Key findings
The six-hour window starts when an incident is noticed or reported, not when it is fully understood. Organisations should plan to report on initial information and update later.
High confidencePre-agreed decision rights are the single most important factor in meeting short reporting windows; assembling a decision group after detection routinely consumes most of the available time.
Moderate confidenceThe log retention and clock synchronisation requirements are prerequisites for effective investigation, not just compliance obligations.
High confidenceA single, joined-up playbook covering CERT-In, DPDP and sector regulators reduces the risk of inconsistent or late notifications.
Moderate confidence
Context
Since April 2022, organisations covered by CERT-In's directions have had to report specified cyber security incidents within six hours of noticing them, or of being informed about them. Six hours is very little time. It is often not enough to understand what has happened, let alone to convene the people who should decide whether and how to report.
What we recommend
- Name a primary and a deputy person authorised to decide whether an incident is reportable, available at all hours.
- Pre-draft the report template with the information CERT-In requests, so that only incident facts need adding.
- Confirm that logs are kept for a rolling 180 days within India and that system clocks are synchronised as specified.
- Rehearse the full reporting path at least twice a year, including outside business hours.
References
- Indian Computer Emergency Response Team (CERT-In). Directions under sub-section (6) of section 70B of the Information Technology Act, 2000. 28 April 2022.
- Indian Computer Emergency Response Team (CERT-In). Frequently Asked Questions on Cyber Security Directions of 28 April 2022. May 2022.
- Government of India. The Digital Personal Data Protection Act, 2023.
- National Institute of Standards and Technology. SP 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management. April 2025.
- Securities and Exchange Board of India. Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities. August 2024.
How we reached these conclusions
This report draws on 5 published regulations, standards and frameworks, listed in the references, applied through Krynthnode analysis. Vendor claims are never counted as evidence on their own. Each finding is graded in the Krynthnode confidence ledger, described on our methodology page, and the whole report is due for review by 16 March 2027.