How Can Companies Comply With CERT-In’s Six Hour Cyber Incident Reporting Requirement?

CERT-In six-hour reporting is a key cyber security compliance obligation for companies operating in India. Under directions issued by the Indian Computer Emergency Response Team (CERT-In) on 28 April 2022, covered organisations must report specified cyber incidents within six hours of noticing them or being informed about them.

The short deadline creates practical challenges. Companies must identify reportable incidents, involve the right decision makers, preserve evidence and submit an initial report without waiting for a full forensic investigation. A clear reporting process helps organisations meet their legal obligations while managing the technical and commercial impact of a cyber incident.

This guide explains the legal framework, the incidents covered, how to manage the six hour deadline and the steps companies can take to strengthen compliance.

1. What Is the CERT-In Six Hour Reporting Rule?

CERT-In issued its Cyber Security Directions under Section 70B(6) of the Information Technology Act, 2000. The directions became effective on 27 June 2022 and establish requirements for reporting specified cyber incidents, maintaining system logs and synchronising system clocks.

Under Direction (ii), covered entities must report incidents listed in Annexure I within six hours of noticing them or being brought to notice of them. The obligation focuses on timely reporting, rather than waiting until the organisation has established the full cause, extent or financial impact of an attack.

The six hour requirement is not simply an internal best practice. It forms part of a binding regulatory framework. Companies should therefore treat incident reporting as a defined operational responsibility, supported by written procedures, assigned personnel and reliable records.

The official CERT-In directions and FAQs provide the governing materials and reporting guidance. Organisations should review the current documents when designing or updating their procedures.

2. Which Companies Must Comply?

The directions apply to service providers, intermediaries, data centres, body corporates and government organisations. They also contain specific obligations for certain service providers, including cloud, virtual private server and VPN providers.

The inclusion of body corporates means the reporting requirement is not restricted to technology companies. Businesses in sectors such as manufacturing, retail, healthcare, financial services and professional services may also need to comply.

A company should not assume it falls outside the framework simply because it outsources its IT infrastructure. If a reportable incident affects its data or systems hosted by a third party, it should assess its own obligations. CERT-In’s FAQs clarify the reporting position for incidents involving data held on third party systems.

The company should also identify any additional rules applying to its sector. A regulated financial institution, for example, may have separate incident notification duties alongside its CERT-In obligations.

3. Which Cyber Incidents Must Be Reported?

Annexure I to the directions identifies categories of cyber incidents which must be reported. These include data breaches and data leaks, ransomware, unauthorised access, website defacement, phishing, identity theft, spoofing and denial of service attacks. The list also covers incidents involving malicious code and attacks affecting servers, cloud systems, networks and other specified digital infrastructure.

Companies should build an incident classification process around the official list. The purpose is to identify incidents which may trigger the reporting requirement as soon as credible information becomes available.

For example, an employee reporting an unexpected ransomware message, a security alert indicating unauthorised administrator access or evidence of data exfiltration should trigger prompt assessment. The response team should check the facts against the applicable categories instead of waiting for a complete investigation.

Not every IT problem is a reportable cyber incident. A routine outage or software defect does not automatically trigger the six hour rule. However, where there are credible signs of a listed incident, uncertainty should prompt rapid escalation and assessment rather than an automatic decision not to report.

4. When Does the Six Hour Clock Start?

The deadline runs from the time the organisation notices the incident or is brought to notice of it. It is not necessarily measured from the moment an attacker first gained access, which may be unknown.

This distinction makes internal escalation procedures especially important. A security alert may initially reach a monitoring team, an outsourced security provider or a business unit rather than senior management. If the incident is potentially reportable, the company should not allow it to remain in a technical queue while teams debate responsibility.

Organisations should record the earliest known time of detection or notification, the source of the alert and the time it was escalated. Where information arrives in stages, the incident record should explain the sequence and the basis for the reporting decision.

The safest operational approach is to start the response immediately. Companies should not treat the full six hours as a period available for routine internal approvals or prolonged investigation.

5. How Can Companies Submit a Report Before the Investigation Is Complete?

A common compliance challenge arises when the company knows an incident has occurred but does not yet have every technical detail. CERT-In’s FAQs address this issue: entities may provide the information available at the time of reporting and submit additional information later within a reasonable period.

This means a company should prepare an initial report based on verified information rather than delay until the forensic review is finished. The report should describe the known incident, affected systems, approximate discovery time, apparent impact and immediate response measures, using the applicable reporting format and available facts.

