Quick answer
Under the CERT-In Directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, organisations must report specified cyber security incidents to CERT-In within six hours of noticing them or being told of them. Failure to comply with CERT-In directions can attract penalties under section 70B(7). The clock runs from the first employee who notices.
Key takeaways
- CERT-In expects specified cyber incidents, such as ransomware, data breaches, phishing and unauthorised access, to be reported within six hours of noticing them.
- The six hours are counted from when anyone in the organisation notices the incident, not from when the security team confirms it.
- The Directions also require organisations to keep ICT system logs for 180 days and to nominate a point of contact for CERT-In.
- Non-compliance with CERT-In directions can lead to punishment under section 70B(7) of the IT Act, so this is a legal duty and not only good practice.
- The six-hour rule is a people problem first: staff must know what to report, to whom, and that speed beats certainty.
Most Indian companies have an incident response plan. Far fewer have tested whether an ordinary employee knows that the plan exists, or that a statutory clock may already be running. The CERT-In reporting rule turns the first few minutes of an incident into a compliance question.
What is the CERT-In six-hour reporting rule?
On 28 April 2022, the Indian Computer Emergency Response Team (CERT-In) issued directions under section 70B(6) of the Information Technology Act, 2000. They require service providers, intermediaries, data centres, body corporates and government organisations to report listed cyber incidents to CERT-In within six hours of noticing them or being brought to notice of them. The CERT-In website carries the Directions and the reporting channels.
The list of reportable incidents is broad. It includes ransomware, data breaches and data leaks, unauthorised access to IT systems or data, compromise of critical systems, phishing attacks, attacks on servers and applications, and malicious code attacks. Read the current list on the CERT-In site with your legal team and map it to your own environment.
| Duty | What it requires | Why it matters for staff training |
|---|---|---|
| Report incidents | Notify CERT-In within six hours of noticing a listed incident | The first person to notice starts the clock |
| Keep logs | Maintain ICT system logs for 180 days, within Indian jurisdiction | Logs prove what happened and when |
| Point of contact | Nominate a person to liaise with CERT-In | Staff need one name and number to escalate to |
| Penalty | Non-compliance with directions can be punished under section 70B(7) of the IT Act | The duty sits with the organisation, not only IT |
Who starts the six-hour clock?
The Directions speak of noticing an incident or being brought to notice of it. A cautious reading is that the clock can start when anyone in the organisation becomes aware, including a junior employee, a helpdesk agent or a vendor. Ask your counsel how your company will interpret this, and design your process on the safe assumption that early awareness counts.
How Reporting Fails
- “IT will see it on Monday”
- Staff wait until they are certain it is an attack
- No after-hours number or mailbox
- Fear of being blamed for a click
- Vendors do not pass on their alerts
- Incident plan lives in a folder nobody opens
How Reporting Works
- Staff report suspicion first, certainty later
- One 24x7 number and mailbox on every desktop
- A no-blame rule for prompt reports
- A named CERT-In point of contact with a deputy
- Vendor contracts with a short alert period
- Quarterly drills with a timer
Which incidents do employees miss or sit on?
Phishing clicks and credential entry
An employee who enters a password on a fake login page often says nothing, hoping it was harmless. That silence is the most expensive habit in security. Our article on deepfake and voice-clone scams shows how convincing these attempts have become.
Ransomware symptoms
Renamed files, a ransom note or systems that suddenly slow down are all signals. Staff should disconnect from the network if told to and call the escalation number, rather than trying to fix it themselves.
Lost devices and unusual access alerts
A lost laptop, a login alert from an unfamiliar location, or a colleague’s account sending odd messages should all be escalated at once. The security team can decide whether the event is reportable.
How do you build a six-hour reporting process that works?
Make escalation one step
Give every employee a single phone number and email address that is monitored around the clock, and put it on the login screen, the intranet and the ID card.
Separate reporting from blame
Tell staff that reporting a suspected incident quickly will never be penalised, even if it turns out to be nothing. Reserve discipline for concealment.
Pre-fill the CERT-In report
Keep a draft template with your contact details and the fields CERT-In asks for, so the nominated officer can file in minutes. Check the current format on the CERT-In website.
Drill with a timer
Run a quarterly exercise from “employee notices” to “report filed”, and record how many hours it takes. Fix the slowest step first. Our Information Security Awareness course trains staff on what to spot and report, and the information security training hub collects the related guides.
What should you do this week?
Ask five employees from different departments what they would do if their screen showed a ransom note at 9 pm. If any of them cannot name the number to call, your six hours are already at risk, and that is a gap you can close with a short briefing.
Frequently asked questions
What is the CERT-In six-hour reporting rule?
The CERT-In Directions of 28 April 2022 require organisations to report specified cyber security incidents to CERT-In within six hours of noticing them or being brought to notice of them.
Which law are the CERT-In Directions issued under?
They are issued under section 70B(6) of the Information Technology Act, 2000, which empowers CERT-In to call for information and give directions to service providers, intermediaries, data centres and body corporates.
How long must ICT logs be kept under the CERT-In Directions?
The Directions require ICT system logs to be maintained securely for a rolling period of 180 days within Indian jurisdiction. Confirm the details with your security and legal teams.
What is the penalty for not following CERT-In directions?
Section 70B(7) of the IT Act provides for punishment for failure to provide information or comply with directions, including imprisonment of up to one year or a fine up to Rs 1 lakh, or both. Check the current text of the section.
Do employees need to be trained on incident reporting?
Yes in practice. The six-hour period is hard to meet unless every employee knows what to report and whom to call. Training and drills are the usual way to build that habit.
Sources
Make sure the first person to see an incident knows what to do next.
See how role-based information security training helps your teams spot, escalate and report cyber incidents inside the CERT-In window. Book a walk-through with our team.
Request Demo