What Does CERT-In Actually Require?
Key takeaways
- The 28 April 2022 directions require incident reporting within six hours of noticing an incident, and CERT-In has itself said that uncertainty about the full facts is not a reason to delay the first report.
- Logs must be retained for 180 days, which in practice means shipping them off your servers to a write-once store or a SIEM, because disk retention on a single host is the usual failure point.
- An ISMS is required, and it is not a document exercise: CERT-In's auditor checklist expects a written policy set, asset inventory, access control, incident management and continuous monitoring.
- Audits must be done by a CERT-In empanelled auditor, at least once every three years, and again after any significant change to the ICT system.
- Service providers and cloud data centres have their own obligations under the directions, including synchronised clocks and customer log access on demand.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Who do the CERT-In directions actually apply to?
The 28 April 2022 directions reach broadly: every organisation with an ICT system in India, in the public and private sector alike, and they extend to the body corporate that owns the system. Government agencies had 180 days to comply and private entities had a year, so the grace period has long expired. If you run servers, a network, a cloud tenancy or a managed service for a client, you are in scope. The carve-outs are narrow, such as purely domestic use of a computer.
What does the six-hour incident reporting duty involve?
The duty is to report to CERT-In within six hours of noticing an incident or a suspected incident, and to keep updating the report as facts become clearer. The report goes to the CERT-In incident reporting portal or the designated email address, and it must include the nature of the incident, the affected systems, the impact, and the mitigation taken or planned. CERT-In has stated that an incomplete report is acceptable and can be updated, so the practical instruction to your team is: report the suspicion, and do not sit on it for a forensic weekend.
What do the 180-day log retention rules mean in practice?
The directions require ICT system transaction logs to be retained for 180 days, produced on demand, and tamper-evident. In practice that rules out relying on a live server's local disk, because the log window there is usually days, not months. You need a central log store with immutability, and clock synchronisation across hosts so timestamps can be correlated. For a mid-sized Indian firm, the cheapest compliant pattern is a SIEM agent on servers and endpoints feeding a central tenant, plus an archive tier for the 180-day window.
What does the ISMS and audit requirement look like?
The directions require an Information Security Management System, a documented set of policies covering asset classification, access control, incident management, backup, human resource security and information security education, and a periodic audit by a CERT-In empanelled auditor. The audit cycle is at least once every three years, and again after a major change such as a new data centre or a new cloud provider. The empanelment scheme carries its own validity period and mandatory surveillance, so your auditor's certificate being current is part of your obligation, and budget the audit as an annual line item.
| Obligation | What it means | Proof an auditor wants |
|---|---|---|
| 6-hour incident reporting | Report suspected or confirmed incidents to CERT-In within six hours of noticing them, and keep updating | Incident register with report timestamps and CERT-In reference numbers |
| 180-day log retention | ICT system transaction logs kept centrally for 180 days, tamper-evident and produced on demand | SIEM configuration, archive policy and a sample log pull |
| Information Security Management System | Documented policies for assets, access control, incident management, backup and training | Policy set, asset inventory, risk register and training records |
| Empanelled audit | Audit by a CERT-In empanelled auditor at least every three years and after major change | Current auditor certificate plus the closure report from the last audit |
| Supply chain coverage | Service providers and cloud data centres must support the directions, including clock synchronisation and log access | Vendor clauses naming CERT-In obligations in contracts |
What are the frequently asked questions?
Get a straight answer on this
Send us your CERT-In scope and incident register, and we will return a fixed-price gap assessment against the 6-hour, 180-day and empanelled-audit rules.
Send us the details See pricing