CERT-In Directions 2022: 6-Hour Reporting, 180-Day Logs and Compliance

The CERT-In Directions of 28 April 2022 are some of the most concrete cyber security obligations in Indian law. They tell almost every company operating in India to report specified cyber incidents to CERT-In within six hours of noticing them, to keep logs of all ICT systems for a rolling 180 days within Indian jurisdiction, to synchronise system clocks to national time servers, and to name a point of contact. Data centres, cloud, VPS and VPN providers carry extra duties to record and keep customer details for five years.

This guide is based on the text of the Directions, the June 2022 extension notice and CERT-In's own FAQs. It explains who is covered, each direction in turn, the 20 reportable incident types, what "within Indian jurisdiction" means for logs, how to build a reporting process that can meet a six-hour deadline, and how the Directions interact with the DPDP Act, sector regulators and client contracts.

What are the CERT-In Directions?

CERT-In, the Indian Computer Emergency Response Team, is the national agency for cyber incident response, appointed under section 70B of the Information Technology Act, 2000. Section 70B(6) gives it power to call for information and give directions to service providers, intermediaries, data centres, body corporates and any other person to carry out its functions. Using that power, CERT-In issued Directions No. 20(3)/2022-CERT-In on 28 April 2022, titled "Directions relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe and Trusted Internet".

The Directions contain six numbered directions and three annexures: Annexure I lists the incident types that must be reported, Annexure II gives the point of contact format, and Annexure III lists KYC documents for virtual asset service providers. CERT-In also published a detailed FAQ in May 2022, which it describes as explanatory and not a legal document, but which clarifies how it reads the Directions.

History and why the Directions were introduced

CERT-In has existed since 2004 and was given statutory status by the 2008 amendment to the IT Act. Its functions and incident reporting duties were set out in the CERT-In Rules, 2013, which already listed incident types that must be reported. In practice, reporting was inconsistent, and the Directions note that information needed for analysis and investigation was often not available or not readily available with service providers, data centres and body corporates.

The Directions were issued to fix that: a fixed reporting window, a guaranteed log trail, comparable timestamps across systems, and records that let investigators trace who used a server or VPN. A draft was discussed with stakeholders in March 2022. The Directions took effect 60 days after issue, on 27 June 2022. A notice dated 27 June 2022 extended the date to 25 September 2022 for micro, small and medium enterprises, and for the requirement on data centres, VPS, cloud and VPN providers to keep validated customer names, addresses and contact numbers.

Who must comply?

The Directions apply to service providers, intermediaries, data centres, body corporates and government organisations. "Body corporate" is defined in the IT Act as any company, including a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities. That covers almost every business, including IT services companies, software and SaaS firms, e-commerce companies and startups.

On foreign companies, CERT-In's FAQs say the Directions apply to any entity in the matter of cyber incidents, referring to sections 1 and 75 of the IT Act, and that service providers offering services to users in India must designate a point of contact even without a physical presence. FAQs also confirm that incidents affecting an entity's data stored in a third party's systems must be reported, and that reporting is a statutory duty that overrides confidentiality clauses in contracts (by virtue of section 81 of the IT Act).

Some directions apply only to specific types of provider: direction (v) to data centres, VPS providers, cloud service providers and VPN service providers, and direction (vi) to virtual asset service providers, exchanges and custodian wallet providers.

The six directions explained

Direction (i): clock synchronisation

All ICT system clocks must be synchronised to the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to NTP servers traceable to them. Entities with infrastructure in several countries may use another accurate and standard time source, as long as it does not deviate from NIC and NPL time. CERT-In's FAQs add that customers in cloud environments may continue to use the cloud provider's native time service, and that there is no requirement to set clocks to Indian Standard Time. The NIC servers listed in the FAQs are samay1.nic.in and samay2.nic.in, and NPL's is time.nplindia.org.

