Business
The directions are binding on you now. Here is how to meet them without a new department.
The CERT-In directions of 28 April 2022, issued under section 70B of the IT Act, require all service providers, intermediaries, data centres, body corporates and government organisations to report specified incidents within six hours, keep ICT system logs for 180 days within India, synchronise clocks to NIC or NPL time, and, for certain providers, keep customer records for five years. We turn each requirement into something your team can run and evidence.
- Readiness assessment against every clause of the directions and the CERT-In FAQs
- Six-hour reporting process with roles, templates and the CERT-In incident form filled in advance
- Log retention design using what you already have, with 180-day coverage and India residency
- Evidence file for auditors, regulators, customers and insurers
Fixed price for the readiness assessment; implementation support quoted after it. Logging design reviewed against your existing tools before recommending anything new.
Typical engagement
- Assessment
- Implementation support
- Drill
- Evidence and review
Who this is for
- Any Indian company that has never formally addressed the directions
- SaaS, hosting, VPN, cloud, data-centre and VPS providers with KYC and record-keeping duties
- NBFCs, fintechs and brokers whose RBI or SEBI inspections now ask about CERT-In reporting
- Hospitals, schools and institutions with outsourced IT that nobody has asked about logs
- Companies that have reported an incident late and want to prevent a repeat
- Organisations preparing for ISO 27001 or SOC 2 who want the Indian requirements folded in
What is included
Readiness assessment
Clause-by-clause review of the directions and FAQs against your systems, providers and practices, with a gap list and a plan.
Incident reporting process
Definitions of the reportable incident types in your context, an on-call decision path, the CERT-In reporting template pre-filled with your organisation details, and a drill so the six-hour clock is understood.
Logging and retention
Which logs the directions cover for you, where they live today, how to retain them for 180 days in India, and how to make them retrievable when CERT-In or the police ask. Designed around your existing tools where possible.
Time synchronisation
NTP configuration to NIC or NPL servers (or a documented equivalent) across servers, network devices and cloud, with a check script.
Provider KYC and records
For VPN, cloud, data-centre and VPS providers: the customer information to be collected and retained, the retention period, and the process for lawful requests.
Evidence pack
Policies, configuration evidence, drill records and a one-page statement of compliance you can hand to auditors, customers and insurers.
How we work
Assessment
Interviews with IT and the providers you depend on, a review of logging and time settings, and a report with gaps and a plan within two weeks.
Implementation support
Process documents, configuration guidance and templates delivered; your team implements with our help.
Drill
A tabletop exercise on a realistic incident to test the six-hour process and the log retrieval.
Evidence and review
Evidence pack assembled and a review date set, usually annually or when systems change.
What you walk away with
- A documented position on every clause of the directions, with evidence
- A team that knows what to report, to whom, and by when
- Logs you can produce for 180 days when an investigator asks
- A requirement that regulators and customers increasingly check, answered once and reused
What we do not do
We would rather lose an enquiry than mislead you.
- We do not report incidents on your behalf unless engaged for incident response; the duty remains yours
- We do not resell logging products; we design around what you have and recommend only where there is a gap
- We cannot waive or interpret the directions on CERT-In's behalf; where a clause is unclear we say so and document a reasonable position
Frequently asked questions
Does the six-hour rule really apply to a small company?
Yes. The directions apply to all service providers, intermediaries, data centres, body corporates and government organisations, with no size threshold. The six hours run from noticing the incident or being brought to notice of it. What changes with size is the simplicity of the process, which can be a one-page decision path and a template.
Which incidents have to be reported?
The directions list types including targeted scanning, compromise of critical systems, unauthorised access to data, website defacement, malware and ransomware, identity theft and phishing, data breaches and leaks, attacks on applications and servers, and attacks on cloud, IoT and payment systems. We map each to what it would look like in your environment.
We use a cloud provider. Are logs their responsibility?
Partly. The provider retains logs for its own systems; you are responsible for logs of your applications, accounts and infrastructure on that cloud, including retaining them for 180 days within India. Most cloud platforms can do this with configuration, which we specify.
What are the consequences of not complying?
Non-compliance with directions under section 70B of the IT Act is an offence, and regulators such as the RBI and SEBI treat CERT-In reporting as part of their own expectations. Practically, the larger risk is a late or absent report during a real incident, when the question will be asked.
Tell us what you run and where
Systems, cloud providers, whether you are a VPN, hosting or data-centre provider, and any regulator asking. We reply with a scope and fixed price within two working days.