CERT-In Incident Reporting Requirements: What Indian Businesses Need to Know

CERT-In incident reporting is a critical compliance requirement for businesses operating in India. Under directions issued by the Indian Computer Emergency Response Team (CERT-In) on 28 April 2022, covered organisations must report specified cyber security incidents within six hours of noticing them or being informed of them. Failure to comply may expose an organisation to legal and regulatory consequences.

For businesses, the challenge is not limited to reporting a cyberattack. They must also preserve digital evidence, maintain technical logs, coordinate with service providers and assess other applicable reporting obligations. Understanding these requirements helps organisations respond promptly and reduce compliance risks.

This guide explains the CERT-In reporting framework, the incidents covered, the six hour deadline, record keeping duties and practical steps businesses should take to maintain compliance.

1. What Is CERT-In and Why Does Incident Reporting Matter?

The Indian Computer Emergency Response Team is India’s national agency for cyber security incident response. It operates under Section 70B of the Information Technology Act, 2000, and coordinates responses to cyber threats, analyses reported incidents and issues security advisories.

The CERT-In directions dated 28 April 2022 were introduced to improve the timely reporting of cyber incidents and strengthen India’s cyber security response. They establish requirements for incident reporting, technical log retention, system clock synchronisation and certain information maintained by specified service providers.

For businesses, compliance is both a legal obligation and an important part of incident management. Timely reporting can help authorities analyse attack patterns, identify connected threats and coordinate appropriate responses. It also encourages organisations to establish clear escalation procedures before a serious incident occurs.

The directions should be read alongside the Information Technology Act, 2000, the CERT-In Rules, 2013 and any applicable sectoral requirements.

2. Which Organisations Must Comply with CERT-In Directions?

The directions apply to service providers, intermediaries, data centres, body corporates and government organisations, along with specified virtual private server, cloud, VPN and virtual asset service providers. Their application depends on the category of entity and the particular obligation involved.

For most companies, the inclusion of body corporates means the requirements cannot be dismissed as obligations limited to technology businesses. Companies in manufacturing, retail, professional services, healthcare, e commerce and other sectors may also need to comply.

The reporting obligation may arise even when an incident affects systems hosted by a third party. For example, a business may discover a data breach involving its cloud provider or outsourced IT partner. The affected business should assess its own reporting duties rather than assume the vendor’s report automatically satisfies them.

CERT-In’s official directions and FAQs are available through the CERT-In regulatory guidance page. Organisations should consult the applicable documents to confirm their obligations.

3. Which Cyber Incidents Must Be Reported?

The directions identify categories of cyber incidents which must be reported. These include data breaches and data leaks, unauthorised access to systems or data, website defacement, attacks involving malicious code, ransomware, denial of service attacks and distributed denial of service attacks.

Other specified categories include attacks on servers, cloud systems and Internet of Things devices, identity theft, phishing, spoofing, attacks on critical systems and certain incidents affecting digital payment systems or applications.

The list is not limited to situations where an organisation has confirmed financial loss. A suspected incident may also require attention where the available facts indicate a qualifying security event.

Businesses should therefore avoid waiting for a complete forensic investigation before assessing whether a report is required. An unexplained intrusion, suspicious administrative access or suspected data exfiltration should trigger an immediate review against the applicable reporting categories.

The precise classification depends on the facts and the directions. A routine technical fault is not automatically a reportable cyber incident merely because it affects an IT system.

4. What Is the CERT-In Six Hour Reporting Deadline?

One of the most important CERT-In incident reporting requirements is the six hour deadline. Covered entities must report specified cyber incidents within six hours of noticing the incident or being brought to notice of it.

The reporting clock is not necessarily linked to the moment an attack began. It is tied to awareness of the incident. However, organisations should maintain effective monitoring and detection controls because delayed detection can increase operational and legal risk.

Businesses should not interpret the deadline as permission to wait six hours before beginning the reporting process. Once a potentially reportable incident is identified, the response team should promptly assess the facts, notify the relevant internal stakeholders and prepare the submission.

CERT-In’s published FAQs clarify that organisations may provide the information available at the time of reporting and submit additional information later within a reasonable period. A company should not delay an initial report simply because every technical detail is not yet available.

A documented escalation procedure can help teams recognise incidents quickly and meet the deadline without compromising containment or evidence preservation.

5. How Should a Business Report an Incident to CERT-In?

The organisation should first establish an incident response process with a clearly designated internal lead. The IT or security team should record the time of discovery, identify affected systems and collect the information currently available.

The report should provide a clear description of the incident, its apparent nature, the affected infrastructure and the known or suspected impact. Relevant technical indicators, detection details, containment actions and contact information should be included where applicable under the reporting format.

