kept securely, and CERT-In can ask for them along with an incident report or by order.
What the FAQ clarifies
Two answers matter for engineering teams.
On location, the FAQ says logs may be stored outside India as long as you can supply them to CERT-In within a reasonable time. It separately says a service provider offering services to users in India must maintain logs and records of financial transactions in Indian jurisdiction.
On scope, the FAQ says the right logs depend on your sector. Its examples include firewall logs, IPS logs, SIEM logs, web, database, mail, FTP and proxy server logs, event logs of critical systems, application logs, SSH logs and VPN logs, and it says the list is not exhaustive.
The FAQ also has a question on logs that contain personal data. Treat that as a reason to design the log pipeline carefully, not to log less.
Turning it into a design
A practical setup for a SaaS or fintech team:
- Inventory log sources. Start from your asset list, not from what is already shipped to the log tool.
- Pick a central store with write once or restricted delete access, so logs are trustworthy as evidence.
- Set retention to at least 180 days, then check whether another rule asks for longer.
- Decide the region. If the store is outside India, test that you can export a day of logs quickly.
- Keep clocks aligned across systems, because logs with drifting timestamps are hard to use. The directions have a separate clock sync direction, covered in our post on NTP.
- Mask or tokenise personal data in logs where you can.
Do not forget the DPDP overlap
The DPDP Rules 2025 add their own one year log and data retention rule for Data Fiduciaries once the relevant rules commence. If both apply to you, the longer period wins in practice. See the post on log retention under both regimes.
Try it yourself
Open the demo and look at how components and assets are listed. If you cannot list your systems, you cannot say your logging covers all of them.
Click through it at your own pace, or open it full screen.
Safeguard's asset discovery gives you an inventory to check your logging coverage against. It is not a log store.
Quick check
Does 180 days mean 6 months?
The direction says 180 days, rolling. Use the day count.
Must the logs physically be in India?
The direction says within Indian jurisdiction. The FAQ says logs may be stored outside India if you can provide them to CERT-In in reasonable time. Confirm your own position with counsel.
Sources
Last reviewed: 19 October 2026.
