The CERT-In directions: a six-hour clock, and two duties that bind you before anything happens

They are Direction No. 20(3)/2022-CERT-In, issued on 28 April 2022 by the Indian Computer Emergency Response Team under sub-section (6) of section 70B of the Information Technology Act, 2000. They are directions with statutory force, not guidance.

There are five operative obligations, and only one of them is about reporting. The other four are standing duties: synchronise your clocks, keep logs, designate a point of contact, and — for a defined set of providers — keep subscriber records for five years.

The breadth is in who they bind: "service providers, intermediaries, data centres, body corporate and Government organisations". The phrase that catches people is "body corporate". It is not a technology-sector term, and an Indian company that runs ordinary IT is a body corporate.

The direction requires an entity to "mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents or being brought to notice about such incidents".

Read the second half again. The clock starts when you notice, or when you are told — by a customer, a researcher, a journalist, or a regulator. It does not start when you have confirmed what happened, sized the blast radius, or decided what to say. Six hours is not an investigation window; it is a notification window, and the report you file at hour five will necessarily be incomplete.

That is the design. The practical consequence is that the decision to report cannot be an escalation up a chain that needs a director's sign-off — not because escalation is wrong, but because six hours does not survive it. The organisations that meet this have decided in advance who may file, on what evidence, without waiting.

Annexure I lists twenty reportable incident types. They run wider than a breach: targeted scanning or probing of critical networks, unauthorised access, malicious code, identity theft and phishing, attacks on IoT devices, attacks on cloud and application systems, and unauthorised access to social media accounts, among others. Several of those occur on networks every week.

Because it is retrospective. Clause (iv) requires entities to "mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days and the same shall be maintained within the Indian jurisdiction", to be provided to CERT-In with an incident report or when directed.

Two halves, and both bite. A rolling 180 days means that on the day an incident is reported, the six months behind it must already exist — a retention policy changed after the event produces nothing. Held within the Indian jurisdiction means a default cloud configuration that ships logs to a region outside India does not satisfy it, however well those logs are kept.

This is the obligation most often discovered during an incident, which is the worst moment to discover it, and it is the one that takes longest to fix.

Clause (i) requires connecting to the NTP server of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to NTP servers traceable to them, for synchronisation of all ICT system clocks.

There is an accommodation for organisations spanning several geographies: they "may also use accurate and standard time source other than NPL and NIC, however it is to be ensured that their time source shall not deviate from NPL and NIC". So a global time source is acceptable where it agrees with the Indian one.

It reads like housekeeping, and it is the quiet foundation of everything else. Logs from systems whose clocks disagree cannot be put in order, and a reconstruction that cannot be ordered is not evidence of anything.

Clause (v) binds a narrower set: data centres, Virtual Private Server providers, cloud service providers and VPN service providers. They must register and maintain subscriber information for five years — or longer where another law requires it — and the clock runs from the point a registration is cancelled or withdrawn, not from when it started.

What must be kept includes validated names of subscribers, the period of hire with dates, the IP addresses allotted to and used by them, the email address, IP address and timestamp used at registration, the purpose for hiring the service, and validated addresses and contact numbers.

If you resell or operate any of those services, this is a data retention obligation attached to your customer records, and it interacts with everything you have told those customers about deletion.

No, and this is worth knowing because it is frequently stated wrongly. The directions were issued on 28 April 2022 and became effective 60 days later, in late June 2022.

A further direction of 27 June 2022 pushed two things to 25 September 2022: the directions as a whole for Micro, Small and Medium Enterprises as classified under the MSME notification of 1 June 2020, and the subscriber-validation mechanism at clause (v)(a) and (f) for data centres, VPS, cloud and VPN providers.

Both dates are long past. The only reason they matter now is that an organisation which concluded in 2022 that it had more time may never have revisited the conclusion.

No. They are different regimes, with different triggers, different recipients and different clocks, and satisfying one does not satisfy another. A single event can start all three.

CERT-In is a cyber-incident direction: it is triggered by the incident types in Annexure I, reported to CERT-In, within six hours. Data protection breach notification is triggered by the involvement of personal data, reported to a data protection authority and often to the individuals affected, on its own timeline. We set out the data protection side separately, in our article on breach notification timelines.

The practical shape is one detection process with three outputs, not three processes. What decides whether you can run it is the same set of things in every case: who is allowed to declare an incident, what evidence exists, and whether the clocks on that evidence agree.

The direction states that non-compliance "may invite punitive action under sub-section (7) of the section 70B of the IT Act, 2000 and other laws as applicable".

We are not going to characterise your exposure under that provision — that is a legal question for a lawyer who practises it. What we can say from doing this work is that the operational question arrives long before the legal one. An organisation that cannot produce 180 days of ordered logs cannot answer CERT-In's follow-up whatever its intentions were.