Businesses should use the reporting channels and forms specified by CERT-In at the time of submission. They should retain a copy of the report, proof of submission and any acknowledgement or reference received.

If the investigation remains incomplete, submit the available information within the required timeframe and provide further details as they become available. Keep a record of subsequent communications and remedial action.

The internal incident record should also identify who approved the submission and which facts remained unverified. This creates an auditable record of the organisation’s response.

6. What Are the Log Retention and Time Synchronisation Requirements?

CERT-In compliance extends beyond incident notification. Covered entities must enable logs of their ICT systems and maintain them securely for a rolling period of 180 days within Indian jurisdiction, as required by the directions.

Logs can be vital when determining how an attacker entered a network, which accounts were compromised and whether confidential information was accessed or transferred. Missing or incomplete records can make investigations more difficult and weaken an organisation’s ability to explain its response.

Businesses should review logging across relevant servers, endpoints, cloud environments, applications and network devices. Access to logs should be restricted, and appropriate safeguards should protect them against deletion or alteration.

The directions also require ICT system clocks to be synchronised with the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or another source which does not deviate from these time sources.

Accurate timestamps help investigators correlate events across different systems. Organisations should therefore test time synchronisation and confirm that logs remain accessible during an incident.

7. What Happens if a Business Fails to Report an Incident?

Failure to comply with a binding CERT-In direction can have legal consequences. Section 70B(7) of the Information Technology Act, 2000 provides for imprisonment of up to one year, a fine of up to ₹1 lakh, or both, for specified failures to provide required information or comply with directions under Section 70B(6).

This does not mean every reporting delay automatically results in prosecution. The statutory provision, circumstances of the breach and applicable enforcement considerations must be examined in each case.

Non compliance may also create wider regulatory and commercial concerns. Depending on the business and the incident, the organisation may need to address contractual claims, sectoral reporting duties, customer concerns or questions about its security controls.

Businesses should document the reasons for any delay, the steps taken to comply and the corrective measures introduced. Where a possible breach of a legal direction has occurred, obtain appropriate advice and avoid making unsupported statements about compliance.

8. How Do CERT-In Requirements Interact with Data Protection and Sectoral Rules?

CERT-In reporting is not the only obligation which may arise from a cyber incident. A breach involving personal information may trigger separate data protection requirements, while regulated businesses may face additional duties under sector specific rules.

India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have a phased commencement schedule. As of October 2026, the principal breach notification duties under Sections 8 and 33 are scheduled to commence in May 2027, subject to the notified commencement framework and any subsequent changes. Organisations should verify the current position before relying on a particular provision.

In the meantime, applicable obligations under existing law, contractual arrangements and sectoral regulations must still be assessed. Financial institutions, insurers, telecommunications entities and other regulated businesses may have additional reporting requirements.

A CERT-In report should not automatically be treated as satisfying every separate notification duty. Organisations should maintain a compliance matrix identifying the relevant authority, trigger, deadline, required information and responsible internal team for each applicable obligation.

Businesses operating across borders should also consider contractual notification periods and foreign privacy laws where applicable.

9. How Can Businesses Build a Reliable Incident Reporting Framework?

Effective compliance begins before an incident occurs. Organisations should maintain a written incident response plan defining how staff identify, classify, escalate and report cyber incidents.

The plan should identify the personnel responsible for technical investigation, legal assessment, regulatory communication and senior management decisions. It should also include an up to date contact list, reporting templates and procedures for collecting reliable evidence.

Regular tabletop exercises can test whether teams recognise a reportable incident and can prepare an initial submission within the six hour deadline. Exercises should cover ransomware, data leakage, compromised cloud accounts and incidents involving external vendors.

Contracts with cloud providers and outsourced service providers should establish clear escalation procedures and prompt access to relevant technical information. However, contractual arrangements cannot simply transfer away a statutory reporting duty where the law places it on the reporting entity.

Seeking advice from cybersecurity lawyers for regulatory compliance can help organisations assess their obligations, review incident response procedures and coordinate legal requirements with technical operations.

Where a cyber incident also involves suspected hacking, fraud, extortion or other criminal conduct, criminal lawyers for cyber offences may assist with the criminal law implications, complaints and related proceedings. These issues should be addressed alongside, rather than instead of, the applicable reporting obligations.

Conclusion

CERT-In incident reporting is a central part of India’s cyber security compliance framework. Covered organisations must understand which incidents are reportable, act within the six hour deadline and maintain the technical records required by the directions.

A reliable response combines early detection, accurate reporting, evidence preservation, secure log retention and clear internal accountability. Businesses should also assess separate privacy, contractual and sectoral obligations before assuming a single report resolves every compliance issue.

By preparing in advance and reviewing their procedures regularly, Indian businesses can respond more effectively to cyber incidents and reduce the risk of avoidable compliance failures.