In this article · 5 sections
CERT-In (the Indian Computer Emergency Response Team) is the national agency for cyber security incidents. Its directions issued in April 2022 under Section 70B of the IT Act changed how organisations in India must respond to incidents. Here's a plain-language summary of the CERT-In guidelines most relevant to businesses.
Who they apply to
The directions cover service providers, intermediaries, data centres, body corporates and government organisations. "Body corporate" is broad and includes companies and firms engaged in commercial activity. Many small businesses therefore fall within scope; when in doubt, assume the reporting duty applies to you.
Key requirements
-
Report incidents within 6 hours of noticing them, for specified types of incidents, including:
- Targeted scanning of critical systems
- Compromise of systems or data
- Unauthorised access to IT systems or data
- Website defacement or intrusions
- Malicious code attacks such as ransomware. See ransomware response
- Attacks on servers, databases, email, applications and cloud
- Data breaches and data leaks. See data breach response
- DDoS attacks. See DDoS protection
-
Maintain logs of ICT systems for a rolling 180 days, within Indian jurisdiction, and provide them to CERT-In when asked
- Synchronise clocks with NTP servers of NIC or NPL (or traceable to them)
- Designate a point of contact to interface with CERT-In
- Extra duties for VPN providers, data centres, cloud providers (subscriber records) and virtual asset service providers (KYC and transaction records)
How to report
Reports go through CERT-In's incident reporting channels (email/website forms listed on cert-in.org.in). Include what happened, when it was detected, affected systems and actions taken. You can send updates later; the first report should not wait for a full investigation.
Practical steps for small businesses
- Write down who reports and keep CERT-In's contact details in your incident plan
- Ask your host what logs they keep and for how long; enable website and admin login logs
- Keep server time accurate (most hosts handle NTP)
- Run a quick cyber security audit
- If personal data is involved, also follow DPDP Act duties. See DPDP Act compliance
FAQs
Is a hacked website "reportable"?
Website intrusion and defacement are listed types. See hacked website legal responsibility.
What if we notice it late at night?
The 6-hour clock runs from noticing the incident, so plan for after-hours reporting.
This article is general information, not legal advice. Check the latest CERT-In directions and FAQs.
Was this article helpful?
Your answer helps us improve our guides