CERT-In Directions 2022
CERT-In Directions under Section 70B(6) of the IT Act (28 April 2022)
Directions from India's national CERT that set one of the world's shortest incident reporting windows, plus log retention and clock synchronisation duties.
In force: Issued 28 April 2022; in force after a short extension for some entities
Who it applies to
Service providers, intermediaries, data centres, body corporates and government organisations, with additional duties for VPN, VPS, cloud, crypto-asset and certain other providers.
Key requirements
- Report listed types of cyber incidents to CERT-In within 6 hours of noticing them or being told about them.
- Keep ICT system logs securely for a rolling 180 days within Indian jurisdiction.
- Synchronise system clocks to the NTP servers of NIC or NPL, or to sources traceable to them.
- Designate a point of contact to liaise with CERT-In.
- Data centre, VPS, cloud and VPN providers retain specified subscriber information for 5 years.
Breach and incident notification
Reportable cyber incidents go to CERT-In within 6 hours of noticing them.
Penalties
Non-compliance can be punished under section 70B(7) of the IT Act, which provides for fines and imprisonment.
Related frameworks
Shows up on these exams
Official source
CERT-In: Directions under section 70BNot legal advice
This is a study summary, not legal advice. Laws and their guidance change, and obligations depend on your facts and jurisdiction. Check the official source and the current, dated text, and consult a qualified lawyer before acting.
Go deeper
Breach timeline lab
Practise this topic hands-on.
Compliance obligations lab
Practise this topic hands-on.
DPDP Act
India - Privacy & data protection
IT Act 2000
India - Cybercrime
NIS2
European Union - Cybersecurity & incident reporting
EU CRA
European Union - Cybersecurity & incident reporting
EU Cybersecurity Act
European Union - Cybersecurity & incident reporting
FISMA
United States (federal) - Cybersecurity & incident reporting