Six hours. That’s how long organizations in India have to report specified cyber incidents to CERT-In. The question isn’t whether you’ll report — it’s whether you’ll notice in time.
Who it’s for
Organizations operating in India
You’ll learn
- · What CERT-In requires
- · Why fast detection matters
- · How to get ready
Reading time
6 min read
Why this matters to your business
Missing the six-hour reporting window can bring regulatory trouble on top of the incident itself. Being ready ahead of time makes a stressful day far more manageable.
CERT-In Directions 2022
India- The requirement
- Report cyber incidents within 6 hours; retain ICT system logs for 180 days.
- Auditors look for
Incident reporting procedure (6-hour timeline)
Log retention for 180 days
Monitoring coverage of ICT systems
- How we help
- VAPT and log-review evidence for your CERT-In obligations. Where your regulator requires a CERT-In empanelled auditor, we work alongside them and prepare you for that audit.
- 1
The key requirements
Specified cyber incidents must be reported to CERT-In within six hours of being noticed, and logs of ICT systems must be kept for 180 days.
- 2
Why monitoring matters
You can only report within six hours if you notice the incident quickly. That requires the right log sources, retention and someone watching the alerts — including at night and on weekends.
- 3
Getting ready
Confirm your log retention, write a short incident-reporting procedure with named owners, and rehearse it. Round-the-clock monitoring removes the gap between an alert firing and someone acting on it.
- 4
What a good first hour looks like
Confirm the alert is real, contain the immediate risk, preserve evidence and notify the people who make the reporting decision. A short written playbook makes this calm instead of chaotic.
- 5
Logs: the evidence you will need
Without logs it is hard to know what happened, when, and what was affected. Check that firewalls, servers, applications and identity systems all send logs to a central place and keep them long enough.
What you should do
- Confirm 180-day log retention across key systems
- Write a short incident-reporting procedure
- Name owners and backups for reporting decisions
- Rehearse the process at least once a year
What our team does
- Test the systems that hold your logs and critical data
- Check log coverage and retention gaps during testing
- Report critical findings within 24 hours
- Provide test evidence for your CERT-In obligations
- Review your log sources and retention
- Write an incident playbook with you
- Run a tabletop exercise with your team
Our testing shows where your logging and detection gaps are, so you are ready before the six-hour clock ever starts.
— The CRIS InfoTech security team