Quick Answer
CERT-In compliance means meeting the Directions issued on 28 April 2022 under Section 70B(6) of the Information Technology Act, 2000. In practice that comes down to five things: report qualifying cyber incidents to CERT-In within six hours of noticing them, retain 180 days of security logs inside India, synchronise all system clocks to trusted Indian NTP sources, keep prescribed customer and subscriber records if you are a service provider, and name a 24×7 point of contact. It applies to every body corporate operating in India, with no turnover or headcount threshold.
Who Actually Has to Comply
This is the question most businesses get wrong, because the Directions are usually reported as a rule for VPN providers and crypto exchanges. They are broader than that.
- Every body corporate providing digital services in India, regardless of size. There is no minimum revenue or employee count.
- Service providers, intermediaries and data centres, including hosting and colocation.
- Cloud service providers and VPN providers, who carry additional customer record-keeping obligations.
- Virtual asset service providers and exchanges.
- Government organisations and their contractors.
If your business runs email, a website, a customer database or a VPN for staff, you are in scope. A 40-person company in Noida has the same six-hour reporting obligation as a listed enterprise; what differs is the scale of the machinery you need behind it.
The Six-Hour Incident Reporting Rule
The clock starts when the incident is noticed or brought to your attention, not when it is confirmed, contained or fully understood. That distinction is what catches most organisations out: teams wait until they know the full story, and by then the window has closed.
Which incidents are reportable
- Unauthorised access to IT systems or data.
- Compromise of critical systems or information.
- Malware and ransomware infections.
- Denial-of-service and distributed denial-of-service events.
- Identity theft, spoofing and phishing attacks.
- Data breaches, leaks and exfiltration.
- Attacks on web servers, applications, APIs and databases.
- Supply-chain compromises affecting your software or vendors.
- Attacks on operational technology and industrial control systems.
What a first report needs to contain
CERT-In publishes a reporting format, but the practical minimum is: what was observed, when it was observed, which systems and how many users are affected, what has been done so far, and who at your organisation is handling it. An incomplete report filed inside six hours is compliant. A perfect report filed on day three is not.
How to make six hours achievable
Six hours is not a technology problem, it is a process problem. The organisations that meet it have three things in place before an incident: monitoring that surfaces the event quickly, a named person authorised to file without waiting for a management meeting, and a pre-drafted report template with the account details already filled in. Continuous monitoring through SOC support or managed detection and response is what turns detection from an accident into a process.
The 180-Day Log Retention Rule
Every in-scope organisation must enable logs for all its ICT systems, retain them securely for a rolling 180 days, and keep them within Indian jurisdiction. Logs must be producible to CERT-In on request during an investigation.
Which logs actually matter
- Firewall, IDS/IPS and web application firewall logs.
- Endpoint detection and response telemetry from laptops and servers.
- Identity provider and directory logs — sign-ins, MFA challenges, privilege changes.
- VPN and remote access gateway logs.
- Application and API access logs.
- Database activity logs for systems holding personal or financial data.
- Cloud provider audit trails for every tenant and subscription you run.
The two mistakes that break log compliance
The first is default retention. Most firewalls, cloud audit trails and SaaS platforms keep 30 to 90 days out of the box, so a business that has changed nothing is already short of 180. The second is residency: a SIEM or logging SaaS that stores data in Singapore, Ireland or the United States does not satisfy a requirement to hold logs within India. Both are configuration decisions, and both cost money — retention is usually the single largest line in a managed SOC quote, which is why it should be settled before you sign rather than discovered afterwards.
Time Synchronisation
All servers, network devices and endpoints must synchronise their clocks to NTP sources maintained by the National Informatics Centre or the National Physical Laboratory, or to sources traceable to them. Organisations with global infrastructure may use their own sources provided they do not deviate from those references.
This sounds like a formality until an investigation begins. If the firewall, the domain controller and the application server disagree by minutes, an incident timeline cannot be reconstructed and log evidence loses much of its value. Set it once, then monitor for drift.
Record-Keeping Obligations for Service Providers
If you operate as a data centre, cloud provider, VPN provider or virtual asset service provider, the Directions add customer record-keeping on top of the general obligations. Validated subscriber and customer records — identity details, corporate ownership, addresses, allocated IP addresses, timestamps of use and authorised contact details — must be maintained for a prescribed period, commonly five years after the engagement ends, even if the customer has cancelled.
Ordinary businesses consuming these services are not caught by this clause, but they are affected by it: it is why Indian providers now ask for far more onboarding documentation than they used to.
Point of Contact and Penalties
Every in-scope organisation must nominate a point of contact for CERT-In correspondence and keep the details current. In practice you want a named coordinator with a documented alternate, because the obligation runs around the clock.
Non-compliance is not a civil-penalty regime. Failure to comply with a Direction issued under Section 70B(6) is an offence under Section 70B(7) of the IT Act, punishable with imprisonment of up to one year, a fine of up to ₹1 lakh, or both. The realistic exposure for most businesses is not prosecution — it is being unable to answer CERT-In during an investigation, and the contractual and reputational consequences that follow.
CERT-In and the DPDP Act Are Different Obligations
These two regimes are routinely conflated, and they are not the same.
