Exhibit A
Six hours from noticing: will your report land in time?
Time since it opened
7h 12m
7h 12m in: window closed. Report is late: non-compliance under Section 70B.
What is the CERT-In directive?
The CERT-In Directions are cyber security directions issued on 28 April 2022 by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, 2000. They apply to service providers, intermediaries, data centres, body corporates and government organisations, which in practice covers most companies that run IT systems serving users in India, including messaging platforms, CPaaS providers and the businesses that integrate them.
Four obligations matter most day to day. Reportable incidents, a list of 20 types in Annexure I that includes unauthorised access to IT systems or data, data breaches and data leaks, malicious code such as ransomware, DDoS attacks, identity theft and phishing, and unauthorised access to social media accounts, must be reported within six hours of noticing them or being told about them. Logs of all ICT systems must be kept securely for a rolling 180 days and provided on request. Clocks must be synchronised to the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to a source that does not deviate from them. And each organisation must name a point of contact for CERT-In.
Some providers carry extra duties: data centres, VPS, cloud and VPN providers must keep validated subscriber records for five years, and virtual asset service providers must keep KYC and transaction records. The Directions say logs are to be maintained within Indian jurisdiction; CERT-In's May 2022 FAQs clarified that logs may also be stored outside India as long as they can be produced to CERT-In. This is an incident-reporting and logging mandate, separate from the DPDP Act, which governs personal-data breaches and Data Breach Notification to the Data Protection Board and affected people. One incident can trigger both.
Key takeaways
- The CERT-In Directions of 28 April 2022 were issued under Section 70B(6) of India's Information Technology Act, 2000.
- Listed cyber incidents must be reported to CERT-In within six hours of noticing them or being told about them.
- ICT system logs must be kept securely for a rolling 180 days and produced to CERT-In on request.
- System clocks must sync to NIC or NPL time servers, or to a time source that does not deviate from them.
- They govern cyber incidents; personal-data breach duties to the Data Protection Board come separately from the DPDP Act.
How does the CERT-In directive work?
Detect and timestamp
The six hours run from when you notice the incident or are told about it. Record that moment from a clock synced to NIC or NPL time, because every later step is measured against it.
Classify against Annexure I
Decide quickly whether the event matches one of the 20 listed incident types. When in doubt, report: CERT-In's FAQs allow an initial report with partial information, with details to follow.
File through your point of contact
Your designated point of contact submits the report in CERT-In's prescribed format through its official channels, such as the email address incident@cert-in.org.in.
Preserve and provide logs
Freeze the relevant logs, which you keep for a rolling 180 days, and be ready to hand them over with the report or whenever CERT-In asks.
Follow up and check other duties
Send updates as facts emerge, act on any direction CERT-In issues, and check whether the same incident also triggers DPDP Act breach duties or contractual notices to customers.
Example: A leaked token at 11:20 p.m.
At 11:20 p.m., the on-call engineer at a Pune SaaS company that runs WhatsApp support for clinics sees API calls from an unknown IP address using a leaked access token. She opens an incident, records the time and pages the company's CERT-In point of contact. By 1:30 a.m. the token is revoked and an initial report, classed as unauthorised access to IT systems, goes to CERT-In with partial details, well inside the six-hour window. The team preserves its gateway, audit and cloud logs, sends updates over the following days, and separately assesses under the DPDP Act whether patient data was exposed.
Common mistakes with the CERT-In directive
Waiting for the investigation to finish
The clock starts when you notice the incident, not when you understand it. File an initial report within six hours and send details as they emerge.
Keeping only 30 days of logs
Default retention in many log tools is far shorter than 180 days. Set a separate retention policy for ICT system logs, including firewall, VPN, application, audit and cloud control-plane logs.
Clocks that drift
Logs from servers minutes apart cannot be stitched into a reliable timeline. Sync every system to NIC or NPL time, or a source that does not deviate from it, and monitor drift.
Treating it as DPDP breach notification
CERT-In reporting covers cyber incidents; the DPDP Act covers personal-data breaches and notices to the Data Protection Board and affected people. Plan for both in one runbook.
No named point of contact
Without an agreed owner, a reportable incident at 2 a.m. stalls. Designate a point of contact, share it with CERT-In and name a backup.
The CERT-In directive in code
# /etc/chrony/chrony.conf: sync to the Indian time sources named in CERT-In's FAQsserver samay1.nic.in iburstserver samay2.nic.in iburstserver time.nplindia.org iburstmakestep 1.0 3 # step the clock if it is more than 1 s off during the first 3 updatesrtcsync # keep the hardware clock in step
Cloud hosts may use the provider's own time service, provided it does not deviate from NIC or NPL time.
Why does the CERT-In directive matter?
For a WhatsApp or CPaaS stack, events like a leaked system user token, a compromised agent dashboard or ransomware on the contact database are very likely reportable, and six hours is short. Teams that have not agreed in advance who decides, who files and which logs exist discover the gap at 2 a.m. Failing to comply is punishable under Section 70B(7) with imprisonment of up to one year, a fine of up to one lakh rupees, or both, and enterprise customers now ask about CERT-In readiness in security reviews.
Best practices for the CERT-In directive
- Pre-fill a CERT-In report template with your company details so only the incident facts need writing at 2 a.m.
- Put the six-hour deadline into your incident management runbook and severity matrix.
- Ask your messaging providers how they handle CERT-In reporting and log retention for their part of the stack.
- Rehearse with a tabletop drill: a leaked API token discovered at 11 p.m. on a Saturday.