Direction (ii): six-hour incident reporting

Service providers, intermediaries, data centres, body corporates and government organisations must report the incidents listed in Annexure I to CERT-In within six hours of noticing them or being brought to notice about them. Reports go by email to incident@cert-in.org.in, by phone or by fax, using the formats on CERT-In's website. The FAQs say you may report the information available at the time and send the rest later within a reasonable time, and that incidents meeting these criteria in particular should be reported within six hours: severe incidents (such as DoS, DDoS, intrusion, or the spread of ransomware) on public information infrastructure; data breaches or data leaks; large-scale or most frequent incidents such as intrusion into computer resources or websites; and incidents affecting human safety.

Direction (iii): information on request and a point of contact

When CERT-In orders or directs, entities must act or provide information or assistance in the format and timeframe specified, which may be up to near real-time. Every entity must designate a Point of Contact and send their name, designation, organisation, address, email, mobile and phone numbers to CERT-In in the Annexure II format, keeping the details updated. All CERT-In communications go to this person.

Direction (iv): logs for 180 days

Entities must enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days within the Indian jurisdiction, and provide them to CERT-In with an incident report or when directed. The FAQs give examples of logs depending on the sector: firewall, intrusion prevention, SIEM, web, database, mail, FTP and proxy servers, event logs of critical systems, application logs, ATM switch logs, SSH and VPN logs, and others. On location, the FAQs say logs may also be stored outside India as long as the obligation to produce them to CERT-In within a reasonable time is met, while service providers offering services to users in India need to maintain logs in Indian jurisdiction. Requests for logs come from a CERT-In officer not below the rank of Deputy Secretary.

Direction (v): customer records for data centre, VPS, cloud and VPN providers

These providers must register and keep, for five years or longer if law requires after a registration is cancelled or withdrawn, accurate information on: validated names of subscribers or customers; period of hire with dates; IPs allotted or used; email address, IP address and timestamp used at registration; purpose for hiring the services; validated address and contact numbers; and ownership pattern of the customer. The FAQs clarify that "VPN service provider" here means an entity providing internet proxy-like services to general internet users, not a company's own VPN for its staff.

Direction (vi): virtual asset service providers

Virtual asset service providers, exchanges and custodian wallet providers must keep all KYC information and records of financial transactions for five years, with enough detail to reconstruct individual transactions, including IP addresses with timestamps and time zones, transaction IDs, public keys or equivalent identifiers, accounts involved, nature, date and amount.

The 20 reportable incident types (Annexure I)

1. Targeted scanning or probing of critical networks or systems.
2. Compromise of critical systems or information.
3. Unauthorised access of IT systems or data.
4. Defacement of a website or intrusion into a website and unauthorised changes, such as inserting malicious code or links to external websites.
5. Malicious code attacks such as viruses, worms, Trojans, bots, spyware, ransomware and cryptominers.
6. Attacks on servers such as database, mail and DNS, and network devices such as routers.
7. Identity theft, spoofing and phishing attacks.
8. Denial of service and distributed denial of service attacks.
9. Attacks on critical infrastructure, SCADA and operational technology systems and wireless networks.
10. Attacks on applications such as e-governance and e-commerce.
11. Data breach.
12. Data leak.
13. Attacks on Internet of Things devices and associated systems, networks, software and servers.
14. Attacks or incidents affecting digital payment systems.
15. Attacks through malicious mobile apps.
16. Fake mobile apps.
17. Unauthorised access to social media accounts.
18. Attacks or malicious or suspicious activities affecting cloud computing systems, servers, software or applications.
19. Attacks or malicious or suspicious activities affecting systems related to big data, blockchain, virtual assets, virtual asset exchanges, custodian wallets, robotics, 3D and 4D printing, additive manufacturing and drones.
20. Attacks or malicious or suspicious activities affecting systems, servers, software or applications related to artificial intelligence and machine learning.

