In short
CERT-In is India’s national agency for cyber incidents, set up under Section 70B of the Information Technology Act, 2000. Its Directions of 28 April 2022, in force from 27 June 2022, set four duties for almost every organisation: report listed incidents within 6 hours, keep logs for 180 days, sync clocks to Indian time servers, and name a point of contact. Hosting, cloud and VPN providers must also keep customer records for 5 years. The 6-hour deadline is the one that shapes software: you cannot meet it without good logs and a practised plan.
Who it applies to
- Service providers, intermediaries, data centres, body corporates and government organisations. A body corporate includes any company, firm or sole proprietor, and the FAQs give no size exemption.
- Organisations outside India that use ICT systems in India or offer services to users in India.
- Data centres, VPS, cloud and VPN service providers, for the subscriber records duty. A VPN provider here means one offering internet proxy-like services to the general public, not a company’s own staff VPN.
- Virtual asset exchanges and custodian wallet providers, for KYC and transaction records.
MSMEs were given until 25 September 2022 to comply. That extension is over.
What it means for your website
The Directions have no rules about what a website must display. They apply to the systems behind it.
- Keep the logs. Web server, application, firewall and WAF logs all count as ICT system logs. Keep them for a rolling 180 days, in a form you can hand to CERT-In.
- Watch for listed incidents. Website defacement, malicious code injected into pages, DoS and DDoS attacks, and attacks on e-commerce applications are all on the list.
- Check your hosting contract. Your host or cloud provider should keep its own logs and records. Make sure you can get yours quickly when you need them.
What it means for your software
Incident reporting within 6 hours
Listed incidents must be reported within 6 hours of noticing them or being told about them. If you do not have every detail, report what you know and add the rest later. Annexure I lists 20 incident types. They include scanning of critical systems, unauthorised access, malware and ransomware, identity theft and phishing, data breaches and data leaks, and attacks on applications, cloud, IoT, payment systems and AI systems.
Software must make an incident visible fast. That means alerts on failed logins, privilege changes, mass exports and unusual traffic, and a runbook that says who decides and who files the report. CERT-In publishes the reporting formats and methods on its website.
Logs for 180 days
Every covered organisation must enable logs on all its ICT systems and keep them securely for a rolling 180 days. Logs must be given to CERT-In with an incident report or when it asks. The CERT-In FAQs give examples: firewall, IPS, SIEM, web, database, mail, FTP and proxy servers, application logs, SSH and VPN logs. Both successful and failed events should be recorded.
The Directions say logs are to be maintained within Indian jurisdiction. CERT-In’s FAQs add that copies may also be stored outside India, if the logs can be produced to CERT-In in reasonable time. Records of financial transactions with users in India must be kept in India. If you also hold personal data, the DPDP Rules require logs for at least one year, so design for a year.
Clock synchronisation
All ICT system clocks must sync to the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to servers traceable to them. The FAQs name samay1.nic.in, samay2.nic.in and time.nplindia.org. Organisations spread across several countries may use another accurate source that does not deviate from NIC or NPL. Cloud customers may use the provider’s own time service.
Systems need not run on Indian time, since NTP gives UTC, but the time zone must be recorded. In practice: store timestamps in UTC with the zone, and make every server, database and application log use the same source. Logs from different systems must line up when you reconstruct an incident.
Point of contact
Each organisation must name a point of contact to deal with CERT-In, using the format in Annexure II. Keep the details current. The person also needs access to logs and authority to act out of hours.
Records for hosting, cloud and VPN providers
Data centres, VPS, cloud and VPN providers must keep validated details of each customer for 5 years after the customer stops using the service. These include names, period of hire, allotted IP addresses, the email and IP used to register, the purpose of the service, address and contact numbers, and ownership pattern. Virtual asset service providers must keep KYC and transaction records for 5 years. If you build a hosting or billing system for such a provider, it needs these fields and a retention rule that starts when the service ends.
Later CERT-In guidance
- Bills of materials. CERT-In’s Technical Guidelines on SBOM, QBOM and CBOM, AIBOM and HBOM were issued on 9 July 2025. They ask software makers to list every component, library and version in a product, in SPDX or CycloneDX format. They are voluntary guidance, aimed most at government, public sector and essential services, and may appear in procurement terms.
- Audits. CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines were issued on 25 July 2025. They expect audits at least once a year, and bind CERT-In empanelled auditors and the organisations they audit. RBI and SEBI regulated entities already need audits by empanelled auditors. See VAPT.
Checklist
- List every ICT system: web servers, apps, databases, firewalls, cloud accounts, VPNs and SaaS tools.
- Turn on logging for each, covering both successful and failed events.
- Keep logs for at least 180 days, or one year if you hold personal data, and test that you can retrieve them.
- Point every server and device at the NIC or NPL time servers, or your cloud provider’s time service.
- Store timestamps in UTC with the time zone recorded.
- Name a point of contact for CERT-In and send their details in the Annexure II format.
- Write an incident runbook with a 6-hour clock: who spots, who decides, who reports.
- Set alerts for the incident types in Annexure I that fit your business.
- Check your hosting and cloud contracts give you logs quickly.
- Keep a software bill of materials for products you sell to government or large buyers.
How Kreon helps
We design the systems we build to log user actions, logins and data access, with timestamps from a single synced time source. Kreon ERP keeps a full audit trail of every change, with the values before and after and the option to revert. We have deployed systems in the Indian defence sector and built systems that passed independent VAPT, and we can help you set up logging and an incident runbook that fits the 6-hour rule.