Six hours from the moment you notice, not from the moment you understand. Twenty reportable categories, criminal liability attached, and a separate clock running for every other regulator you answer to.
- India
- CERT-In
- Incident response
- Regulatory
The short answer
CERT-In Directions dated 28 April 2022, effective 27 June 2022, require organisations in India to report any of twenty specified cyber security incident categories within six hours of noticing them. Non-compliance is an offence under Section 70B(7) of the IT Act carrying up to one year of imprisonment, a fine up to one lakh rupees, or both. Logs must be retained in India for 180 days.
Most incident response processes take six hours just to confirm something real has happened. That is the problem this rule creates, and the reason preparation matters more here than in almost any other regime.
On this page
This is not legal advice. CERT-In obligations are statutory and their application depends on your entity type, sector and the specific facts of an incident. Confirm your position with qualified Indian counsel before relying on any summary, including this one.
When the clock starts
Six hours from noticing the incident or being brought to notice about it. Not six hours from confirming it, not from completing triage, and not from the point somebody senior agrees it is serious.
That distinction is where most organisations get caught. A mature response process typically spends the first few hours establishing whether an alert is real, looping in stakeholders and drafting an internal situation report. By the time that finishes, the regulatory deadline can already have passed.
What counts as reportable
The 2013 CERT-In Rules listed ten mandatorily reportable incident types. The 2022 Directions expanded that to twenty, and the expansion is where teams get exposed, because several of the added categories are events people would not instinctively treat as a breach.
Obvious ones
Targeted scanning of critical systems, compromise of critical systems, unauthorised access to data, website defacement, malware and ransomware.
Less obvious ones
Attacks on servers and network devices, identity theft and phishing, denial of service, attacks on applications and databases, data breach and data leak.
Easily missed
Incidents affecting IoT devices, cloud systems, big data platforms, blockchain and virtual assets, robotics and drones, and systems related to digital payments.
Under-reporting is a violation, not a judgment call. Deciding an incident was too minor to report is itself a compliance risk. Train the team to recognise all twenty categories rather than the handful that feel serious.
What you file in six hours
The six-hour report is an initial notification, not an investigation. You are not expected to produce root cause, complete impact assessment or attribution in that window, and attempting to will make you late.
| Field | What to put |
|---|---|
| Incident category | Which of the reportable types this falls under |
| Detection timestamp | When it was noticed, synchronised to the designated time source |
| Affected systems | Named systems and their function, as currently understood |
| Estimated scope | A best current estimate, marked as preliminary |
| Point of contact | A named person who can be reached, not a shared inbox |
| Initial containment | What you have already done to limit the incident |
Reports go to CERT-In by the channels published in the Directions. Have the submission route tested and the contact details current before an incident, not during one.
The two obligations that come with it
Reporting is the visible requirement. Two others in the same Directions are discovered by many organisations only during an inspection.
180 days of logs, held in India
Logs of all ICT systems must be enabled, maintained securely and retained for a rolling 180 days within Indian jurisdiction. If your logging stack ships everything to a region outside India by default, that is a configuration problem worth finding now.
Synchronised time
ICT systems must be synchronised to the designated network time source. This sounds administrative until you need to correlate events across systems during an investigation and the timestamps do not line up.
The other clocks running
CERT-In is one obligation triggered by an incident, not the only one. Depending on what you do and who your customers are, the same event can start several timers at once.
Getting ready before you need it
- Name the person who can file at 3amAnd a backup, with the CERT-In submission route tested
- Write the six-hour report as a template nowSix fields, pre-filled where possible, blanks for the rest
- Check where your logs physically live180 days, in India, is a hosting question before it is a policy one
- Synchronise every system to the designated time sourceIncluding anything running outside your main cloud account
- Train on all twenty categories, not the obvious fiveThe gap is usually cloud, payments and IoT incidents
- Map every clock the same incident startsOne intake, fanning out to each regulator that applies to you
Where Osto helps
Detection speed is what makes a six-hour window survivable. Osto correlates events across web protection, cloud posture, endpoint and code security in one platform, so an incident surfaces as a single picture rather than four separate alerts somebody has to assemble.
Log retention and time synchronisation are configuration questions we cover during assessment, and both are common findings in Indian environments built on default cloud settings.
Check your six-hour readiness
A free assessment reviews detection coverage, log retention location and time synchronisation against the CERT-In Directions.
Frequently asked questions
What is the CERT-In 6-hour rule?
Under Directions issued on 28 April 2022 and effective from 27 June 2022, any service provider, intermediary, data centre, body corporate or government organisation in India must report specified cyber security incidents to CERT-In within six hours of noticing the incident or being made aware of it. The Directions were issued under Section 70B(6) of the Information Technology Act, 2000.
What is the penalty for not reporting to CERT-In?
Failure to comply with a CERT-In direction is an offence under Section 70B(7) of the IT Act, carrying imprisonment of up to one year, a fine of up to one lakh rupees, or both. Section 70B(8) provides that no court takes cognisance unless a complaint is made by a CERT-In officer. Proposed amendments have sought to raise the financial penalty substantially.
How many types of incidents must be reported to CERT-In?
The 2022 Directions expanded the list of mandatorily reportable incident categories from the original ten under the 2013 CERT-In Rules to twenty. Under-reporting is treated as seriously as not reporting, so teams need to recognise all twenty categories rather than only the obvious breach scenarios.
Does the 6-hour clock start at detection or at confirmation?
At the point the incident is noticed or brought to your attention, not when investigation concludes. This is the most commonly misunderstood part of the rule. You are not expected to have root cause, full impact assessment or attribution within six hours.
How does CERT-In compare to GDPR and DPDP timelines?
CERT-In is considerably tighter. GDPR allows 72 hours to notify a supervisory authority, and the DPDP framework works to a comparable window for the detailed Board report. CERT-In requires six hours, which is among the shortest statutory incident reporting windows anywhere.
What are the log retention requirements under CERT-In?
The Directions require organisations to enable logs of all ICT systems and maintain them securely for a rolling period of 180 days within Indian jurisdiction. Systems must also be synchronised to a designated network time source, so timestamps across systems are consistent during an investigation.
Do CERT-In and DPDP obligations run at the same time?
Yes. They are separate obligations with separate clocks and separate recipients, both triggered by the same event. Sector regulators may add further reporting duties. Building one intake process that fans out to every applicable regulator is more reliable than treating each as a distinct workflow.
Related reading: DPDP Act explained · SOC 2 readiness checklist
Accuracy and legal note: This guide summarises the CERT-In Directions No. 20(3)/2022 dated 28 April 2022, effective 27 June 2022, issued under Section 70B(6) of the Information Technology Act, 2000, and related provisions, current to August 2026. It is general information and not legal advice. Applicability, incident classification and penalties depend on entity type, sector and specific facts. Proposed legislative amendments may alter penalty levels. Consult qualified Indian counsel on your obligations.