Latest alerts
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins Hackers hijack Google domains after breaching ccTLD registries Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances Microsoft Outlook to block MSIX attachments starting November CriticalUnpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet PoeLLM malware infects exposed AI servers in cryptomining attacks CriticalRansomware has a new target. Is your backup ready?
  1. Home
  2. Insights
  3. Incident Response
// incident response · 4 min read

CERT-In's 6-hour reporting rule: a ready-to-use checklist

Reportable incidents, the 180-day log requirement and clock synchronisation — what Indian organisations must have in place.

Published 24 June 2026 · Dravincon Security Team

CERT-In's directions of 28 April 2022 under Section 70B of the IT Act apply to service providers, intermediaries, data centres, body corporates and government organisations. Four requirements catch organisations out most often.

1. Report within 6 hours

Reportable cyber incidents — including targeted scanning, compromise of critical systems, unauthorised access, website defacement, malicious code, identity theft, data breaches and attacks on servers and applications — must be reported to CERT-In within 6 hours of noticing them or being told about them.

2. Keep logs for 180 days, in India

Logs of all ICT systems must be maintained securely for a rolling period of 180 days within Indian jurisdiction and provided to CERT-In on request.

3. Synchronise clocks

System clocks should be synchronised with NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or with sources traceable to them — so that timelines across systems line up during an investigation.

4. Name a point of contact

Designate a Point of Contact to interface with CERT-In and share their details in the prescribed format.

Checklist

  • Incident severity matrix that flags CERT-In-reportable events
  • On-call rota that can make the 6-hour deadline at night and weekends
  • Pre-filled reporting template and contact details
  • Central log collection with 180-day retention in India
  • NTP configured to NIC/NPL on all servers and network devices
  • Annual tabletop exercise including a DPDP breach-notification step

Our SOC and MDR services are built around these requirements.

// keep reading

DPDP Rules, 2025: what changes, when, and what to do now

The Rules are notified and the 18-month clock is running. A practical, phase-by-phase plan for Indian businesses.

Compliance7 min

OWASP Top 10:2025, explained for business leaders

Supply-chain failures and mishandled exceptions are new on the list. What each category means for your applications — in plain language.

AppSec6 min

VAPT vs red teaming: which one do you actually need?

One finds as many vulnerabilities as possible. The other tests whether you would catch a real attacker. Here is how to choose.

Offensive5 min
// ready when you are

Find out how an attacker sees you — before they do.

Book a free 30-minute scoping call with our security team. No sales script, just an honest view of your risk and what to do first.

Talk to a security expert Scan my website free
Call Email Under attack? Free DPDP Check