The CERT-In directions of 28 April 2022 require covered entities to synchronize clocks to NIC or NPL time, report listed cyber incidents within 6 hours, designate a point of contact, and keep logs of all ICT systems for a rolling 180 days within Indian jurisdiction. Evidence should prove each of those, plus extra records for certain providers.
Who do the directions cover?
The text addresses all service providers, intermediaries, data centres, body corporate and Government organisations. They were issued under sub-section (6) of section 70B of the IT Act, 2000. Read the original to decide whether and how it applies to you, and ask counsel for edge cases. This post summarizes the document itself.
What does each direction ask, and what proves it?
- Time sync. Entities must connect all ICT system clocks to the NTP servers of the National Informatics Centre or the National Physical Laboratory, or servers traceable to them. Organisations spanning several geographies may use another accurate standard time source if it does not deviate from NPL and NIC. Evidence: NTP configuration exports, a monitoring check showing offset, and a list of systems in scope.
- Incident reporting. Cyber incidents listed in Annexure I must be reported to CERT-In within 6 hours of noticing them or being notified. Reporting channels given in the text are email, phone and fax, and CERT-In publishes formats on its site. Evidence: a runbook with the 6 hour clock, a log of when the incident was noticed, the report sent and CERT-In's acknowledgment.
- Cooperation. When CERT-In orders it, entities must take action or provide information, in the format and time frame it specifies, including up to near real time. A Point of Contact must be designated and details sent in the Annexure II format, and kept updated. Evidence: the submitted PoC form, update history, and an on-call roster that reaches that person.
- Logs. Entities must enable logs of all their ICT systems and keep them securely for a rolling 180 days, within Indian jurisdiction, and provide them to CERT-In with an incident report or on order. Evidence: a log source inventory, retention settings, storage location records and a restore test.
- Subscriber records. Data centres, VPS providers, cloud service providers and VPN providers must register accurate information about subscribers, including validated names, period of hire, IP addresses, registration email and time stamp, purpose, address and contact numbers, and ownership pattern, and keep it for 5 years or longer after cancellation. Evidence: schema and sample records, and retention rules.
- Virtual asset providers. Virtual asset service providers, exchange providers and custodian wallet providers must keep KYC information and financial transaction records for 5 years, with enough detail to reconstruct individual transactions.
A constructed example: a SaaS company hosts in an Indian cloud region but ships logs to a global observability tool abroad, keeping only 30 days locally. The log item fails twice, on retention and on location. A fix is an in-country archive with 180 day retention, and a test that retrieves a sample from day 170.
How do you keep the evidence fresh?
Dated screenshots age badly. Prefer exports from the system itself, scheduled checks that write results somewhere durable, and a quarterly review with sign off. Rehearse the 6 hour report once a year so the first real attempt is not the first attempt.
Safeguard's compliance automation can help collect and organize evidence and tasks, and its dependency scanning and asset discovery can feed the log and system inventory. It does not make an organization compliant on its own.
What to do
- Decide whether you are in scope and which items apply. Record the reasoning.
- Build a system inventory and tag each system with its NTP source and log destination.
- Write the 6 hour incident procedure and confirm who files and how.
- Register your Point of Contact with CERT-In and keep the entry current.
- Set 180 day in-country log retention and test retrieval.
- If you are a data centre, VPS, cloud or VPN provider, confirm the subscriber record fields and 5 year retention.
- Store evidence with dates and owners, and review it every quarter.
Quick check
How soon must an incident be reported?
The directions say within 6 hours of noticing the incident or being brought to notice about it, for incidents listed in Annexure I.
Can logs be stored abroad?
The directions say logs must be maintained within the Indian jurisdiction for a rolling 180 days. Keep at least that copy in India.
Sources
Last reviewed: 18 October 2026.
