Why it matters
Six hours is very little time. Organisations need to know in advance who decides whether an incident is reportable, who files the report, and how evidence is preserved, or they will miss the window.
What to get right
- The directions apply broadly: service providers, intermediaries, data centres, body corporates and government organisations.
- Logs of ICT systems must be kept securely for a rolling 180 days and maintained within Indian jurisdiction.
- System clocks must be synchronised with the time servers specified in the directions.
- Build the reporting step into your incident response plan and test it in exercises.
Common questions
What kinds of incidents must be reported?
The directions list many types, including targeted scanning of critical systems, compromise of systems or data, ransomware, identity theft, attacks on servers and applications, and data breaches or leaks. Check the current list published by CERT-In.
Does the six-hour clock start at the attack?
It starts when the organisation notices the incident or is told about it, which is why fast detection and clear escalation paths matter.