The CERT-In directions of 28 April 2022 require covered organizations in India to report listed cyber incidents within 6 hours, keep logs of all ICT systems for a rolling 180 days within Indian jurisdiction, sync clocks to NIC or NPL time, and name a point of contact. Cloud, VPS and VPN providers have extra record duties.
This summary reads the text of the directions as published by CERT-In. It is not legal advice.
Who has to follow them?
The directions are issued under section 70B(6) of the Information Technology Act, 2000. They address service providers, intermediaries, data centres, body corporate and government organisations. That wording is wide, so a software company with an Indian entity should assume it is covered unless counsel says otherwise.
What are the main duties?
Time sync. All ICT system clocks must connect to the Network Time Protocol servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or servers traceable to them. Organizations spread across several geographies may use another accurate source, provided it does not deviate from NPL and NIC.
Six hour reporting. Incidents listed in Annexure I must be reported to CERT-In within 6 hours of noticing them or being told about them. The directions give an email address, phone number and fax number for reporting.
Cooperation. When CERT-In orders it, you must act or supply information, in the format and time it specifies. You must designate a point of contact and send the details to CERT-In using the Annexure II format.
Logs. You must enable logs of all ICT systems and keep them securely for a rolling 180 days, maintained within the Indian jurisdiction, ready to hand over with an incident report or on order.
Provider records. Data centres, VPS, cloud and VPN providers must register accurate subscriber information, such as validated names, period of hire, assigned IP addresses, onboarding email and IP with timestamp, purpose, address and contact numbers, and ownership pattern, and keep it for 5 years or longer after cancellation.
Virtual asset firms. Virtual asset service providers, exchanges and custodian wallet providers must keep KYC records and financial transaction records for five years.
Failure to comply may invite punitive action under section 70B(7) and other laws. The directions took effect 60 days after issue.
What counts as a reportable incident?
Annexure I has twenty types. They include targeted scanning of critical systems, compromise of critical systems or information, unauthorised access, website defacement or malicious changes, malicious code such as ransomware and cryptominers, attacks on servers and network devices, phishing and spoofing, denial of service, attacks on critical infrastructure and operational technology, attacks on applications such as e-commerce, data breach, data leak, IoT attacks, attacks on digital payment systems, malicious or fake mobile apps, unauthorised access to social media accounts, attacks on cloud systems, attacks on systems related to big data, blockchain, virtual assets, robotics, drones and similar, and attacks on AI and machine learning systems.
What does this mean for engineering?
Constructed example: a SaaS firm in Pune stores application logs with a vendor in another country, retaining them for 30 days. Both the retention period and the location need review against the 180 day, in-India rule. A second gap: nobody is on call to decide within 6 hours whether a suspicious alert is a reportable incident.
What to do
- Confirm whether your entities are covered, with counsel.
- Point every server, device and container host at an approved time source and monitor drift.
- Set log retention to 180 days rolling for all ICT systems and store them in India.
- Name a point of contact and send the Annexure II details.
- Write a runbook that gets from first alert to a CERT-In report inside 6 hours, with an owner for each step.
- Map your own alert types to the Annexure I list so triage is quick.
- If you run cloud, VPS or VPN services, build the 5 year subscriber record.
Quick check
When does the 6 hour clock start?
The directions say within 6 hours of noticing the incident or being brought to notice about it.
Can logs live in a foreign region?
The directions say logs must be maintained within the Indian jurisdiction. Check with counsel before keeping the only copy elsewhere.
Sources
Last reviewed: 18 October 2026.
