IndiaCERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation
Directions under section 70B(6) of the Information Technology Act 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, )
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
- Connect all your ICT systems' clocks to the Network Time Protocol server of the National Informatics Centre or the National Physical Laboratory, or to an NTP server traceable to one of them, and ensure any other time source you use does not deviate from NPL or NIC.NIST CSF 2.0PR.PS-04
- Report a listed cyber security incident, including a targeted attack, a data breach, a data leak, unauthorised access to your IT systems, an attack through a malicious or fake mobile app, or an attack on, or malicious or suspicious activity affecting, an AI or machine learning system, to CERT-In within six hours of noticing it or being notified of it, by email, phone, or fax; current reporting formats and channels are published on CERT-In's own website.
- Enable logs of all your ICT systems and retain them securely, within Indian jurisdiction, on a rolling 180-day basis, and provide them to CERT-In together with an incident report or when CERT-In orders or directs you to.NIST CSF 2.0PR.PS-04NIST CSF 2.0RS.CO-03
- Designate a Point of Contact to interface with CERT-In, using the format CERT-In publishes, and keep that designation current.NIST CSF 2.0GV.RR-02
- If your own service is itself a data centre, a virtual private server provider, a cloud service provider, a virtual private network service, or a virtual asset (crypto) service provider, a narrower and heavier duty also applies: register and retain specified customer KYC information and financial-transaction records for five years. That narrower bound-party class is not one this profile's declared activities can identify on their own, so confirm applicability directly against the text if this describes your service.no control in the NIST CSF 2.0
- Failing to furnish information CERT-In calls for, or to comply with a direction it issues, including these Directions, is punishable under section 70B(7) of the Information Technology Act with imprisonment for up to one year, a fine of up to one lakh rupees, or both.
These lines are LexLint's reading of the law's text. Also read by: CERT-In Artificial Intelligence Security Auditing Guidelines, Version 1.0 (guidance from the Indian Computer Emergency Response Team, issued ).
In the frameworks
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- PR.PS-04Log records are generated and made available for continuous monitoring
- RS.CO-03Information is shared with designated internal and external stakeholders
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment for a term which may extend to one year, or a fine which may extend to one lakh rupees, or both, under Information Technology Act section 70B(7), for failing to provide information called for, or to comply with a direction issued, under section 70B(6), which includes these Directions.
Penalty structure
Section 70B(7)'s fine cap of one lakh rupees; the same provision separately authorises imprisonment for up to one year, either alone or in addition to the fine. The Directions themselves state only that non-compliance 'may invite punitive action under sub-section (7) of the section 70B', without restating the figures; the amounts are stated in section 70B(7) itself.
- Rule
- Fixed only
- As of
- Currency
- INR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
CERT-In (the Indian Computer Emergency Response Team), the national agency appointed under Information Technology Act section 70B(1), which issued these Directions under section 70B(6); non-compliance may be prosecuted as an offence under section 70B(7).
What this law does
Any service provider, intermediary, data centre, body corporate, or Government organisation that operates a computer resource in India must synchronise all its ICT system clocks to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or an equivalent source that does not deviate from them. The same entities must enable logs of all their ICT systems and retain them securely within Indian jurisdiction on a rolling 180-day basis.
They must also designate a Point of Contact for CERT-In. They must mandatorily report a broad enumerated list of cyber security incidents to CERT-In within six hours of noticing the incident or being notified of it. That enumerated list includes a data breach, a data leak, an attack through a malicious or fake mobile app, and attacks on systems and applications related to artificial intelligence and machine learning.
Data centres, virtual private server providers, cloud service providers, virtual private network service providers, and virtual asset service providers face an additional duty to register and retain specified customer KYC and transaction records for five years.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- CERT-In Artificial Intelligence Security Auditing Guidelines, Version 1.0, the Indian Computer Emergency Response Team
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .