What is the CERT-In 6-hour rule?

Under CERT-In's directions of 28 April 2022, covered organisations must report the cyber incident types listed in Annexure I within 6 hours of noticing them or being told about them. You can report the information available at that time and send further details later. Reports go to CERT-In's incident response help desk at incident@cert-in.org.in.

How long must logs be kept under the CERT-In directions?

Logs of all ICT systems must be enabled and kept securely for a rolling period of 180 days, and provided to CERT-In with an incident report or when directed. CERT-In's FAQs allow logs to be stored outside India if you can still produce them in a reasonable time. Check cloud defaults, which are often shorter.

Do the CERT-In directions apply to small businesses?

The directions cover service providers, intermediaries, data centres, body corporate and government organisations, which takes in most businesses running IT systems. MSMEs received an extension that ended on 25 September 2022, so the directions now apply to them as well. Individual citizens are not covered. Confirm your own position with legal advice.

Which NTP servers does CERT-In recommend?

CERT-In's FAQs name samay1.nic.in and samay2.nic.in from the National Informatics Centre and time.nplindia.org from the National Physical Laboratory. You may use other accurate or cloud-native time sources if they do not deviate from NIC and NPL time. System clocks do not have to be set to IST, but record the time zone.

Is CERT-In reporting the same as a DPDP breach notice?

No. CERT-In reporting covers listed cyber incidents within 6 hours. The DPDP Rules, 2025 separately require notice of personal data breaches to affected people and the Data Protection Board, with a detailed report to the Board within 72 hours, from May 2027. One incident can trigger both, so plan for both timelines.

CERT-In Cyber Security Directions: What Indian IT Teams Need to Know

CERT-In's Cyber Security Directions of 28 April 2022, issued under section 70B(6) of the IT Act, 2000, require covered organisations in India to report listed cyber incidents within 6 hours of noticing them, keep logs of all ICT systems for a rolling 180 days, synchronise clocks with NIC or NPL time servers, and name a point of contact. They remain the baseline for Indian IT teams.

At a glance

Issued: 28 April 2022 by CERT-In, under MeitY, and effective 60 days later in late June 2022
Who: service providers, intermediaries, data centres, body corporate and government organisations; individual citizens are not covered
Report: the 20 incident types in Annexure I, within 6 hours, to incident@cert-in.org.in
Logs: all ICT system logs, kept securely for a rolling 180 days
Time: sync to NIC or NPL NTP servers, or to sources traceable to them
Extra duties: data centre, VPS, cloud and VPN providers keep validated subscriber records for 5 years; virtual asset providers keep KYC and transaction records for 5 years
Penalty: CERT-In's FAQs point to section 70B(7) of the IT Act, which now provides for imprisonment of up to one year, a fine of up to one crore rupees, or both (the Jan Vishwas Act, 2023 raised the fine from one lakh rupees with effect from 30 November 2023)

This article is general information for IT teams, not legal advice. Confirm your organisation's obligations with counsel.

Who the directions apply to

The directions apply to service providers, intermediaries, data centres, body corporate and government organisations. CERT-In's FAQs, published in May 2022, add three useful points. Individual citizens are not covered. Foreign firms serving users in India are covered in the matter of cyber incidents. And providers offering services to users in India must designate a point of contact even without a physical presence here.

In practice, most Indian companies and firms that run IT systems should assume they are in scope. For micro, small and medium enterprises, and for the subscriber validation duties of data centre, VPS, cloud and VPN providers, CERT-In's notice of 27 June 2022 extended the start date to 25 September 2022, so those extensions have long since ended.

The core obligations in one table

Obligation	What the directions require	What your team does
Incident reporting	Report Annexure I incidents within 6 hours	A runbook, an on-call owner, a report template
Logs	Enable logs of all ICT systems, keep 180 days	Central log store with at least 180 days
Clock sync	Use NIC or NPL NTP, or traceable sources	NTP on servers, network devices and cloud
Point of contact	Name a contact and send details to CERT-In	Email info@cert-in.org.in, update on change
CERT-In requests	Provide information or assistance when directed	Know who responds, and how fast
Provider records	Subscriber details kept 5 years	Only if you are such a provider

The 6-hour reporting rule

The clock starts when you notice the incident or someone brings it to your notice, not when you finish investigating. The FAQs make two practical points: you may report the information available at the time and add more later within a reasonable time, and an incident that went undetected for a long time still has to be reported within 6 hours of noticing it.

Annexure I lists 20 types. Grouped for a runbook, they are:

Probing and access: targeted scanning or probing of critical networks or systems; compromise of critical systems or information; unauthorised access to IT systems or data
Malware and server attacks: website defacement or intrusion; malicious code such as viruses, worms, trojans, bots, spyware, ransomware and cryptominers; attacks on database, mail and DNS servers and on network devices such as routers
Fraud and disruption: identity theft, spoofing and phishing; denial of service and distributed denial of service
Critical and connected systems: attacks on critical infrastructure, SCADA, operational technology and wireless networks; on e-governance, e-commerce and other applications; on IoT devices; on digital payment systems
Data: data breaches and data leaks
Mobile and social: attacks through malicious mobile apps; fake mobile apps; unauthorised access to social media accounts
Cloud and emerging technology: attacks on cloud computing systems; on big data, blockchain, virtual assets, robotics, 3D and 4D printing, additive manufacturing and drones; and on artificial intelligence and machine learning systems

The FAQs also ask intermediaries to report incidents outside this list, considering their nature, severity and impact.

