CERT-In's 6-hour rule: how to report a cyber incident on time

Last reviewed 19 October 2026 by the InspireGRC team.

What the rule says

On 28 April 2022, CERT-In issued Directions under section 70B(6) of the Information Technology Act, 2000. They came into force 60 days later. The core duty: report any incident on CERT-In's list within 6 hours of noticing it, or of it being brought to your notice.

CERT-In's FAQs accept that you will not know everything in six hours. Report what you know, then send further details as you learn them.

Who it applies to

The Directions address service providers, intermediaries, data centres, companies (body corporates) and government organisations. In practice, if your company runs computer systems in India, assume it applies to you.

What counts as reportable

The Directions list 20 incident types. In plain terms they cover:

• targeted scanning of critical systems, and compromise of critical systems or data
• unauthorised access to systems, data or social media accounts
• website defacement, malicious code and malware, including ransomware
• attacks on servers, network devices, applications, cloud systems, IoT devices and digital payment systems
• identity theft, spoofing and phishing; denial-of-service attacks
• data breaches and data leaks
• malicious or fake mobile apps
• attacks on operational technology, and on systems using AI, blockchain, big data or drones

The list is broad. When in doubt, treat the incident as reportable and decide quickly.

The other duties people forget

• Clock sync: connect systems to the NTP servers of the National Informatics Centre (NIC) or National Physical Laboratory (NPL), or to servers traceable to them, so timelines line up.
• Logs: enable logs on all ICT systems and keep them securely for a rolling 180 days. The Directions say within India; CERT-In's FAQs allow storage abroad if you can produce the logs on request.
• Point of contact: designate a person to deal with CERT-In and share their details in the prescribed format.
• Cloud, VPS, data centre and VPN providers must keep validated customer details for five years, even after an account closes. Enterprise VPNs are excluded.

How to report

CERT-In publishes the current reporting formats and channels on cert-in.org.in. The Directions also list toll-free phone (1800-11-4949) and fax (1800-11-6969) numbers. Keep the latest form and your point of contact's details in your incident playbook, not in someone's inbox.

A 6-hour playbook

1. Hour 0: someone notices. Log the incident with the time; that is when the clock starts.
2. Hour 1: check it against the 20 types. If it fits, or you cannot rule it out, it is reportable.
3. Hours 1 to 4: gather what you can, including affected systems, timeline, indicators and impact, with logs you can trust because clocks are in sync.
4. Hour 5: the named approver reviews the report.
5. Before hour 6: submit, and record when and how.
6. After: send updates, and decide whether customers, RBI, SEBI or IRDAI, or the Data Protection Board must also be told.

Other regulators

Regulated entities have more than one clock. Under RBI's IT outsourcing directions, for example, an NBFC must report to RBI within six hours of its IT vendor detecting an incident. A personal data breach also triggers DPDP reporting. See our DPDP guide and RBI guide.

Penalty

Under section 70B(7) of the IT Act, failing to provide information or comply with a direction can lead to imprisonment of up to one year, a fine of up to ₹1 lakh, or both.

Checklist

• Name a CERT-In point of contact and a backup, and send CERT-In their details.
• Point every server, firewall and cloud service at NIC or NPL time sources.
• Turn on logging everywhere and keep 180 days; test that you can actually retrieve them.
• Keep the reporting format and channels in your incident playbook.
• Decide in advance who approves a report at 2 a.m., and who covers when they are away.
• Run a timed drill once a year: from "noticed" to "submitted" in under six hours.

Sources

1. CERT-In Directions of 28 April 2022 (reproduced by TaxGuru)
2. Nishith Desai Associates: CERT-In FAQs explained
3. Reserve Bank of India: Master Direction on Outsourcing of IT Services (2023)
4. Official CERT-In website

This guide explains the rules in plain English. It is not legal advice; for decisions about your own obligations, speak to a qualified lawyer.