India's CERT-In Directions require organisations to report 20 types of cyber incident within six hours, keep logs of all ICT systems for 180 days inside India and synchronise clocks to national time servers, and most global incident programmes were not built for any of the three. The Directions were issued on 28 April 2022 by the Indian Computer Emergency Response Team under section 70B(6) of the Information Technology Act, 2000, and have applied since 27 June 2022. They reach service providers, intermediaries, data centres, body corporates and government organisations, with extra record-keeping duties for cloud, VPS, VPN and virtual asset providers. This guide covers scope, each direction, the reportable incident list, current status including the 2023 penalty increase and the 2025 audit guidelines, and what the rules mean for service accounts, API keys and AI systems. It is for security operations, incident response and compliance leads at companies operating in or serving India; for a cross-country view see the Breach Notification Laws by Country Guide.
Status checked 27 October 2026 against the CERT-In directions page and PDF. No replacement or amendment of the Directions was found; the penalty in section 70B(7) was changed in 2023 (see below). This page is not legal advice.
Key takeaways
- Six hours from noticing: any of the 20 incident types in Annexure I must be reported to CERT-In within six hours of noticing it or being told of it; CERT-In's FAQs allow an initial report with the information available and details later.
- Logs for 180 days in India: logs of all ICT systems must be enabled and kept securely for a rolling 180 days within Indian jurisdiction, and handed over with incident reports or on demand.
- Clock synchronisation is mandatory: systems must connect to the NTP servers of the National Informatics Centre (NIC) or National Physical Laboratory (NPL), or to servers traceable to them.
- Five-year records for infrastructure providers: data centres, VPS, cloud and VPN providers must keep validated subscriber records for five years, and virtual asset providers must keep KYC and transaction records for five years.
- Penalty raised in 2023: from 30 November 2023 the fine under section 70B(7) for failing to provide information or comply with a direction rose from Rs 1 lakh to Rs 1 crore, according to legal commentaries on the Jan Vishwas Act (the 30 November 2023 date is confirmed by the MeitY gazette notification).
Scope: who and what is covered
| Entity | Directions that apply | Source |
|---|---|---|
| Service providers, intermediaries, data centres, body corporates and government organisations | NTP sync, six-hour reporting, point of contact, information on demand, 180-day logs | Directions (i) to (v) |
| Data centres, virtual private server (VPS) providers, cloud service providers, VPN service providers | Also: subscriber records for five years | Direction (vi) |
| Virtual asset service providers, exchanges and custodian wallet providers | Also: KYC and financial transaction records for five years | Direction (vii) |
| Individual citizens | Not covered | CERT-In FAQs (May 2022), as summarised by AZB and Partners |
| Enterprise or corporate VPNs | Not covered by the VPN subscriber records duty | CERT-In FAQs, as summarised by AZB and Partners |
Whether the Directions bind entities outside India that serve Indian users is contested. CERT-In's FAQs suggest they do, while AZB and Partners note the argument that they cannot reach beyond section 75 of the IT Act. Multinationals with Indian subsidiaries, offices or customers should plan to comply for systems serving India and take legal advice on purely offshore operations.
Key obligations
| Direction | Requirement | Practical implication |
|---|---|---|
| (i) Clock synchronisation | Connect to the NTP servers of NIC or NPL, or to NTP servers traceable to them; entities spread across geographies may use another accurate source if it does not deviate from NPL and NIC | Point domain controllers and core time sources at NIC or NPL (or a traceable stratum) and document it; cloud tenants document how provider time is traceable |
| (ii) Incident reporting | Report Annexure I incidents within six hours of noticing them or being brought to notice | The clock starts at detection, not at confirmation |
| (iii) Point of contact | Designate a point of contact for CERT-In in the Annexure II format and keep it updated | A monitored role mailbox and named deputies, sent to [email protected] |
| (iv) Information on demand | Act on CERT-In orders and provide information or assistance, in the format (up to near real-time) and timeframe CERT-In specifies | Be able to export logs and indicators quickly; failure is treated as non-compliance |
| (v) Logs | Enable logs of all ICT systems and keep them securely for a rolling 180 days within Indian jurisdiction | FAQs allow storage abroad if a copy is kept in India |
| (vi) Subscriber records | Data centre, VPS, cloud and VPN providers keep validated names, hire period, allotted IPs, registration email, IP and timestamp, purpose, validated address and contact numbers, and ownership pattern, for five years after cancellation | Know-your-customer onboarding and retention |
| (vii) Virtual assets | KYC information and transaction records for five years, sufficient to reconstruct each transaction, including IP addresses, timestamps and time zones, transaction IDs, public keys, accounts, nature, date and amount | Ledger and access log retention aligned per transaction |
The 20 reportable incident types (Annexure I)
| No. | Incident type | No. | Incident type |
|---|---|---|---|
| i | Targeted scanning or probing of critical networks or systems | xi | Data breach |
