For incident reporting in India, CERT-In is the agency whose directions set the timetable.

CERT-In, the Indian Computer Emergency Response Team, collects reports of cyber incidents, issues alerts and advisories, and coordinates the response. It has been operating since 2004 and was named the national agency for this work when the Information Technology Act, 2000 was amended in 2008. It can issue binding directions to organisations in India.

Spelled out: Indian Computer Emergency Response Team.

In April 2022 CERT-In issued directions under section 70B(6) of the IT Act on reporting cyber incidents and keeping logs. They reach service providers, intermediaries, data centres, companies and government bodies, so most Indian technology businesses are in scope. The practical effect is a short reporting window and log-keeping duties that your incident plan must already account for, separate from any notice owed under the DPDP Act to the Data Protection Board of India (the Board). Buyers and regulators increasingly ask how you meet both.

The directions of 28 April 2022

Commonly read as requiring certain incidents to be reported within six hours of noticing them, logs kept for a rolling 180 days within India, and clocks synchronised to approved time sources.

Your incident response plan

The step that decides whether an event is reportable to CERT-In and who sends the report.

A designated point of contact

The directions expect a named contact to interface with CERT-In on incidents and information requests.

Sector rules from RBI, SEBI and IRDAI

Regulated entities often have their own reporting line on top of CERT-In's; check each instrument.

The Data Protection Board of India

The Board enforces the DPDP Act on personal data. CERT-In handles cyber incidents under the IT Act. One event can trigger duties to both.

CERT-In empanelled auditors

CERT-In maintains a list of empanelled security auditing organisations. Being on that list is about auditors, not about your own reporting duty.

• Add a CERT-In reportability check to your incident runbook with a clear owner.
• Confirm where your logs are stored and for how long, against the directions.
• Name your point of contact and keep the name current.
• Read the current directions and FAQs on the CERT-In website rather than relying on summaries.

• GuideISO 27001 and CERT-In directionsIncident reporting and logging duties, and the ISMS.
• GuideDPDP beside the IT Act, CERT-In and sector rulesWhich rule applies first when several do.
• GuidePersonal data breaches under the DPDP ActWho must be told, what they are told, and your records.

Sources: CERT-In website (about CERT-In and its functions); CERT-In directions under section 70B(6) of the Information Technology Act, 2000, dated 28 April 2022, and the related FAQs; Information Technology (Amendment) Act, 2008.