CERT-In Rules: 6-Hour Reporting and 180-Day Logs

• Report within six hours. Cyber incidents of the types CERT-In lists must be reported within six hours of noticing them, or of being told about them. Reports go to CERT-In by email, phone or its form.
• Keep logs for 180 days. Logs of all your information and communication technology systems must be kept securely for a rolling 180 days, and kept within India. You hand them to CERT-In if asked.
• Synchronize clocks. System clocks must be synchronized to the network time servers of NIC or NPL, or to servers traceable to them, so timestamps agree across systems.
• Name a point of contact. Provide and keep updated a person who deals with CERT-In.

The directions list many types. Examples include unauthorized access to systems or data, data breaches and leaks, attacks on servers such as databases, mail and DNS, attacks on web applications such as e-commerce and government portals, website defacement, malicious code such as ransomware, phishing and spoofing, compromise of critical systems and targeted scanning. If you are unsure whether something qualifies, the safe course is to treat it as reportable until you have checked the list.

Six hours is not much when you must also understand what happened. In practice the delay is rarely the email. It is deciding that an event is an incident, finding someone senior enough to approve a report and knowing which logs to look at. Companies that handle it well have:

1. A short incident plan naming who declares an incident and who reports it.
2. A one-page template for the first report, with the facts CERT-In asks for.
3. A contact list that works outside office hours.
4. Monitoring that makes it likely that you notice, which is the real constraint.

The 180-day rule is easy to read and hard to meet. Logs must exist, and they must cover the systems that matter: servers, firewalls, VPNs, applications and cloud accounts. Check that:

• Logging is turned on, at a level that records authentication and administrative actions.
• Logs are sent to a place an intruder who controls a server cannot erase.
• Storage is sized for 180 days and sits in India.
• Clocks are synchronized, so events line up.

A penetration test is not a CERT-In requirement on its own, but it shows how well the above works in practice. Testers can tell you, after the fact, which of their actions your systems logged, and whether anyone would have been alerted. That is a direct test of your ability to meet a six-hour reporting duty. Ask for a section in the report on what was detected.

CERT-In also keeps a panel of auditing organizations and, in 2025, published Comprehensive Cyber Security Audit Policy Guidelines describing how cyber security audits should run for the auditors on that panel and the organizations they audit. Some regulators and tenders require an audit by a panel member. Whether yours does depends on the requirement, so read the wording. We explain the difference in do you need a CERT-In empanelled auditor.

If personal data is involved, the DPDP Rules add their own notification steps: see our DPDP checklist. Sector regulators may add more.

1. Write the six-hour plan and test it with a tabletop exercise.
2. List your systems and confirm each one logs, for 180 days, in India.
3. Synchronize time on every system.
4. Name your CERT-In contact person.
5. Run a penetration test and ask what your monitoring saw.

Our engineers can run a test and report which activity your logs and alerts captured. Read how an engagement runs in our methodology, see network penetration testing, or request a scoping call.

Facts in this article were checked on 4 November 2026 against these primary sources:

• CERT-In: Directions under section 70B(6), 28 April 2022
• CERT-In: FAQs on the Cyber Security Directions
• CERT-In: Comprehensive Cyber Security Audit Policy Guidelines