CERT-In Directions: 6-Hour Incident Reporting and Log Rules Explained

Since June 2022, organisations in India must report specified cyber incidents to CERT-In within six hours of noticing them, keep ICT system logs for 180 days within India and synchronise their clocks to Indian time servers. These CERT-In Directions apply widely: to service providers, intermediaries, data centres, body corporates and government organisations. This guide explains who is covered, each obligation in plain terms, what the CERT-In FAQs clarified, and how IT companies can build a compliant, practical incident reporting process.

What are the CERT-In Directions?

CERT-In, the Indian Computer Emergency Response Team, is the national agency for cyber incident response under Section 70B of the IT Act. In April 2022 it issued directions on information security practices, procedures, prevention, response and reporting of cyber incidents to strengthen India's ability to detect and investigate attacks.

Full form and definition

CERT-In stands for Indian Computer Emergency Response Team, part of the Ministry of Electronics and Information Technology. The directions are formally titled "Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe and Trusted Internet".

Law, standard or certification?

They are legally binding directions (a regulation made under a statute), not a voluntary standard. There is no certification.

History and background

CERT-In was set up in 2004 and given statutory status by the IT (Amendment) Act 2008. The CERT-In Rules 2013 already required certain incidents to be reported, but without a fixed short deadline, and many incidents went unreported. The April 2022 Directions introduced the 6-hour deadline, log retention and record-keeping duties, and came into force on 28 June 2022. CERT-In issued FAQs in May 2022 to clarify scope, and extended the deadline to 25 September 2022 for micro, small and medium enterprises and for the record-keeping duties of data centres, VPS, cloud and VPN providers.

In July 2025 CERT-In issued Comprehensive Cyber Security Audit Policy Guidelines, setting out how organisations should plan and conduct cybersecurity audits, including through CERT-In-empanelled auditors.

Why were the Directions introduced?

CERT-In found gaps in incident information and logs when analysing attacks. Delayed reporting and missing logs made it hard to coordinate responses and investigate incidents, especially those spanning multiple organisations.

Main objectives and purpose

• Get early warning of cyber incidents so CERT-In can coordinate response.
• Ensure logs exist and are available for investigation.
• Make timestamps reliable across systems through clock synchronisation.
• Enable attribution through subscriber and transaction records for certain providers.

Who needs to comply with the CERT-In Directions?

The Directions apply to service providers, intermediaries, data centres, body corporates and government organisations. In practice this includes:

• IT and IT-enabled services companies, SaaS companies and software product companies in India
• Cloud, hosting, VPS and data centre providers
• Telecom and internet service providers
• Platforms, marketplaces and other intermediaries
• Virtual asset service providers, exchanges and custodian wallet providers
• Government bodies

Geography

India. According to CERT-In's FAQs, the Directions also apply to entities outside India that provide services to users in India, in respect of those services.

Key requirements of the CERT-In Directions

1. Clock synchronisation

Connect to the NTP servers of the National Informatics Centre (NIC) or National Physical Laboratory (NPL), or to NTP servers traceable to them, to synchronise all ICT system clocks. Entities operating across jurisdictions may use other accurate time sources, provided they do not deviate from NPL and NIC time.

2. Incident reporting within 6 hours

Report the cyber incidents listed in Annex I of the Directions within six hours of noticing them or being notified about them. The list includes, among others:

• Targeted scanning or probing of critical networks and systems
• Compromise of critical systems or information
• Unauthorised access to IT systems or data
• Website defacement or intrusion
• Malicious code attacks such as viruses, worms, ransomware and cryptominers
• Attacks on servers (database, mail, DNS) and network devices
• Identity theft, spoofing and phishing attacks
• Denial of service and distributed denial of service attacks
• Attacks on critical infrastructure, SCADA, operational technology and wireless networks
• Attacks on applications such as e-governance, e-commerce and digital payment systems
• Data breaches and data leaks
• Attacks on IoT devices and cloud computing systems
• Fake or malicious mobile apps and unauthorised access to social media accounts
• Attacks on systems related to big data, blockchain, virtual assets, AI and machine learning

Reports can be submitted by email, phone or through CERT-In's website using the prescribed format. The FAQs clarify that the initial report can be submitted with the information available within 6 hours, with details shared later.