How to comply, step by step

1. Register a point of contact with CERT-In using the Annexure II format, with a backup person, and keep the details current.
2. Decide who can report, and give them authority to report within six hours without waiting for management sign-off or a client's permission.
3. Write an incident triage procedure that maps alerts to the Annexure I types and starts the six-hour clock from the moment an incident is noticed.
4. Prepare the CERT-In incident reporting form template with fixed details already filled in.
5. Enable logging on all ICT systems: cloud audit logs, identity provider and SSO logs, firewalls and WAFs, VPNs, servers, databases, applications, email and endpoints.
6. Centralise logs with 180-day retention in a store you control, with integrity protection and access control, in Indian jurisdiction where the Directions require it.
7. Configure time synchronisation to NIC or NPL servers, or to a cloud native time service, and check drift.
8. For data centre, cloud, VPS or VPN businesses, add customer validation and the direction (v) fields to onboarding, with five-year retention.
9. Add the duty to client contracts: tell clients that statutory reporting to CERT-In will happen, and agree how you will notify them in parallel.
10. Rehearse with a tabletop exercise that measures the time from detection to report.

Documentation and records required

• Point of contact registration sent to CERT-In, and updates.
• Incident response and reporting procedure, including the six-hour process.
• Copies of incident reports sent to CERT-In and later updates.
• Log management policy and evidence of 180-day retention for each ICT system.
• Time synchronisation configuration.
• For direction (v) providers: customer records with the required fields, kept for five years.
• For direction (vi) providers: KYC and transaction records kept for five years.

Audits and enforcement

There is no certification. CERT-In can direct entities to provide information, and non-compliance is punishable under section 70B(7) of the IT Act with imprisonment for up to one year, a fine of up to one lakh rupees, or both. CERT-In's FAQs say this power will be exercised reasonably and when non-compliance is deliberate. Sector regulators include CERT-In reporting in their own requirements: SEBI's Cybersecurity and Cyber Resilience Framework and the RBI's IT governance direction, for example, expect regulated entities to report incidents to CERT-In as well as to the regulator. Clients increasingly audit vendors for CERT-In readiness.

Timeline and cost considerations

The Directions have applied since June 2022 (September 2022 for MSMEs), so there is no transition period left. The main costs are log storage and management for 180 days across all systems, a SIEM or log platform, time synchronisation work, staff time for incident triage and reporting, and, for infrastructure providers, customer verification during onboarding. For many small companies, the largest cost is moving from scattered logs with short default retention to a central store.

Benefits and consequences of non-compliance

Good logs and synchronised clocks are what make incident investigation possible, so compliance improves your own ability to understand and recover from attacks. A tested six-hour process also helps you meet the 72-hour breach reporting in the DPDP Rules, the GDPR and sector rules.

Non-compliance can be prosecuted under section 70B(7). It can also breach client and regulator requirements, and a failure to report a breach can compound liability under other laws.

Common mistakes and challenges for IT companies

• Default log retention. Many cloud services keep logs for days or weeks by default. Export them to a store with 180-day retention.
• Logs from SaaS tools left out. Identity provider, email, code hosting and ticketing logs are ICT system logs too.
• Waiting for full facts before reporting. The FAQs allow partial information within six hours and updates later.
• Waiting for the client's permission. Statutory reporting overrides contractual confidentiality; agree parallel client notification in advance.
• No backup point of contact. A six-hour window does not wait for one person's holiday.
• Clock drift between on-premises systems and cloud services, which makes timelines unreliable.
• Treating CERT-In as the only report. The DPDP Board, sector regulators and clients may each need their own notice.

Best practices, tools and technologies

• Use a central log platform or SIEM with tiered storage, so 180 days is affordable.
• Protect logs from tampering: write-once storage, separate accounts and restricted access.
• Alert on the Annexure I scenarios that apply to you: unauthorised access, malware, data exfiltration, website changes, DDoS.
• Pre-fill reporting templates and keep them in your incident runbook.
• Combine the CERT-In process with your ISO/IEC 27001 incident management controls.
• Include application logs in the plan: authentication events, admin actions, data exports and permission changes.

We set up logging, alerting and log retention for client applications as part of maintenance and support, and add audit logs to products in development projects.

