CERT-In Directions
Important Dates, Deadlines, and Penalties
The Indian Computer Emergency Response Team (CERT-In) has issued cybersecurity directions to help organizations improve their cybersecurity practices and respond to cyber incidents on time. These directions cover incident reporting, log retention, time synchronization, and certain record-keeping requirements for service providers and other specified entities.
Organizations operating in India should understand these requirements and take the necessary steps to comply. Missing a reporting deadline or failing to follow the applicable directions may lead to legal consequences under the Information Technology Act, 2000.
Background and Implementation Timelines
CERT-In issued its cybersecurity directions on 28 April 2022 under Section 70B(6) of the Information Technology Act, 2000. The directions came into effect on 27 June 2022, with an extended implementation date of 25 September 2022 for eligible MSMEs under the applicable extension. These dates mark the original rollout of the directions and are provided for reference. Organizations should continue to follow the applicable CERT-In requirements and refer to official notifications for any subsequent updates or amendments.
Key CERT-In Compliance Deadlines
Report Cyber Incidents Within 6 Hours
Organizations covered by the directions must report specified cyber incidents to CERT-In within 6 hours of noticing the incident or being informed about it. Reportable incidents may include ransomware attacks, unauthorized access, data breaches, data leaks, website defacement, and certain attacks on servers or cloud systems.
Organizations should have a clear incident response process to identify, assess, and report incidents quickly. If all the required information is not available within six hours, the available information should be submitted first, followed by additional details within a reasonable time.
Maintain System Logs for 180 Days
Organizations must enable logs of their Information and Communication Technology (ICT) systems and securely maintain them for a rolling period of 180 days within Indian jurisdiction. These logs help investigate cyber incidents, identify suspicious activity, and support incident response.
Businesses should ensure that logs are collected from relevant systems, protected from unauthorized changes, and made available when required. Log retention should be part of the organization’s regular cybersecurity monitoring and incident response process.
Synchronize System Clocks
Organizations must enable logs of their Information and Communication Technology (ICT) systems and securely maintain them for a rolling period of 180 days within Indian jurisdiction. These logs help investigate cyber incidents, identify suspicious activity, and support incident response.
Businesses should ensure that logs are collected from relevant systems, protected from unauthorized changes, and made available when required. Log retention should be part of the organization’s regular cybersecurity monitoring and incident response process.
Appoint a CERT-In Point of Contact
Organizations covered by the directions must designate a Point of Contact (PoC) to communicate with CERT-In. The organization should share the required contact details through the prescribed process and ensure that the designated person can coordinate incident reporting and respond to requests.
The PoC should understand the organization’s incident response process and know whom to contact internally if a cyber incident occurs.
Maintain Records for Specific Service Providers
Data center, VPS, cloud, and VPN service providers must maintain customer and subscriber details as required by CERT-In directions. Similarly, virtual asset service providers, virtual asset exchanges, and custodian wallet providers must maintain the required records and complete Know Your Customer (KYC) checks, as applicable.
For the relevant categories, specified records must generally be maintained for five years or longer where required by law or a competent order. The exact requirements depend on the type of service provider and the applicable direction.
Penalties for Non-Compliance with CERT-In Directions
Failure to comply with applicable CERT-In directions can have legal consequences. Under Section 70B(7) of the Information Technology Act, 2000, a service provider, intermediary, data center, body corporate, or other person who fails to provide information requested by CERT-In or comply with a direction issued under Section 70B(6) shall be:
- Imprisonment: Up to one year.
- Fine: Up to ₹1 lakh.
- Both: Imprisonment and a fine may be imposed together.
CERT-In’s official FAQs state that this penal provision may be applied reasonably, particularly in cases of deliberate non-compliance. The consequences depend on the facts and applicable law. Organizations should not assume that every missed deadline automatically results in the maximum penalty.
How Can Organizations Prepare for CERT-In Directions?
Businesses should review their existing cybersecurity policies, incident response procedures, and record-keeping practices to identify gaps. They should establish a process for reporting applicable incidents within six hours, maintain system logs for 180 days, synchronize system clocks, and designate an appropriate Point of Contact.
Organizations should also train relevant employees, conduct periodic compliance reviews, and maintain evidence of the controls implemented. Businesses using third-party cloud, hosting or IT service providers should clearly define incident notification responsibilities and ensure that contractual arrangements do not delay statutory reporting.
How Eagle Can Help
Eagle helps organizations strengthen their cybersecurity readiness through security assessments, incident response planning, security monitoring, and compliance support. Our team can help identify gaps in your existing security practices, review incident reporting processes, and recommend measures to improve your readiness for applicable CERT-In directions.
Frequently Asked Questions?
What is the deadline for reporting a cyber incident to CERT-In?
Specified cyber incidents must be reported within six hours of being noticed or brought to the organization's attention.
How long must organizations retain system logs under CERT-In directions?
Covered organizations must securely retain ICT system logs for 180 days within Indian jurisdiction.
What is the penalty for not complying with CERT-In directions?
Under Section 70B(7) of the IT Act, 2000, non-compliance may result in imprisonment of up to one year, a fine of up to ₹1 lakh, or both.
Do CERT-In directions apply to all businesses in India?
The directions cover specified entities, including service providers, intermediaries, data centers, body corporates, and government organizations. Individual citizens are not covered by these directions.
Is CERT-In compliance a one-time requirement?
No. Requirements such as incident reporting, log retention, and system clock synchronization are ongoing obligations wherever applicable.
Where can I get help with CERT-In directions?
For guidance on understanding and meeting applicable CERT-In directions, consult Eagle. Our team can help your organization assess its cybersecurity requirements, identify compliance gaps, and explore suitable security solutions.