What the CERT-In six-hour rule asks of you.

Who the Directions apply to

CERT-In issued the Directions under sub-section (6) of section 70B of the Information Technology Act, 2000. They apply to service providers, intermediaries, data centres, body corporates and government organisations. In practice that is every company in India with computer systems. They took effect sixty days after issue, on 27 June 2022. For micro, small and medium enterprises, and for some of the subscriber-record duties on data centres and cloud providers, the date was deferred to 25 September 2022.

The six hours

Three things in that sentence decide how it plays out. The clock starts when you notice or are told, not when you confirm. The list in Annexure I is specific and long: data breaches and leaks, ransomware, denial of service, unauthorised access, defacement, and attacks on critical systems, cloud, IoT and AI systems among them. And the report goes to CERT-In by email, phone or fax, with a timestamp. A regulated entity may have a second clock running for the same incident: the RBI Directions for NBFCs, for example, ask for a report on the DAKSH platform within six hours of detection as well.

A named point of contact

This is the duty most often found missing when an auditor asks. It costs nothing and it is the first thing CERT-In will use if it ever writes to you. When CERT-In issues an order or asks for information during an incident, you are expected to act within the time it sets.

Synchronised clocks

A six-hour window is only meaningful if the timestamps in your logs agree with each other and with the regulator's. The evidence an auditor accepts is the NTP configuration and a clock-sync check.

Logs for 180 days, in India

Two words carry the weight: rolling and India. Logs must be kept continuously, not switched on after an incident, and they must stay within Indian jurisdiction. For a business whose logging runs through a vendor abroad, this is the clause to check first.

Subscriber records for infrastructure providers

Data centres, virtual private server providers, cloud providers and VPN providers must keep validated subscriber records for five years or more after a service ends: name, period of hire, allotted IPs, registration details, purpose, validated address and contact, and ownership pattern. Virtual asset service providers must keep KYC and transaction records for five years. Most businesses are customers of these providers rather than providers themselves, and will meet these duties through their contracts.

Direction (v) and Direction (vi) with Annexure III.

What happens if you do not

Failure to furnish information CERT-In asks for, or to comply with the Directions, may attract punitive action under section 70B(7) of the IT Act, 2000 and any other applicable law.

What this looks like as evidence

For the six-hour rule, an incident response procedure that names the twenty incident types and the reporting route, and a record of each report with its timestamp. For the point of contact, the Annexure II submission. For clocks, the NTP configuration. For logs, the retention setting and a sample showing 180 days. These are the documents an auditor asks for, and they are what AuditSahi asks you to upload for this rulebook.