CERT-In readiness quiz

What the CERT-In Directions require

On 28 April 2022, CERT-In (the Indian Computer Emergency Response Team) issued Directions under section 70B(6) of the Information Technology Act, 2000. They apply to service providers, intermediaries, data centres, body corporates and government organisations, which in practice covers almost every company running IT systems in India, and they took effect in June 2022.

The obligations are short to state and harder to prove in practice:

• Clock synchronisation: connect to the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to time sources traceable to them, so that logs from different systems line up.
• 6-hour reporting: report the cyber incidents listed in Annexure I to CERT-In within 6 hours of noticing them or being told about them.
• Point of Contact: designate a person to interface with CERT-In and send their details in the prescribed format.
• Responding to CERT-In: when CERT-In orders or directs, take the action or provide the information or assistance within the time it sets.
• Logs: enable logs of all ICT systems, maintain them securely for a rolling 180 days within Indian jurisdiction, and provide them to CERT-In with an incident report or when ordered.
• Provider records: data centres, VPS, cloud and VPN providers keep validated subscriber records for 5 years; virtual asset service providers, exchanges and custodian wallet providers keep KYC and transaction records for 5 years.

How the score works

Each question carries a weight: 3 for obligations you can't fix after the fact (reporting within 6 hours, having the logs at all, keeping them for 180 days, provider records), 2 for the rest. "Not sure" counts as a gap, because in an audit or an incident you'd need to show the evidence. Questions that don't apply to your type of organisation are left out of the score.

Where teams usually fall short

The most common gap is log retention. Default retention in many cloud services and logging tools is 30 or 90 days, and logs from network devices and SaaS tools are often not kept at all. The second is the 6-hour clock: it starts when you notice the incident, and teams lose hours deciding whether an event counts. A one-page runbook that lists the Annexure I incident types and who sends the report removes that delay.

Clock synchronisation is easy to overlook in cloud environments, where instances use the provider's time service by default. Check that your time sources are traceable to NIC or NPL, or document how yours stay aligned with them.

What this quiz can't tell you

It records what you believe is true. An audit asks for evidence: retention settings, log samples from 180 days ago, NTP configuration, the Point of Contact submission. CERT-In Ready checks those from your actual infrastructure and Terraform, and BreachClock turns the reporting obligations into a plan the moment an incident happens.

This quiz summarises the Directions; read the current text and CERT-In's FAQs on cert-in.org.in, and check sector rules (RBI, SEBI, IRDAI) that may add stricter timelines.