How to report: CERT-In's contact page lists the incident response help desk at incident@cert-in.org.in, toll-free phone 1800-11-4949 and toll-free fax 1800-11-6969. The FAQs say reporting methods and formats are published on the CERT-In website and updated from time to time, so check the current format before you need it.

A simple 6-hour runbook

Hour 0 to 1, triage. Confirm the event, match it to an Annexure I type, open an incident record, and note the exact time you noticed it with the time zone.
Hour 1 to 2, decide. The incident manager decides whether it is reportable and informs leadership and legal.
By hour 6, report. Send what you know: time noticed, systems affected, incident type, indicators seen, actions taken and a contact.
After reporting. Preserve logs and evidence, send further details as you learn them, and keep a copy of everything you sent.

Run a tabletop exercise at least twice a year so the first rehearsal is not a real ransomware night.

Logs: 180 days, and the cloud default trap

The directions require logs of all ICT systems, kept securely for a rolling 180 days within Indian jurisdiction and provided to CERT-In with incident reports or on request. FAQ 35 clarifies that logs may also be stored outside India, as long as you can produce them to CERT-In in a reasonable time. FAQ 37 gives examples: firewall, intrusion prevention and SIEM logs; web, database, mail, FTP and proxy server logs; event logs of critical systems; application logs; ATM switch logs; and SSH and VPN logs. Record both successful and unsuccessful events.

The common gap is that cloud defaults are shorter than 180 days:

Log Analytics: tables keep data for 30 days by default, or 90 days in Microsoft Sentinel. You can extend analytics retention to two years and total retention to 12 years, according to Microsoft's data retention guide.
Microsoft Entra sign-in and audit logs: kept for 7 days on Entra ID Free and 30 days on P1 or P2. Route them to a Log Analytics workspace or storage account with diagnostic settings to keep them longer.

A quick PowerShell check for Azure teams lists the Log Analytics tables whose total retention is under 180 days:

Get-AzOperationalInsightsTable -ResourceGroupName "rg-security" -WorkspaceName "law-central-india" |
  Where-Object { $_.TotalRetentionInDays -lt 180 } |
  Select-Object TableName, Plan, RetentionInDays, TotalRetentionInDays

Fix each table with Update-AzOperationalInsightsTable and the -TotalRetentionInDays parameter, and remember that longer retention costs money, so agree the period with security and finance together.

Time synchronisation

The directions ask you to connect to the NTP servers of NIC or NPL, or to servers traceable to them. FAQ 43 names samay1.nic.in and samay2.nic.in for NIC and time.nplindia.org for NPL. FAQ 40 adds that you do not have to set system clocks to Indian Standard Time; NTP provides UTC, and you should record time zone information. Organisations spanning several geographies, and cloud customers, may use other or cloud-native time sources provided they do not deviate from NPL and NIC.

In an Active Directory domain, point the PDC emulator at Indian time sources and let other machines follow the domain hierarchy. Run this on the domain controller that holds the PDC emulator role:

w32tm /config /manualpeerlist:"samay1.nic.in,0x8 samay2.nic.in,0x8 time.nplindia.org,0x8" /syncfromflags:manual /reliable:yes /update
Restart-Service w32time
w32tm /resync
w32tm /query /status

Allow outbound UDP port 123 for these servers, and do the same for firewalls, switches, Linux servers and appliances. For Azure virtual machines, Microsoft documents that Windows images sync from two sources by default, the Azure host and time.windows.com, and usually prefer the host. Whatever you choose, write it down, because "how do you sync time?" is an easy audit question to fail.

How this fits with DPDP and sector rules

CERT-In reporting is not the only clock. The Digital Personal Data Protection Rules, 2025, notified in November 2025, require a data fiduciary to inform affected people and the Data Protection Board of India of a personal data breach without delay, with a detailed report to the Board within 72 hours. Those rules are scheduled to apply 18 months after publication, in May 2027. One ransomware incident could therefore trigger both a 6-hour CERT-In report and a DPDP breach notice. The DPDP Rules also ask for relevant logs to be kept for one year, so many teams will standardise on at least a year. Our article on the DPDP Act and AI tools covers the data protection side.

Banks, NBFCs, insurers and market intermediaries also follow cyber security frameworks from RBI, IRDAI or SEBI, each with its own reporting expectations. Map every applicable timeline in one table so the incident manager does not have to remember them at 3 am.

Separately, CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (version 1.0, 25 July 2025) set out how audits by CERT-In empanelled auditors should run and say auditees should audit their full ICT systems at least once a year.

Skills your team needs

Policies only work if the people running the systems understand them:

Security basics for everyone in IT and their managers: identity, compliance and threat concepts, as covered in SC-900.
Data protection operations: data loss prevention, retention and insider risk in Microsoft Purview, the focus of SC-401, which matters directly for data leak incidents.
Cloud monitoring: diagnostic settings, Log Analytics and retention, part of everyday Azure administration in AZ-104.

If your Azure security engineers held AZ-500, note that it retired on 31 August 2026. Microsoft's replacement for that role is Cloud and AI Security Engineer Associate (SC-500).

How CertTulen Academy can help

CertTulen Academy runs live, MCT-led training with hands-on labs, online or as private cohorts for Indian IT teams. SC-900 gives engineers and managers a shared security vocabulary, SC-401 covers data loss prevention and retention in Microsoft Purview, and AZ-104 covers Azure monitoring and diagnostic settings. For a workshop built around your incident runbook, see corporate training or contact us.