The rule in one sentence

Under the CERT-In directions of April 2022, service providers, intermediaries, data centres, body corporates and government organisations must report specified cyber incidents to CERT-In within six hours of noticing them.

Six hours is not long. The organisations that comply consistently are the ones that decided, in advance, who makes the call and what information goes into the first report.

What else the directions require

  • Log retention: ICT system logs must be maintained securely for a rolling 180 days within Indian jurisdiction
  • Clock synchronisation: systems must sync to the NTP servers of NIC or NPL, or to servers traceable to them
  • Point of contact: a designated contact must be registered with CERT-In
  • Information on request: you must be able to provide logs and details when CERT-In asks

Building the playbook

Step 1 — Define "noticing"

The six-hour clock starts when the incident is noticed or brought to your attention. Agree internally what that means: the first SOC alert, analyst confirmation, or a report from a vendor. Document it.

Step 2 — Pre-classify reportable incidents

CERT-In lists the incident types that must be reported, including targeted scanning of critical systems, compromise of systems, unauthorised access, website defacement, malicious code attacks such as ransomware, identity theft and data breaches. Map each to your SIEM use cases so classification is a lookup, not a debate.

Step 3 — Pre-approve the decision-makers

Name a primary and a backup approver for every hour of the week. Waiting for a CISO on a flight is the most common reason reports are late.

Step 4 — Prepare the first report template

The initial report can be updated later. Pre-fill organisation details, contacts and system inventory references so the team only adds incident specifics.

Step 5 — Rehearse

Run a tabletop at least twice a year with a realistic scenario and a stopwatch. Measure the time from first alert to submission.

Evidence that auditors look for

  1. A written incident classification matrix aligned to CERT-In categories
  2. Log retention configuration showing 180 days and Indian storage
  3. NTP configuration across servers, network devices and cloud workloads
  4. Tabletop records with timings and lessons learned

Key takeaways

  • Report specified incidents to CERT-In within six hours of noticing them.
  • Keep ICT logs for 180 days within Indian jurisdiction and sync clocks to NIC/NPL time sources.
  • Pre-classify incidents, pre-approve decision-makers and rehearse with a stopwatch.

Frequently asked questions

Who must follow the CERT-In directions?

Service providers, intermediaries, data centres, body corporates and government organisations operating in India, including organisations whose systems serve Indian users.

Does the six-hour report need full details?

No. The initial report can be filed with the information available and updated as the investigation progresses. What matters is reporting on time.

Can logs be stored in a cloud region outside India?

The directions require logs to be maintained within Indian jurisdiction. If you use cloud logging, choose Indian regions or keep an in-country copy.

Speed comes from decisions made before the incident, not during it.

Our cyber security services include SOC design, SIEM tuning and incident response retainers built around CERT-In timelines.