| ii | Compromise of critical systems or information | xii | Data leak |
| iii | Unauthorised access of IT systems or data | xiii | Attacks on IoT devices and associated systems |
| iv | Defacement or intrusion into a website, including malicious code or links to external sites | xiv | Attacks or incidents affecting digital payment systems |
| v | Malicious code attacks: viruses, worms, trojans, bots, spyware, ransomware, cryptominers | xv | Attacks through malicious mobile apps |
| vi | Attacks on servers such as database, mail and DNS, and network devices such as routers | xvi | Fake mobile apps |
| vii | Identity theft, spoofing and phishing attacks | xvii | Unauthorised access to social media accounts |
| viii | Denial of service and distributed denial of service attacks | xviii | Attacks or malicious or suspicious activity affecting cloud systems, servers, software and applications |
| ix | Attacks on critical infrastructure, SCADA and operational technology systems and wireless networks | xix | Attacks or suspicious activity affecting big data, blockchain, virtual assets, exchanges, custodian wallets, robotics, 3D and 4D printing, additive manufacturing and drones |
| x | Attacks on applications such as e-governance, e-commerce | xx | Attacks or malicious or suspicious activity affecting systems related to artificial intelligence and machine learning |
Reports go to [email protected], with phone 1800-11-4949 and fax 1800-11-6969 listed in the Directions. The list is broad: "unauthorised access", "suspicious activity affecting cloud systems" and phishing capture events that many global programmes would treat as routine. Define in advance how your SOC triage categories map to each Annexure I item, so the six-hour decision is mechanical. See the Cyber Incident Reporting Requirements Map for how this compares with other regimes.
Timeline and current status
| Date | Event |
|---|---|
| 28 April 2022 | CERT-In issues the Directions under section 70B(6) |
| 18 May 2022 | CERT-In publishes FAQs on the Directions (date as reported by AZB and Partners) |
| 27 June 2022 | Directions take effect (60 days after issue); CERT-In extends timelines for MSMEs and for the subscriber validation mechanism |
| 25 September 2022 | Extended deadline for MSMEs and for data centre, VPS, cloud and VPN subscriber records (date as reported by AZB and Partners) |
| 30 November 2023 | Jan Vishwas (Amendment of Provisions) Act 2023 changes to the IT Act take effect, raising the section 70B(7) fine |
| 25 July 2025 | CERT-In Comprehensive Cyber Security Audit Policy Guidelines issued; auditors must verify compliance with the 2022 Directions in every audit |
The audit guidelines (as summarised by AZB and Partners) expect audits at least annually by CERT-In-empanelled auditors, with more frequent audits where sector regulators require them, so compliance with the six-hour, log and NTP directions is now tested routinely rather than only after an incident. The Digital Personal Data Protection regime adds its own breach duties for personal data, separate from CERT-In reporting; see the India DPDP Act Guide. Regulated financial entities also follow sector rules such as the SEBI CSCRF Guide and the RBI Cyber Security Framework and IT Governance Guide.
Enforcement and penalties
- Legal hook: the Directions state that failure to furnish information or non-compliance may invite punitive action under section 70B(7) of the IT Act and other applicable laws.
- Before 30 November 2023: imprisonment of up to one year, a fine of up to Rs 1 lakh, or both.
- Since 30 November 2023: the Jan Vishwas Act substituted Rs 1 crore for Rs 1 lakh, as reported by legal commentaries (the official schedule text was not checked). Reproductions of the amended section still show imprisonment of up to one year as an alternative, while some commentaries describe the offence as decriminalised; check the official gazette text before relying on either reading.
- Officer liability: AZB and Partners note that, where a company commits an offence under the IT Act, responsible officers can also be held liable.
- Information on demand: failure to act on a CERT-In order under direction (iv) is itself treated as non-compliance, so slow log retrieval is a breach in its own right.
What it means for AI agents and non-human identities
Several Annexure I categories describe identity events: unauthorised access to IT systems or data, identity theft and spoofing, unauthorised access to social media accounts, and suspicious activity in cloud systems. Most of these now happen through machine credentials, and item (xx) explicitly covers AI and machine learning systems.
- Leaked keys are reportable events: an exposed API key or cloud access key that is used by an outsider is unauthorised access under item (iii) and possibly a data leak under item (xii). The Indian Government breach found in 2021 involved exposed .git and .env files that leaked 35 credential pairs and five RSA private keys. See the Cloud Access Key Leak Playbook.
- Log machine identities, not only users: "logs of all ICT systems" includes cloud audit trails, API gateway logs, secrets manager access logs and agent tool-call logs. Without them, the six-hour report cannot say what a compromised token touched.
- Timestamps make correlation possible: NTP traceability matters most for machine activity, where thousands of API calls per minute must be ordered across systems. See the NTP Security Guide.
- AI systems are named: prompt injection leading to data exposure, model or agent misuse, or suspicious activity in an ML pipeline falls under item (xx). Agent deployments need logs that tie each action to the agent identity and the human or system that invoked it. See the AI Agent Incident Response Playbook.