3. Point of contact

Designate a point of contact to interface with CERT-In and share their details in the prescribed format, keeping them updated.

4. Information on request

Provide information or assistance requested by CERT-In for response, protective or preventive action within the time specified in the request.

5. Log retention

Enable logs of all ICT systems and maintain them securely for a rolling period of 180 days within Indian jurisdiction, and provide them to CERT-In when asked as part of an incident. The FAQs indicate that logs may be stored outside India as long as the obligation to produce them within the specified time is met; many organisations choose to keep a copy in India to remove any doubt.

6. Subscriber records for certain providers

Data centres, virtual private server providers, cloud service providers and VPN service providers must register and keep for at least five years after cancellation or withdrawal of registration: validated subscriber names, period of hire, allotted IPs, email and IP addresses with timestamps used at registration, purpose, validated address and contact numbers, and ownership pattern. The FAQs clarify this does not apply to enterprise VPNs used internally by an organisation.

7. Virtual asset providers

Virtual asset service providers, exchanges and custodian wallet providers must keep KYC and financial transaction records for five years.

How to comply: step by step

1. Confirm applicability and which special duties (subscriber records, virtual assets) apply to you.
2. Appoint a point of contact and register with CERT-In.
3. Synchronise clocks on servers, network devices, cloud resources and endpoints to compliant NTP sources.
4. Inventory log sources: firewalls, VPNs, servers, applications, databases, cloud control planes, identity providers, endpoints and SaaS tools.
5. Centralise logging with 180-day retention, integrity protection and the ability to export quickly.
6. Write a 6-hour reporting procedure: detection, triage, decision on reportability, approval and submission, available 24x7.
7. Prepare reporting templates with the fields CERT-In requires.
8. Update contracts with cloud and managed service providers so they notify you quickly and supply logs.
9. Test the process with tabletop exercises that start the 6-hour clock.
10. Combine reporting duties: align with sector regulators (RBI, SEBI, IRDAI) and, from 13 May 2027, the DPDP Act breach notifications.

Documentation required

• Point of contact registration
• Incident response plan with CERT-In reporting procedure
• Incident register, including submitted reports and timestamps
• Logging standard and log source inventory
• Evidence of 180-day retention and NTP configuration
• For covered providers: subscriber record-keeping procedure and records
• Contracts and SLAs with service providers covering notification and log access

Audit and assessment requirements

The Directions do not require a certificate. CERT-In can request information and logs, and may audit or investigate. Government and regulated entities usually undergo security audits by CERT-In-empanelled auditors, following CERT-In's audit guidelines. Sector regulators also check incident reporting compliance in their inspections.

Estimated implementation timeline

• Point of contact, NTP and reporting procedure: 2 to 4 weeks
• Centralised logging with 180-day retention: 4 to 8 weeks, depending on log sources
• Subscriber record systems for cloud and VPN providers: 1 to 3 months

Cost considerations

• Log storage for 180 days, which can be significant for high-volume systems
• SIEM or log management licences
• 24x7 monitoring, in-house or through a managed security service
• Engineering time for NTP and log integrations

Benefits of compliance

• Avoiding criminal penalties under Section 70B(7).
• Faster detection and better forensic readiness.
• Better incident coordination with CERT-In and threat intelligence.
• Evidence for client and regulator security reviews.

Risks and consequences of non-compliance

• Imprisonment of up to one year, a fine of up to INR 1 lakh, or both, under Section 70B(7) of the IT Act.
• Regulatory action by sector regulators that require CERT-In reporting.
• Inability to investigate incidents without logs, increasing the damage.

