CERT-In Rules: 6-Hour Incident Reporting and Log Retention for Indian Businesses

This is general information, not legal advice. Whether the directions cover your business is a question for a lawyer who has read your facts.

When a business is hacked, the first hours decide how much damage follows. India's national cyber agency, CERT-In (the Indian Computer Emergency Response Team), has a rule about those hours. It asks covered organisations to report certain incidents within six hours of noticing them. Many owners have never heard of it, so here is what it says.

What the directions are

On 28 April 2022 CERT-In issued Directions No. 20(3)/2022-CERT-In under section 70B(6) of the Information Technology Act, 2000. They came into effect 60 days after issue, around 27 June 2022. They cover service providers, intermediaries, data centres, body corporates and government organisations. Data centres, VPS, cloud and VPN providers carry extra record-keeping duties, and virtual asset service providers have know-your-customer duties. I found no replacement of the directions as of November 2026. CERT-In has since published advisories, such as CIAD-2025-0019 of 10 May 2025 on essential measures for industry, but an advisory is guidance rather than a new legal duty.

Who counts as covered

CERT-In's own FAQs, dated May 2022, say individual citizens are not covered, and that "body corporate" includes firms, sole proprietorships and other associations doing commercial or professional activity. The FAQ sets no minimum size. So a small company can fall within the wording. The FAQs also describe themselves as evolving and not a legal document, so ask your adviser about your case.

The six-hour rule

Covered entities must report the incident types listed in Annexure I to CERT-In within six hours of noticing them or being told about them. That annexure lists twenty types, including ransomware, data breaches and leaks, phishing, DDoS attacks, and attacks on cloud, IoT, digital payment systems and AI or machine-learning systems. Reports can be sent to incident@cert-in.org.in or the phone line 1800-11-4949.

Six hours does not mean a finished investigation. The FAQs say you should share the information you have at that time and send the rest within a reasonable period. A short, honest first report is the aim.

Log retention

The directions tell covered entities to enable logs on all their systems and keep them securely in Indian jurisdiction for a rolling 180 days, and to hand them to CERT-In with incident reports or when directed. The FAQs add two points. Logs may be stored outside India as long as you can produce them to CERT-In within a reasonable time, and service providers offering services to users in India must keep financial-transaction records within India. Which logs matter depends on your systems; the FAQs give examples such as firewall, web, database, mail, application, SSH and VPN logs and say both successful and failed events should be recorded.

Other duties in the same document

• Clock synchronisation. Set system clocks to NTP servers of NIC or NPL, or servers traceable to them, so logs line up in time.
• A point of contact. Name a person and send the details to CERT-In in the prescribed format, keeping them current.
• Prompt replies. Respond to CERT-In's orders within the time they set.

Penalties, stated carefully

The directions say failure to comply may lead to action under section 70B(7) of the IT Act and other laws. CERT-In's FAQ describes that provision as allowing imprisonment of up to one year, a fine of up to one lakh rupees, or both, and says the power will be used reasonably and where non-compliance is deliberate. That is the agency's own description, not a promise about how any case will go.

What a small firm should set up

1. Decide who is responsible for security reports and who is their backup, and write their phone numbers down.
2. Keep CERT-In's reporting email and phone number somewhere your team can find them at 2 a.m.
3. Turn on logging for your website host, server, firewall, email and admin panel, and confirm how long each keeps logs.
4. Set aside storage for 180 days of logs, in a place that attackers cannot easily delete.
5. Synchronise server clocks.
6. Write a half-page incident checklist: isolate, record the time, preserve logs, report, then investigate.
7. Check your hosting and software contracts to see who keeps logs and whether they will give them to you quickly.
8. Practise once a year with a short drill.

How it connects to data protection law

A personal data breach can trigger two clocks: CERT-In's six hours for listed incidents and the Data Protection Board report under the DPDP Rules, which asks for a fuller account within 72 hours. Our post on the DPDP Rules timeline covers the second. For account-level habits that prevent incidents, see small business cyber security basics.

Where we can help

At VS Tech Builders we set up activity logging and role-based access in the management software we build, and we can advise on cloud hosting choices that keep logs available. Contact us if you want to know what your current systems record. More explainers are on our tech news hub.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• Directions under sub-section (6) of section 70B of the IT Act, 2000 (No. 20(3)/2022-CERT-In) — CERT-In, Ministry of Electronics and Information Technology
• Frequently Asked Questions on the CERT-In Cyber Security Directions — CERT-In, Ministry of Electronics and Information Technology
• CERT-In Advisory CIAD-2025-0019 — CERT-In

Frequently asked questions

Does the CERT-In six-hour rule apply to my small business?

The directions apply to service providers, intermediaries, data centres, body corporates and government organisations, and CERT-In's FAQ says body corporate includes firms and sole proprietorships. The FAQ sets no size threshold, so a small business can be covered. Individual citizens are not. Ask a lawyer to confirm how it applies to your case.

Do I need a full investigation report within six hours?

No. CERT-In's FAQ says you should report within six hours of noticing a listed incident with the information you have at that moment, and send the remaining details within a reasonable period. A short first report to incident@cert-in.org.in is better than waiting until you know everything.

How long must logs be kept under the CERT-In directions?

The directions require covered entities to keep logs of their ICT systems securely for a rolling 180 days within Indian jurisdiction, and to provide them when CERT-In asks. The FAQ says logs may be stored outside India if they can be produced within a reasonable time, though financial transaction records of services offered in India must stay in India.

What happens if I do not comply?

The directions say non-compliance may lead to action under section 70B(7) of the IT Act and other laws. CERT-In's FAQ describes that section as allowing imprisonment of up to one year, a fine of up to one lakh rupees, or both, and says it will be used reasonably, mainly where non-compliance is deliberate.