CERT-In 6-Hour Incident Reporting: A Practical Compliance Guide
What CERT-In's 2022 Directions require — 6-hour reporting, 180-day log retention in India, NIC/NPL time sync, a named point of contact — and how to operationalize them.
What the CERT-In Directions require
CERT-In's Directions of 28 April 2022, issued under Section 70B(6) of the Information Technology Act, 2000 and in force since June 2022, apply to service providers, intermediaries, data centres, body corporates and government organisations. Four obligations matter most in practice: report specified cyber incidents to CERT-In within 6 hours of noticing them; keep logs of ICT systems for a rolling 180 days, stored within India; synchronise system clocks to the NTP servers of NIC or NPL, or servers traceable to them; and designate a point of contact to interface with CERT-In.
Six hours from noticing, not from confirming
The clock starts when an incident is noticed or brought to your attention — not when an investigation concludes. The incident categories listed in the Directions are broad: targeted scanning, compromise of critical systems, unauthorised access, website defacement, malicious code such as ransomware, identity theft and phishing, data breaches and leaks, attacks on IoT devices, and attacks on cloud and AI-adjacent infrastructure among them. In practice this means a report will often be filed on partial information and updated later. Organisations without round-the-clock monitoring cannot reliably meet a six-hour window that begins at 2 a.m. on a Sunday.
Logs and time sync are the hidden work
The 180-day log requirement only helps if logs are complete, centralised and trustworthy. That means covering firewalls, identity providers, VPNs, endpoint telemetry, cloud control planes and critical applications — and storing them in India. Time synchronisation is what makes those logs usable as evidence: correlating an intrusion across systems whose clocks drift by minutes is slow and contestable. Both are typically delivered through a SIEM with defined retention and NTP configuration managed as code.
Turning the Directions into a runbook
A workable CERT-In programme has five parts: a 24/7 monitoring function that can recognise reportable categories; a decision owner empowered to file without waiting for executive sign-off; a pre-filled reporting template with your point-of-contact details; log sources and retention mapped against the 180-day requirement; and a tabletop exercise at least annually that starts the clock and measures time-to-report. Non-compliance can carry imprisonment of up to one year, a fine of up to ₹1 lakh, or both, under Section 70B(7) of the IT Act.