How the CERT-In Directions relate to other rules

Law or framework	Relationship
IT Act, 2000	Section 70B is the legal basis; section 70B(7) is the penalty.
DPDP Act and Rules	Separate duty to report personal data breaches to the Data Protection Board and individuals, with a 72-hour detailed report; one-year log retention for some purposes.
SEBI CSCRF and RBI directions	Sector rules that also require incident reporting and log management, often with their own timelines.
ISO/IEC 27001	Annex A controls on logging (8.15), clock synchronisation (8.17) and incident management (5.24 to 5.28) align with the Directions.
NIST CSF	Detect and Respond functions cover the capabilities the Directions rely on.

Real-world implementation examples

When the Directions were issued, several VPN providers announced they would remove servers from India rather than meet the customer record requirements, which shows how direction (v) changed business decisions for infrastructure providers. Large cloud providers published notes for customers on time synchronisation and log retention in their Indian regions.

An illustrative case for a SaaS company in Bengaluru: its error tracker shows a burst of logins from unfamiliar IPs to admin accounts. The on-call engineer classifies it as possible unauthorised access (Annexure I item iii), the security lead files an initial report to CERT-In within two hours with the facts known, the company pulls 180 days of SSO and application logs from its central store to find the first suspicious login, and sends an update to CERT-In and notices to affected clients. The same timeline and evidence later support its DPDP and client breach notices.

Next steps

1. Register or update your point of contact with CERT-In.
2. Check every ICT system for logging and 180-day retention.
3. Configure time synchronisation and verify it.
4. Write and rehearse a six-hour reporting process.
5. Align contracts and incident runbooks with CERT-In, DPDP and sector duties.

Frequently asked questions

Do CERT-In Directions apply to private companies?

Yes. They apply to body corporates, which under the IT Act include any company, firm, sole proprietorship or association engaged in commercial or professional activity, as well as service providers, intermediaries, data centres and government organisations.

What is the CERT-In six-hour rule?

Incidents of the types listed in Annexure I must be reported to CERT-In within six hours of noticing them or being told about them. Partial information is acceptable at first, with updates later.

How long must logs be kept under CERT-In Directions?

Logs of all ICT systems must be kept securely for a rolling 180 days within Indian jurisdiction and provided to CERT-In with an incident report or on request.

Can logs be stored outside India?

CERT-In's FAQs say logs may be stored outside India as long as they can be produced to CERT-In within a reasonable time, but that service providers offering services to users in India need to maintain logs in Indian jurisdiction. Check with counsel for your situation.

Do foreign companies need to follow the CERT-In Directions?

CERT-In's FAQs say the Directions apply to any entity in the matter of cyber incidents, and that service providers offering services to users in India must designate a point of contact even without physical presence.

What is the penalty for not complying?

Under section 70B(7) of the IT Act, imprisonment up to one year, a fine up to one lakh rupees, or both.

Do we need to sync clocks with Indian NTP servers?

You must use NIC or NPL NTP servers or a time source traceable to them that does not deviate from them. Cloud customers may use the cloud provider's native time service. Clocks need not be set to IST.

Do VPN rules apply to our company VPN?

The FAQs say the VPN service provider duties apply to entities offering internet proxy-like VPN services to general internet users, not to a company's internal VPN for staff.

What if our contract with a client says we cannot disclose incidents?

CERT-In's FAQs say the reporting duty is statutory and overrides confidentiality clauses, by virtue of section 81 of the IT Act. Inform clients in parallel under your contract.

Do we have to report incidents in a cloud provider's systems?

The FAQs say entities must report incidents affecting their data stored in a third party's systems. The cloud provider has its own reporting duty for incidents in its infrastructure.

When did the CERT-In Directions take effect?

On 27 June 2022, sixty days after issue. For MSMEs, and for two customer validation items for infrastructure providers, the date was extended to 25 September 2022.

How do the CERT-In Directions relate to the DPDP Act?

They are separate. A personal data breach may need a CERT-In report within six hours and, once the DPDP Rules apply, intimation to the Data Protection Board and affected people with a detailed report within 72 hours.