CERT-In direction (i) says to synchronise all ICT system clocks with the NTP servers of NIC or NPL, or servers traceable to them. The FAQ says you do not have to switch to Indian Standard Time, and cloud users may keep the native cloud time service, provided accuracy is maintained.
What the direction says
Service providers, intermediaries, data centres, body corporate and government organisations must connect to the NTP server of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to servers traceable to them. Organisations with infrastructure in several geographies may use another accurate and standard source, as long as it does not deviate from NPL and NIC.
What the FAQ clears up
- Clocks do not have to be set to IST. NTP delivers UTC, and local time conversion happens on the host.
- Sources other than NPL and NIC are acceptable if the time source conforms to the time provided by them.
- Cloud customers may use the time service native to their cloud, or run their own NTP server in the cloud.
- If you run your own NTP service that syncs to something other than the native cloud service, then NPL, NIC or another accurate standard source may be used, as long as accuracy is maintained.
The FAQ lists the servers: samay1.nic.in and samay2.nic.in for NIC, and time.nplindia.org for NPL. Check the current FAQ before you hard code them.
Why it connects to logging
The FAQ explains the purpose: consistent time is what lets investigators line up events across systems. If your application log, load balancer log and identity provider log disagree by minutes, a 6 hour incident report becomes guesswork. The 180 day log rule and this one belong in the same runbook.
Containers and managed services
Containers normally inherit the host clock, so fixing the host fixes the container. Managed databases and serverless platforms use the provider's time, so for those you rely on the provider's source and note that in your control record. The point is to know the answer for each class of system before an auditor asks.
A simple configuration check
- List where time comes from: cloud default, your own NTP servers, or device defaults.
- For each, write down the upstream source and who owns it.
- For self run NTP, add NIC or NPL servers, or a source you can show does not deviate from them.
- Alert on drift. A clock offset alarm costs little.
- Record the decision in a short control note so an auditor sees why the cloud time service is your chosen source.
An example of a self run config line in chrony syntax is below. Use your own tooling and verify the server names first.
server samay1.nic.in iburst
server samay2.nic.in iburst
server time.nplindia.org iburst
Quick check
Do we have to run servers in IST?
No. The FAQ says there is no need to set system clocks to IST.
Can we keep the cloud provider time service?
The FAQ says entities relying on native cloud time services may continue to use them. Keep evidence that the time is accurate.
Sources
Last reviewed: 19 October 2026.
