ISO 27001 in India
Running the CERT-In directions through your ISMS
The Indian Computer Emergency Response Team (CERT-In) issued directions on 28 April 2022, using the power in section 70B(6) of India's Information Technology Act, 2000 (the IT Act). They set hard numbers: hours to report, days to keep logs. ISO 27001 sets none of those numbers, but it gives you the machinery to meet them and to prove you did.
Back to ISO 27001 services01 · Who it reaches
A wide net, not a sector rule
Most companies running IT systems in India fall inside it.
The list of addressees reads body corporate, Government organisations, intermediaries, service providers and data centres. In practice that covers most companies operating ICT systems in India. A few duties reach narrower groups: data centres, VPS, cloud and VPN providers must keep subscriber records, and virtual asset businesses must keep KYC and transaction records.
The directions state they take effect 60 days after issue. Failing to furnish information or to comply may invite action under section 70B(7) of the IT Act.
02 · The duties
The main duties, as the directions state them
Four duties touch almost every company. Read the text before you build.
| Duty | What the directions ask | Who |
|---|---|---|
| Clock synchronisation | Set every ICT system's clock from the government time sources, meaning NTP servers run by NIC (the National Informatics Centre) or NPL (the National Physical Laboratory), or servers traceable to them; an entity with sites in several regions may use another accurate source that stays in line | All addressees |
| Incident reporting | Tell CERT-In about any incident of a type listed in Annexure I, no more than 6 hours after you notice it or someone alerts you | All addressees |
| Point of contact | Designate a Point of Contact to liaise with CERT-In, using the Annexure II format, keep it current, and act on CERT-In orders within the time it sets | All addressees |
| Log retention | Enable logs of all ICT systems, keep them securely for a rolling 180 days within Indian jurisdiction, and provide them with an incident report or on order | All addressees |
| Subscriber records | Keep validated subscriber details, hire periods, IPs and purpose for 5 years or longer if law requires, after the registration ends | Data centres, VPS, cloud and VPN providers |
| KYC and transactions | Keep KYC information and financial transaction records for five years | Virtual asset service providers, exchanges and custodian wallets |
Annexure I lists twenty incident types. It runs well beyond data breaches: targeted scanning of critical systems, website defacement, phishing, denial of service, attacks on cloud systems and on AI systems are all named.
CERT-In has published further material on reporting formats and on how the directions apply. Check its website for the current reporting method before you finalise your procedure.
03 · Duty to control
Which Annex A controls carry each duty
The ISMS supplies the process and the evidence. The law supplies the numbers.
| CERT-In duty | Annex A controls that carry it | What to write into the ISMS |
|---|---|---|
| Clock synchronisation | 8.17 Clock synchronization | Name NIC or NPL (or a traceable source) as the reference in the configuration standard, and monitor drift |
| 6-hour reporting | 5.24 to 5.26 incident planning, assessment and response; 6.8 event reporting | A triage step that asks "is this an Annexure I type?" and starts a 6-hour clock from the moment of noticing |
| Evidence for CERT-In | 5.28 Collection of evidence | How logs and artefacts are preserved so they can be sent with the report |
| Point of contact | 5.5 Contact with authorities; 5.2 roles and responsibilities | A named PoC with a deputy, the date CERT-In was told, and a review trigger when people change |
| 180-day logs in India | 8.15 Logging; 8.16 Monitoring activities; 5.23 cloud services | A retention setting of at least 180 days, a record of where logs are stored, and a check that every in-scope system logs |
| Knowing the law applies | 5.31 Legal, statutory, regulatory and contractual requirements | The directions listed in your legal register, with an owner |
| Learning afterwards | 5.27 Learning from information security incidents | Post-incident review that checks whether the 6 hours was met |
04 · Where the ISMS stops
What certification does not settle
A certificate shows a working system. It does not show these specifics were met.
An ISMS can evidence
- An incident process that runs and is tested
- Logging and monitoring that are designed and reviewed
- A legal register that names the directions
- Roles, including a contact with authorities
You still have to show
- Reports actually reached CERT-In within 6 hours
- Logs cover all ICT systems for 180 days, kept in India
- Clocks trace to NIC or NPL
- The PoC on file with CERT-In is current
A certification auditor samples your ISMS; it is not checking compliance with the directions. Test the four numbers yourself, in your internal audit.
- Starting the clock at confirmation. The directions count from noticing or being told, not from the end of an investigation.
- Breach-only triage. Teams that report only data breaches miss most of Annexure I.
- Default log retention. Many cloud services keep logs for less than 180 days unless you change the setting.
- Logs stored abroad. A SIEM in another region may not meet the Indian jurisdiction condition.
05 · CERT-In and DPDP
When a cyber incident is also a personal data breach
Two reports, two recipients, one incident process.
An incident that exposes personal data can trigger CERT-In reporting under the directions and breach intimation under the Digital Personal Data Protection Act, 2023 (DPDP Act). The recipients, timings and contents differ. Build one triage step that asks both questions, and keep separate records of each report. Our DPDP breach guide covers the Act's side.
Illustrative: a phishing compromise
A finance user's mailbox is taken over and used to send invoices. The phishing attack is an Annexure I type, so the 6-hour CERT-In report runs from detection. The mailbox held customer records, so the DPDP breach path starts in parallel. The incident log shows both decisions and their times.
- Personal data breaches under the DPDP ActWho must be told, what they are told, and your records.
- Incident management controlsPlanning, responding, learning, and the records between them.
- Logging and monitoringWhat to log, how long to keep it, and who looks.
Sources: CERT-In, Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In dated 28 April 2022, with Annexures I to III; the Information Technology Act, 2000; ISO/IEC 27001:2022 Annex A control titles, described in our own words.
Questions about CERT-In and ISO 27001
Does ISO 27001 certification mean we comply with CERT-In?
No. It shows a working system, not that each duty was met.
The certificate covers your ISMS against the standard. The directions set specific duties and numbers. Your ISMS can carry them, but you show compliance with records of reports, retention settings and clock sources.
Do the directions apply to a small startup?
They are addressed to body corporate, so usually yes.
The addressees include body corporate, which covers most companies. The subscriber-record and KYC duties reach narrower groups. Have counsel confirm how they apply to your business.
What counts as noticing an incident?
The directions do not define it; set a rule and apply it.
Write a working definition into your incident procedure, such as the time an alert is confirmed as an Annexure I type by the on-call person, and record that time. Consistency is what you can defend.
Can logs live in a global SIEM?
The text says logs are kept within Indian jurisdiction.
The directions require logs to be maintained within Indian jurisdiction. If your logging platform stores data elsewhere, check CERT-In's published clarifications and take advice before relying on that setup.
Test your incident process against the six-hour clock.
An ISO 27001 gap analysis maps the CERT-In duties to your controls and shows where the evidence is thin. Counsel should confirm how the directions apply to your business.