CERT-In's 6-Hour Reporting Rule: A Practical Checklist

What the Directions Require

On 28 April 2022, CERT-In, India's national computer emergency response team, issued directions on information security practices and incident reporting. They apply to service providers, intermediaries, data centres, body corporates and government organisations. Four obligations matter most to most enterprises.

1. Report within six hours. Incidents of the types listed in Annexure I (20 categories, from targeted scanning of systems to data breaches and attacks on cloud services) must be reported to CERT-In within six hours of noticing them or being told about them.
2. Keep logs for 180 days. Logs of all ICT systems must be enabled and kept securely for a rolling 180 days within Indian jurisdiction, and provided to CERT-In with an incident report or on request.
3. Synchronise clocks. System clocks must be synchronised to the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to sources traceable to them, so timelines line up during an investigation.
4. Name a point of contact. Each organisation must designate a point of contact to work with CERT-In and keep the details current.

When Does the Clock Start?

The six hours run from whichever comes first: your team noticing the incident, or someone bringing it to your notice. A customer email, a researcher's report or an alert from a partner can all start the clock before your security team has looked. That is why the first hour of response has to be rehearsed, not improvised.

Checklist: Before an Incident

• Name your CERT-In point of contact and a deputy, and record who decides to report.
• List every system that produces security logs and confirm 180-day retention inside India.
• Point all system clocks at NIC or NPL time sources and verify drift monthly.
• Prepare a reporting template with the facts CERT-In asks for, so writing it takes minutes.
• Agree incident response terms in advance, so responders can start immediately.
• Rehearse with a tabletop exercise at least once a year, including the reporting decision.

Checklist: The First Six Hours

• Record the time the incident was first noticed. This is your deadline anchor.
• Check the incident against the Annexure I categories and decide whether it is reportable.
• Preserve evidence: snapshot affected systems and secure logs before anything is wiped.
• Contain the spread without destroying forensic data.
• Submit the report to CERT-In, then keep updating it as facts change.

How CyberrGuard Helps

Cyber911 responders work on pre-agreed terms, contain the attack, collect evidence with a documented chain of custody and help you prepare the report. Before anything happens, our tabletop exercises rehearse the decision to report so it takes minutes, not hours.

This article summarises the directions for general information and is not legal advice. Read the full directions on CERT-In's website.