CERT-In 6-hour incident reporting: a practical guide
Reviewed against the law as of 28 September 2026
CERT-In's April 2022 Directions: report cyber incidents within 6 hours, keep 180 days of logs in India, sync to NIC/NPL time. A step-by-step guide.
On 28 April 2022, the Indian Computer Emergency Response Team (CERT-In) issued directions under section 70B(6) of the Information Technology Act, 2000. They took effect sixty days later and apply to service providers, intermediaries, data centres, body corporates and government organisations. The best known is the six-hour incident reporting deadline, but there are five duties in total.
The five core duties
- Report within six hours. Report the cyber incidents listed in Annexure I of the Directions within six hours of noticing them or being told about them.
- Keep logs for 180 days in India. Enable logs on all ICT systems and keep them securely for a rolling period of 180 days within Indian jurisdiction, and provide them to CERT-In when asked.
- Synchronise clocks. Connect to the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or servers traceable to them, so that timestamps line up across organisations.
- Designate a point of contact. Nominate a person to interface with CERT-In and keep the details updated.
- Respond to requests. Provide information and assistance when CERT-In asks, within the time it specifies.
Data centre, VPS, cloud and VPN providers, and virtual asset service providers, also have record-keeping duties of five years.
Which incidents are reportable
Annexure I lists twenty types of incident. They include:
- targeted scanning or probing of critical networks and systems;
- compromise of critical systems or information;
- unauthorised access to IT systems or data;
- defacement of or intrusion into websites;
- malicious code attacks such as ransomware, viruses and worms;
- attacks on servers such as databases, mail and DNS, and on network devices;
- identity theft, spoofing and phishing;
- denial of service attacks;
- attacks on critical infrastructure, SCADA and operational technology;
- attacks on applications such as e-governance and e-commerce;
- data breaches and data leaks;
- attacks on IoT devices, digital payment systems, cloud systems, and AI or machine learning systems;
- fake mobile apps and unauthorised access to social media accounts.
Read the Annexure itself for the full list and wording.
A six-hour playbook
| Time | Action |
|---|---|
| 0:00 | Incident noticed. Record the time and who noticed it. |
| 0:15 | Incident lead assigned; decide whether it matches an Annexure I category. |
| 0:30 | Pull what you know: affected systems, first indicators, whether personal data is involved. |
| 2:00 | Draft the report in CERT-In's format; the point of contact reviews it. |
| 4:00 | Approval by the named approver. |
| Before 6:00 | Submit to CERT-In through its published reporting channels; keep the acknowledgement. |
| Later | Send updates as the investigation progresses. |
Report what you know. The Directions expect timely reporting, not a finished investigation.
Where organisations struggle
- Logs in the wrong place. Logs in a region outside India, or kept for 30 or 90 days by default, fail the 180-day rule.
- Clock drift. Servers using public NTP pools rather than NIC or NPL, or containers with unsynchronised clocks.
- Unclear triggers. No one owns the decision that an event is reportable, so the clock runs out in discussion.
- Personal data blind spots. A data breach under CERT-In may also be a personal data breach under the DPDP Act, with its own notification duties.
How TrustNiq helps
TrustNiq tests log retention and location against the 180-day rule, checks time synchronisation, records the point of contact, and runs the six-hour clock from the moment an incident is logged, with a draft CERT-In report built from the affected assets. See also log retention under CERT-In and DPDP.
Frequently asked questions
When does the six-hour clock start?
From the time the incident is noticed or brought to your notice, not from the time it began or was fully investigated. Report what you know within six hours and update later.
Who must follow the CERT-In Directions?
Service providers, intermediaries, data centres, body corporates and government organisations. In practice this covers most companies operating IT systems in India.
What is the penalty for not complying?
Non-compliance with directions under section 70B of the IT Act can lead to imprisonment of up to one year, a fine of up to one lakh rupees, or both.
Do cloud and VPN providers have extra duties?
Yes. Data centres, VPS, cloud and VPN service providers must keep validated subscriber details, such as names, hire period, allotted IP addresses, contact details and purpose, for five years or longer if law requires.
Sources
- CERT-In Directions under section 70B(6) of the IT Act, 28 April 2022cert-in.org.in
- CERT-In websitecert-in.org.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.