In April 2022 India's Computer Emergency Response Team issued binding directions on reporting cyber incidents within six hours, keeping logs for 180 days inside India, synchronising system clocks and naming a point of contact. They apply to service providers, intermediaries, data centres, bodies corporate and Government organisations.
Free account needed to download. You come straight back to the file.
Who it is for. Service providers, intermediaries, data centres, bodies corporate and government organisations in India, and the foreign providers that serve users in India.
What this list covers. CERT-In Directions dated 28 April 2022, with later FAQs: 7 directions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Dir. 1 | Synchronise system clocks | Connect the clocks of all ICT systems to the NTP servers of the National Informatics Centre or the National Physical Laboratory, or to servers traceable to them. |
| Dir. 2 | Report incidents within six hours | Report listed types of cyber incident to CERT-In within six hours of noticing them or being told of them. |
| Dir. 3 | Name a point of contact | Designate a point of contact to interface with CERT-In and give CERT-In their details. |
| Dir. 4 | Keep logs for 180 days in India | Enable logs of all ICT systems and keep them securely for a rolling period of 180 days within Indian jurisdiction, and produce them to CERT-In on request. |
| Dir. 5 | Keep subscriber records | Data centres, cloud, VPS and VPN service providers must register accurate subscriber information and keep it for five years or longer after the relationship ends. |
| Dir. 6 | Virtual asset records | Virtual asset service providers, exchanges and custodian wallet providers must keep know-your-customer and transaction records for five years. |
| Dir. 7 | Provide information on request | Provide the information and assistance CERT-In asks for in its work on incident response and protection, within the time it states. |
CERT-In lists the types in an annexure to the directions, including targeted scanning, compromise of critical systems, data breach, data leak, ransomware, website defacement and attacks on cloud systems. Check the current annexure.
It starts when you notice the incident or are made aware of it. You may add details later, but the first report should not wait for a full investigation.
Within Indian jurisdiction, for a rolling 180 days. This is one reason many organisations keep security logs in an Indian region.
No. This is a plain-English summary of the main obligations. Read the directions and CERT-In's FAQs before you rely on it.