- Provider records include machine-facing data: cloud and VPS providers' five-year records cover IPs allotted and registration IPs and timestamps, which helps attribution when a customer's workload identity is abused.
Compliance steps
- Confirm applicability: list Indian entities, systems serving Indian users and any role as a data centre, cloud, VPS, VPN or virtual asset provider.
- Register the point of contact: submit the Annexure II details, use a role mailbox and a rota, and review it whenever staff change.
- Map triage to Annexure I: add a CERT-In flag to the incident classification so that any event matching the 20 types starts a six-hour clock at detection.
- Prepare the first report: a short template with what is known (time noticed, type, systems, initial indicators), with CERT-In's form fields pre-filled, to be followed by updates.
- Fix time sources: configure NTP hierarchies to NIC or NPL or traceable servers, monitor drift, and record configuration evidence for auditors.
- Retain logs in India: set retention to at least 180 days for every ICT log source, with a copy in an Indian region or data centre, protected from tampering. See the Log Management and Retention Guide.
- Test retrieval: rehearse producing a defined log set within hours, as direction (iv) can demand near real-time formats.
- Provider duties: if you are a cloud, VPS, VPN or virtual asset provider, implement validated onboarding and five-year retention of the listed fields.
- Audit: include the Directions in the annual CERT-In-empanelled audit scope and track findings to closure.
Decision guidance
| Situation | Approach | Trade-off |
|---|---|---|
| Global SaaS with Indian customers, logs in a non-Indian region | Replicate the relevant log sources to an Indian region for 180 days | Storage and egress cost; avoids re-architecting the primary SIEM |
| Indian subsidiary of a multinational with a global SOC | Global SOC flags India-scope incidents; local PoC submits within six hours | Needs clear hand-off; time zones can eat the six hours |
| Uncertain whether an event is reportable | Report early with partial information and update | Volume of reports versus the risk of missing the window |
| Small MSME | Use a managed SOC or MSSP with an explicit six-hour reporting commitment and Indian log retention | Dependence on the provider; keep the PoC role in house |
Measurement and framework mapping
- Metrics: percentage of reportable incidents reported within six hours of detection; median time from detection to CERT-In report; log sources with 180 days retained in India; hosts and appliances synchronised to NIC, NPL or traceable sources with drift under a set threshold; time to produce a requested log set; machine identities whose activity is logged with identity attribution.
| Direction | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| (i) NTP synchronisation | SC-45, AU-8 | PR.PS-04 | A.8.17 |
| (ii) Six-hour reporting | IR-6 | RS.CO-02 | A.5.24, A.5.26 |
| (iii) Point of contact | IR-7 | RS.MA-01 | A.5.5 |
| (iv) Information on demand | IR-4 | RS.AN-03 | A.5.28 |
| (v) 180-day logs | AU-11, AU-9 | PR.PS-04 | A.8.15 |
| (vi), (vii) Subscriber and KYC records | SI-12 | GV.OC-03 | A.5.33 |
Common failure patterns
- Starting the clock at confirmation: waiting for forensics to finish when the Directions count from noticing.
- Default log retention: SaaS and cloud log tiers that keep 30 or 90 days, or keep logs only outside India.
- Unmonitored PoC mailbox: CERT-In orders under direction (iv) sent to a former employee or an unread alias.
- Unsynchronised appliances: network and OT devices left on factory time sources, making timelines unreliable.
- Machine activity not logged: API keys and service accounts used without audit logging, so unauthorised access cannot be scoped or reported accurately.
Practitioner checklist
- Decide which entities and systems are in scope and record the reasoning.
- Submit and maintain the Annexure II point of contact.
- Map SOC categories to the 20 Annexure I incident types.
- Run a six-hour reporting drill from detection to submission.
- Synchronise time to NIC, NPL or traceable NTP servers and monitor drift.
- Retain all ICT logs for 180 days with a copy in India.
- Log API keys, service accounts, cloud roles and AI agents with identity attribution.
- Test producing logs for CERT-In within hours.
- Apply five-year subscriber or KYC retention if you are a covered provider.
- Include the Directions in the annual CERT-In-empanelled audit.
Standards and references
- CERT-In: Directions under Section 70B(6) of the IT Act, 28 April 2022
- CERT-In: Directions, FAQs and Extension Notices
- Courtbook: Information Technology Act 2000, Section 70B (as amended)
- AZB and Partners: CERT-In Directions
- Lexplosion: Jan Vishwas Act Amendments to the IT Act from 30 November 2023
- AZB and Partners: CERT-In Cyber Security Audit Guidelines Decoded
Related NHI Mgmt Group resources: Breach Notification Laws by Country Guide · India DPDP Act Guide · Cyber Incident Reporting Requirements Map · Log Management and Retention Guide. This guide summarises the CERT-In Directions of 28 April 2022 and related amendments as of October 2026 and is not legal advice.