CERT-In

The directions issued on 28 April 2022 set operational duties for in-scope organisations. Specified cyber incidents are reported to CERT-In within six hours of noticing them or of being notified about them. Information and communication technology logs are kept for a rolling 180 days inside India. System clocks are synchronised to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory. A point of contact is designated and kept current.

The incident list covers events such as unauthorised access, defacement, malware, denial of service, data breach, and attacks on critical systems. The exact list and the reporting format are CERT-In’s, and they change when CERT-In updates them.

The directions apply broadly to service providers, intermediaries, data centres, body corporates, and government organisations operating in India. That includes many companies with customers, infrastructure, or a legal presence in the country, even when the parent company sits elsewhere.

Virtual private network, virtual private server, and cloud service providers have additional customer-identification and log duties. If you are unsure whether a subsidiary, a SaaS platform, or a data centre in India brings you in scope, that is the first question to settle before designing the control.

We start with scope: which entities, systems, and vendors are covered, and which incidents on CERT-In’s list can actually occur in your environment. From there we map how an incident would be detected, who decides it is reportable, and how the six-hour clock is met, including nights and weekends.

We also review log sources and retention so the 180-day record exists in India, check time synchronisation, and confirm the point of contact and escalation path. Where CERT-In duties overlap ISO 27001, the DPDP Act, or sector rules, we line the evidence up so the same control is not rebuilt three times.