The CERT-In 6-hour rule: a checklist for the first hours of an incident

India's CERT-In Directions of April 2022 require service providers, intermediaries, data centres, companies and government bodies to report listed cyber incidents to CERT-In within 6 hours of noticing them, or of being told about them.

What counts as a reportable incident

The Directions list the incident types. They include data breaches and data leaks, unauthorised access to systems or data, ransomware and malicious code, attacks on servers, applications and cloud systems, defacement, identity theft and phishing, and attacks on IoT and critical systems.

The first hours

• Note the exact time you noticed the incident: the 6 hours run from then.
• Contain it, and preserve evidence (logs, disk images, emails) before rebuilding anything.
• Send the initial report to CERT-In (incident@cert-in.org.in) using its reporting format, with what you know so far. You can update it later.
• If personal data is involved, the DPDP Act also requires telling the Data Protection Board and the affected people, with a detailed report to the Board within 72 hours under the DPDP Rules 2025.
• If you have customers in the EU, UK, US or Australia, their regulators' clocks are running too.

Be ready before it happens

• Keep logs of your ICT systems for 180 days, within India, as the Directions require.
• Synchronise clocks with the NIC or NPL time servers so your logs line up.
• Name a point of contact for CERT-In and keep their details current.
• Run a tabletop exercise once a year: who decides, who reports, who talks to customers.

This guide summarises the Directions. It isn't legal advice; check the current text on cert-in.org.in.