By the VD Hosts team 3 min read
On 28 April 2022, the Indian Computer Emergency Response Team (CERT-In) issued directions under section 70B(6) of the Information Technology Act, 2000, relating to information security practices and reporting of cyber incidents. They took effect in June 2022 and remain one of the most practical obligations for any company running digital services in India, including banks, NBFCs, payment companies and fintechs.
This guide explains the key requirements and turns them into a checklist you can use before an incident happens. It is general information; read the official text on cert-in.org.in and confirm your obligations with counsel.
The four requirements most teams need to act on
1. Report within six hours
Specified types of cyber incidents must be reported to CERT-In within six hours of noticing them or being told about them. The Directions list the incident types, including targeted scanning of critical networks, compromise of systems or data, unauthorised access, website defacement, malicious code such as ransomware, attacks on servers, identity theft and phishing, data breaches and data leaks, and attacks on applications, cloud and IoT devices, among others. Reports are made through the channels CERT-In specifies.
2. Keep logs for 180 days, in India
Logs of all ICT systems must be enabled and maintained securely for a rolling period of 180 days within Indian jurisdiction, and provided to CERT-In when asked.
3. Synchronise clocks
System clocks must be synchronised to the Network Time Protocol servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to servers traceable to them. Without consistent time, logs from different systems cannot be correlated during an investigation.
4. Name a point of contact
Organisations must designate a point of contact to interface with CERT-In, and share their details in the format CERT-In specifies.
Why six hours is harder than it sounds
An incident noticed at 11 p.m. on a Friday has to be reported by 5 a.m. on Saturday. Meeting that needs three things to already be in place:
- Detection: alerts that reach a person who can act, at any hour.
- Decision rights: a named person who can decide that an event is reportable without waiting for a meeting.
- A prepared report: a template with the information CERT-In asks for, so the first report is fast even if incomplete.
Regulated entities usually have parallel reporting duties, for example to the RBI or SEBI under their own frameworks, and personal data breaches have separate notification duties under the Digital Personal Data Protection Act, 2023. A single playbook that covers all of them avoids confusion when it matters.
Readiness checklist
| Item | Done? |
|---|---|
| Incident response plan names an incident lead, a decision-maker for reporting, and deputies for both | ☐ |
| The plan lists the CERT-In incident types and maps them to your own alert categories | ☐ |
| A report template with the fields CERT-In asks for is ready and stored where on-call staff can find it | ☐ |
| Point of contact designated and shared with CERT-In | ☐ |
| Logging enabled on servers, firewalls, VPNs, cloud accounts, applications and identity systems | ☐ |
| Logs retained for at least 180 days, within India, protected from tampering | ☐ |
| All systems synchronised to NIC/NPL NTP servers or traceable sources | ☐ |
| Contracts with cloud and IT vendors require them to notify you quickly enough for you to meet six hours | ☐ |
| Parallel reporting duties (RBI/SEBI/IRDAI, DPDP Act) included in the same playbook | ☐ |
| A tabletop exercise run in the last 12 months, including an out-of-hours scenario | ☐ |
Vendors are part of your clock
Many incidents start at a supplier: a managed service provider, a cloud account, a payment or KYC partner. If your vendor takes a day to tell you, you cannot meet six hours. Review incident notification clauses in vendor contracts, and require access to the logs you would need to investigate.
How VD Hosts can help
We help fintechs, NBFCs and other companies prepare: logging and monitoring design, incident response plans and tabletop exercises, cloud configuration reviews covering log retention in Indian regions, and security testing that reduces the chance of an incident in the first place.
Common questions
Who must follow the CERT-In Directions?
What counts as "noticing" an incident for the six hours?
Can we report with incomplete information?
Where do logs have to be stored?
This article is general information, not legal or regulatory advice. Check the current official texts and take professional advice for your situation. See our Website Disclaimer.
