Six-Hour Deadline and 180-Day Log Rule: What CERT-In's April 2022 Directions Require

Service providers, intermediaries, data centres, body corporates and government organisations must report cyber incidents to the Indian Computer Emergency Response Team, known as CERT-In, within six hours. The duty comes from directions issued under Section 70B of the Information Technology Act, 2000, and it replaced an open-ended reporting standard with a fixed deadline.

The directions also require covered entities to keep system logs for 180 days and warn that non-compliance may invite punitive action. Here is how the rules work, who they cover, and where the published summaries differ.

What the April 2022 Directions Set Out

CERT-In issued the directions on 28 April 2022 under Section 70B of the IT Act, according to Trilegal, a law firm. Argus Partners, another law firm, says they were issued under sub-section 70B(6). The Legal500 overview gives the reference as No. 20(3)/2022-CERT-In and says the directions took effect on 27 June 2022. The Hacker News reported the directions in late April 2022 and said they take effect 60 days after issue, which matches that date.

The rules replaced an earlier standard. Trilegal says the previous CERT-In Rules, 2013 required reporting only within a "reasonable time frame". The six-hour limit is a fixed figure in place of that wording.

Trilegal says organisations would need to reassess their practices and procedures for breach reporting. It adds that CERT-In is empowered to call for information and give directions to service providers, intermediaries, data centres, body corporates and government organisations.

The Hacker News reports that the government wants indicators of compromise linked to security events to be readily available for analysis, investigation and coordination under the legal process. MeitY said the directions would strengthen overall cybersecurity posture and support a safe and trusted internet.

Who Must Report, and When the Six-Hour Clock Starts

Service providers, intermediaries, data centres, body corporates and government organisations must report cyber incidents within six hours, according to the Legal500 overview. Trilegal also gives the six-hour deadline. The six-hour window starts when an entity becomes aware of an incident or is notified of it, according to Legal500.

Argus Partners says the clock runs from when an incident is noticed or brought to the attention of the concerned person. For a global incident affecting Indian data or residents, it argues the clock may not start until it is reasonably clear that India has been affected, because it can take days to work out which regions and data subjects are involved. The firm presents this as its own reading, not a stated rule.

Argus says the rule took effect on 27 June 2022 and does not apply retrospectively. For earlier incidents, it suggests CERT-In may judge late reports against the older standard of reporting "as early as possible", so a report filed more than a day or two after an incident could be questioned.

Industry bodies pushed back before the rules took effect. Argus Partners says the US Chamber of Commerce and other groups asked CERT-In to delay implementation and argued six hours is too short. In a letter dated 26 May 2022 to CERT-In's Director General, the groups, including the US-India Business Council and BSA, argued the rule would fragment cross-border cybersecurity. Requests to extend the deadline to 72 hours were rejected, according to Argus. MeitY said cybercrime can be committed from remote jurisdictions without traces, so prompt reporting is essential. At a meeting on 10 June 2022, MeitY compared the rule to reporting a robbery immediately, and Argus says the position has not changed.

Which Incidents Fall Under the Reporting List

The directions attach an annexure of reportable incidents, and the published summaries list them differently. Legal500 lists data breaches and leaks, targeted scanning or probing of critical networks, phishing, compromise of critical systems or information, unauthorised access to IT systems or data, website defacement or intrusion, and unauthorised website changes.

The Hacker News lists compromise of critical systems, targeted scanning, unauthorised access to computers and social media accounts, website defacements, malware deployments, identity theft, DDoS attacks, data breaches and leaks, rogue mobile apps, and attacks on servers, network appliances, routers and IoT devices.

Trilegal says the 2022 Directions expand the list to include attacks on IoT devices, digital payment systems, malicious mobile apps, social media accounts, cloud computing systems, big data, blockchain and virtual assets, drones, and AI and machine learning systems.

Argus Partners calls the annexure A, while Legal500 calls it Annexure I. Argus lists its categories as including scanning and probing, unauthorised access, malware, phishing, and DoS and DDoS attacks.

TaxGuru reproduces Annexure I as 20 numbered categories, including attacks on critical infrastructure, SCADA and operational technology, and ransomware and cryptominers. Trilegal says no impact threshold has been specified presently, and that there is "no clarity" on what some listed incidents entail.

Log Keeping for 180 Days Inside India

Covered entities must create and enable logs for all their ICT systems and keep them secure for a rolling 180 days, according to Legal500. The logs must be stored within Indian jurisdiction, a period and location TaxGuru also gives.

Under the Legal500 overview, the logs must be provided to CERT-In when an incident is reported. TaxGuru adds that they must also be provided when CERT-In orders or directs it. Trilegal also refers to the local storage of system logs in India.

The Hacker News says organisations must synchronise their ICT system clocks to the Network Time Protocol server of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL). TaxGuru adds that entities with infrastructure in several geographies may use another accurate time source, provided it does not deviate from those servers.

The Hacker News reports a separate rule for virtual private network (VPN) service providers. They must keep subscriber names, addresses, phone numbers, email addresses and IP addresses for a minimum of five years. TaxGuru names data centres, VPS providers and cloud providers too, and says the period runs for at least five years after registration ends.

Virtual asset service providers, exchanges and custodian wallet providers must keep Know Your Customer (KYC) and financial transaction records for five years, according to The Hacker News and TaxGuru.

The six-hour window starts when an entity becomes aware of an incident or is notified of it.

How Reports Are Made

Argus Partners says covered entities report through an incident reporting form on CERT-In's website. The form asks for basic information, such as incident type, domain or URL, and IP address.

Argus Partners says Rule 12 of the CERT-In Rules allows any affected person to report an incident voluntarily. The same rule requires the agency to run a 24-hour Incident Response Help Desk, but the firm gives no contact details for the desk. The rules do not require a detailed follow-up report, though CERT-In may ask for more.

TaxGuru says reports can be sent by email, phone or fax. Contact details are not printed here. Legal500 says CERT-In will issue the details, form and format of reporting, and may update them from time to time.

Penalties for Non-Compliance Under Section 70B

Legal500 and Argus Partners both cite Section 70B(7) of the IT Act. Under it, non-compliance can be punished with up to one year's imprisonment, a fine of up to ₹1 lakh, or both. Legal500 links the offence to non-compliance with Section 70B(6), while Argus Partners refers to failing to comply with a CERT-In direction.

Argus Partners describes the route to a penalty. A CERT-In designated officer reports non-compliance to the Director General under Rule 16. The Review Committee may direct that a complaint be filed in court under Section 70B(8). The court hears the accused before imposing a penalty proportionate to the breach. The CERT-In Rules set no penalty for breaching Rule 12.

Argus Partners says neither the Rules nor the notification provide exceptions for missing the six-hour deadline. It gives an example in which senior management could not report in time during a crisis, and says its author expects courts to weigh extenuating circumstances. The author hopes future amendments will add specific exemptions, such as where the entity itself suffered injury or harm during the incident.

TaxGuru says failure to furnish information or non-compliance with the directions may invite punitive action under Section 70B(7) and other applicable laws.