The company should distinguish confirmed information from preliminary findings. Avoid presenting assumptions as established facts. Keep a copy of the report, the supporting records and any acknowledgement or reference received.

After submission, continue the investigation and provide additional information as it becomes available. Maintain a record of follow up communications and any further instructions from CERT-In. This approach supports timely reporting while preserving accuracy and accountability.

6. What Internal Process Should Companies Establish?

An effective reporting process begins with clear ownership. Companies should designate an incident response lead and identify the people responsible for technical investigation, legal assessment, regulatory reporting and senior management decisions.

The process should define how staff report suspected incidents, how the security team classifies them and who has authority to approve and submit an initial report. A predefined escalation route reduces delays caused by uncertainty over whether an incident is serious enough to notify.

The company should also maintain current contact details for its designated CERT-In point of contact. Under the directions, covered entities must designate a point of contact to communicate with CERT-In and keep the relevant details updated.

A practical incident response plan should include reporting templates, evidence collection procedures, contact lists and an approval process which works outside ordinary business hours. Regular exercises can test whether the team can recognise a reportable incident and prepare a timely submission.

Seeking guidance from cybersecurity compliance lawyers for companies can help businesses assess the legal scope of the directions, review reporting procedures and coordinate regulatory obligations with their technical response teams.

7. How Do Log Retention and Evidence Preservation Support Compliance?

The CERT-In directions impose related record keeping requirements. Covered entities must enable logs of their ICT systems and maintain them securely for a rolling period of 180 days within Indian jurisdiction. The directions also require system clocks to be synchronised with the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or an appropriate source which does not deviate from them.

These requirements support incident investigation. Logs may help establish when an attacker accessed a system, which accounts were affected and whether information was transferred or altered. Inaccurate timestamps or missing records can make it harder to reconstruct events and explain the response.

Companies should review logging coverage across relevant servers, endpoints, applications, cloud environments and network devices. Access controls should protect logs against unauthorised modification or deletion. Retention procedures should also ensure records remain accessible when an incident occurs.

Evidence preservation should run alongside containment and reporting. Teams should document the actions taken, preserve relevant files and record key decisions. Where criminal activity is suspected, a reliable evidence trail may also be important for a police complaint or later investigation.

8. What Are the Consequences of Non Compliance?

Section 70B(7) of the Information Technology Act, 2000 provides for imprisonment of up to one year, a fine of up to ₹1 lakh, or both for specified failures to comply with directions or provide required information under Section 70B(6). This does not mean every late report automatically results in prosecution. The statutory provision, facts of the case and applicable enforcement considerations matter. However, companies should not assume a missed deadline is inconsequential. A failure to report may also raise questions about the organisation’s incident response controls, record keeping and governance. Depending on the incident and the company’s sector, separate contractual, regulatory or data protection consequences may arise.

Where a possible reporting failure has occurred, the organisation should document the timeline, the reasons for delay, the information available at each stage and the corrective steps taken. It should assess the appropriate legal response rather than making unsupported claims about compliance.

If the incident also involves suspected hacking, fraud, extortion or other criminal conduct, criminal defence lawyers for cybercrime may help assess the criminal law implications and advise on related investigations or proceedings. This work should complement, not replace, the company’s regulatory reporting responsibilities.

9. How Does CERT-In Reporting Interact With Data Protection Duties?

CERT-In reporting and personal data breach notification are distinct obligations. A single incident may trigger more than one reporting requirement, depending on the affected information, the organisation’s sector and the applicable legal framework. India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have a phased commencement schedule. As of October 2026, the principal data fiduciary duties under Section 8 and the associated breach notification requirements under Section 33 are scheduled to commence in May 2027, subject to the notified commencement framework and any subsequent changes.

Companies should verify the current legal position before relying on a particular provision. Existing sectoral requirements, contractual duties and other applicable laws may continue to impose separate obligations. A CERT-In report should not automatically be treated as satisfying every other notification duty. Companies should maintain a compliance matrix recording the relevant authority, triggering event, deadline, required information and responsible team for each obligation.

Conclusion

Complying with CERT-In’s six hour cyber incident reporting requirement requires preparation before an attack occurs. Companies should understand which incidents are reportable, record when they become aware of an incident and ensure the responsible team can submit available information within the deadline.

Clear escalation routes, an updated point of contact, reliable logs and regular response exercises can reduce avoidable delays. Organisations should also assess separate sectoral, contractual and data protection obligations rather than assume one report resolves every compliance issue. A tested reporting process helps companies respond consistently, preserve evidence and demonstrate accountability during a cyber incident.