- CERT-In is about cyber incidents and national response. It applies to any digital system, personal data or not, and its reporting deadline is six hours to CERT-In.
- The DPDP Act is about personal data. It requires notification to the Data Protection Board and to affected individuals, with a detailed report to the Board within 72 hours. The obligations that fall on IT are set out in our DPDP Act compliance checklist.
- A single ransomware event can trigger both. Six hours to CERT-In, plus notification to the Board and to affected data principals. Two clocks, two audiences, one incident — which is why the escalation runbook needs both routes written into it.
What CERT-In Readiness Looks Like Technically
- Centralised logging with 180-day retention on Indian infrastructure, covering the sources listed above. In most estates this means a SIEM or a managed logging service rather than device-local storage.
- Detection with human triage. Logs that nobody reads do not produce a six-hour report.
- NTP configured and monitored across servers, network devices and endpoints.
- An incident runbook naming who declares an incident, who files with CERT-In, who notifies the Data Protection Board, and who talks to customers.
- An asset inventory, because you cannot report scope for systems you have not listed.
- Regular testing. A scoped VAPT finds the exposure before an attacker does, and a tabletop exercise proves the six-hour path works.
CERT-In Empanelled Auditors: What Empanelment Actually Means
CERT-In maintains a list of empanelled information security auditing organisations. Empanelment means the auditor has been assessed by CERT-In and is authorised to conduct audits for government bodies and for organisations that are required to use an empanelled auditor by a regulator or a customer contract.
It does not mean an empanelled auditor is automatically better at penetration testing than a specialist boutique, and it does not mean every business needs one. You need an empanelled auditor when a regulator, a government tender or an enterprise customer specifies it. Otherwise, judge on scope, methodology and reporting quality — the criteria are set out in our guide to choosing a cyber security partner in Noida. Empanelment is also time-bound and cycle-based, so verify current status on the CERT-In list rather than trusting a logo on a proposal.
A 60-Day CERT-In Readiness Plan
- Days 1–10. Inventory systems and log sources. Record current retention on each, and where that data physically sits.
- Days 11–20. Fix residency and retention. Move or duplicate logging into Indian infrastructure and extend retention to 180 days on the sources that matter.
- Days 21–30. Configure NTP across the estate and add drift monitoring.
- Days 31–40. Write the incident runbook. Name the CERT-In point of contact and the alternate; pre-fill the reporting template.
- Days 41–50. Turn on triage. Either staff it internally or contract managed monitoring so alerts are reviewed around the clock.
- Days 51–60. Run a tabletop exercise on a simulated ransomware incident and time the path from detection to a filed report. Fix whatever took too long.
Frequently Asked Questions
What is CERT-In compliance?
CERT-In compliance means meeting the Directions issued on 28 April 2022 under Section 70B(6) of the IT Act, 2000: reporting qualifying cyber incidents within six hours, retaining 180 days of security logs within India, synchronising system clocks to Indian NTP sources, maintaining prescribed customer records where applicable, and nominating a point of contact.
Who has to comply with the CERT-In Directions?
Every body corporate, service provider, intermediary, data centre, cloud provider, VPN provider, virtual asset service provider and government organisation operating in India. There is no minimum company size, turnover or revenue threshold.
How quickly must a cyber incident be reported to CERT-In?
Within six hours of noticing the incident or being made aware of it. The clock starts at awareness, not at confirmation, so an incomplete report filed inside the window is better than a complete one filed late.
How long must logs be retained under CERT-In rules?
A rolling 180 days, stored within Indian jurisdiction and producible to CERT-In on request. Default retention on most firewalls, cloud audit trails and SaaS platforms is shorter, so this usually requires a configuration change and additional storage budget.
What is the penalty for CERT-In non-compliance?
Failure to comply with a Direction issued under Section 70B(6) is an offence under Section 70B(7) of the IT Act, punishable with imprisonment of up to one year, a fine of up to ₹1 lakh, or both.
Is CERT-In compliance the same as DPDP Act compliance?
No. CERT-In covers cyber incidents on any digital system and requires reporting to CERT-In within six hours. The DPDP Act covers personal data and requires notification to the Data Protection Board and affected individuals, with a detailed report to the Board within 72 hours. One incident can trigger both.
Do we need a CERT-In empanelled auditor?
Only when a regulator, government tender or customer contract requires one. Empanelment authorises an organisation to audit government bodies and regulated entities; for ordinary commercial testing, scope and methodology matter more than the empanelment badge.
Does CERT-In apply to small businesses and startups?
Yes. The Directions contain no size threshold. A small business meets the same six-hour reporting and 180-day log retention obligations, usually by outsourcing monitoring and log retention rather than building them in-house.
Getting CERT-In Ready
Most of the gap between where a business is and where the Directions expect it to be is logging and monitoring: retention that is too short, logs held outside India, and nobody watching them out of hours. Novotron builds and runs that layer for businesses across Delhi NCR from its office at Aycon Tower, Sector 135, Noida — centralised logging with compliant retention, 24×7 monitoring, incident runbooks and the testing that proves they work. Call +91 81300 09878 or email sales@novotrontech.com for a readiness review.
CERT-In reporting sits alongside a wider information security management system. If clients are also asking for certification, our breakdown of the ISO 27001 certification cost in India shows what that programme involves and what it costs.