Common mistakes

• No 24x7 coverage, so incidents found on Friday night are reported on Monday.
• Logs from SaaS tools and cloud control planes not collected.
• Retention set to 30 or 90 days by default.
• Clocks synchronised to arbitrary public NTP pools.
• Waiting for a full investigation before the initial report.
• Assuming the Directions apply only to large companies.

Challenges for IT companies

• Deciding quickly whether an event is a reportable incident.
• Coordinating reporting with clients when you operate their systems.
• Log volume and storage cost.
• Multiple reporting clocks: CERT-In 6 hours, sector regulators and the DPDP Board.

Best practices and recommendations

• Pre-agree with leadership who can approve a CERT-In report at any hour.
• Define reportability criteria with examples to speed decisions.
• Store logs in a write-once or tamper-evident store.
• Use NIST CSF Detect and Respond outcomes and CIS Control 8 to structure logging.
• Run incident drills twice a year.

Tools and technologies that help

• SIEM and log management platforms with Indian data regions
• Managed detection and response services with 24x7 monitoring
• NTP configuration management
• Incident management and case tracking tools
• Immutable storage for log archives

Relationship with other compliance frameworks

CERT-In Directions and related requirements

Framework	Relationship
IT Act 2000	The Directions are issued under Section 70B(6)
DPDP Act	Separate personal data breach reporting to the Board and individuals from 13 May 2027
ISO 27001	Incident management, logging and clock synchronisation controls support compliance
NIST CSF	Respond and Detect functions provide a structure
CIS Controls	Audit log management and incident response Controls

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

SaaS company

A SaaS company added logs from its identity provider, cloud control plane and code repository to its SIEM, set 180-day retention in an Indian region and created an on-call rota with authority to file CERT-In reports.

Cloud and VPS provider

A VPS provider built validated customer onboarding with identity and address checks, stored subscriber and IP allocation records for five years after account closure and automated their export.

Frequently asked questions

What is the CERT-In 6-hour rule?

Covered entities must report listed cyber incidents to CERT-In within six hours of noticing them or being told about them.

Who must comply with the CERT-In Directions?

Service providers, intermediaries, data centres, body corporates and government organisations, including IT and SaaS companies.

How long must logs be kept?

For a rolling 180 days, maintained securely within Indian jurisdiction, and provided to CERT-In on request.

Which NTP servers must we use?

Those of NIC or NPL, or NTP servers traceable to them.

Do we need a full report within 6 hours?

No. CERT-In's FAQs indicate that the initial report should include available information, with further details provided later.

Do the Directions apply to foreign companies?

According to CERT-In's FAQs, they apply to entities providing services to users in India, in respect of those services.

What are the penalties for non-compliance?

Imprisonment of up to one year, a fine of up to INR 1 lakh, or both, under Section 70B(7) of the IT Act.

Do enterprise VPNs need to keep subscriber records?

No. The FAQs clarify that subscriber record keeping applies to VPN service providers offering services to the public, not enterprise VPNs used internally.

How do we report an incident to CERT-In?

By email, phone or through the CERT-In website, using the incident reporting format published by CERT-In.

Does the DPDP Act replace CERT-In reporting?

No. Both apply. A data breach may need a CERT-In report within 6 hours and DPDP notifications to the Board and individuals.

Conclusion and next steps

The CERT-In Directions are short but operationally demanding. The key is round-the-clock readiness: synchronised clocks, complete logs and a reporting process that works at any hour.

1. Register a point of contact.
2. Synchronise clocks to compliant NTP servers.
3. Centralise logs with 180-day retention.
4. Build and test a 6-hour reporting procedure.
5. Align with DPDP and sector reporting.

This guide is general information, not legal advice. Refer to the official Directions and FAQs on the CERT-In website.

How we keep this guide up to date

We review this guide every six months and whenever CERT-In issues new directions, FAQs, reporting formats or audit guidelines.