CERT-In Incident Reporting for Indian Businesses: Master the 6-Hour Window

By Krapton Engineering · Reviewed by a senior engineer · Last updated 26 Sept 2026

India's digital economy is booming, but with growth comes increased cyber threats. For every Indian business – from nimble startups and D2C brands to established SMEs and global capability centres – a critical regulatory mandate stands out: the Computer Emergency Response Team, India (CERT-In) directions. These aren't just legal checkboxes; they demand a fundamental shift in how Indian engineering teams approach cybersecurity, particularly the challenging CERT-In incident reporting for Indian businesses within a tight six-hour window.

TL;DR: Indian businesses must engineer robust systems for rapid detection, analysis, and reporting of cyber incidents to CERT-In within 6 hours, alongside maintaining 180 days of specific logs. This requires clear playbooks, automation, and continuous verification to ensure compliance and avoid penalties under CERT-In directions.

Key takeaways

• 6-Hour Reporting Window: Critical incidents must be reported to CERT-In within six hours of detection, demanding real-time monitoring and pre-defined response protocols.
• Mandatory Log Retention: Businesses must store specific types of logs for 180 days and subscriber/customer registration data for five years, requiring secure and scalable storage solutions.
• Proactive Engineering: Compliance isn't just a legal task; it's an engineering challenge requiring investment in SIEM, EDR, automated alerting, and incident response playbooks.
• Integration with DPDP: CERT-In reporting complements the Digital Personal Data Protection Act 2023 (DPDP Act) breach notification requirements, necessitating a unified approach.
• Continuous Readiness: Regular drills, penetration testing, and vulnerability assessments are vital to verify your organisation's ability to meet CERT-In guidelines.

Understanding CERT-In Directions: Who, What, and When

The Ministry of Electronics and Information Technology (MeitY) empowers CERT-In to issue directions to enhance cybersecurity in India. As of 2026, the CERT-In Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 are a cornerstone for cybersecurity compliance. These directions apply broadly to service providers, data centres, corporate bodies, and government organisations, encompassing virtually every Indian business handling digital data.

The core of these directions, particularly for engineering teams, revolves around two key areas:

1. Mandatory Incident Reporting: All cyber incidents, as defined by CERT-In, must be reported within six hours of being noticed or detected. This includes incidents like targeted scanning, compromised servers, data breaches, and ransomware attacks.
2. Log Retention Requirements: Specific types of logs must be maintained for a rolling period of 180 days, and subscriber/customer registration details for five years.

Failing to comply can lead to significant penalties, including imprisonment and fines up to ₹1 lakh, making robust engineering implementation non-negotiable for Indian cybersecurity compliance.

The Engineering Challenge: Mastering the 6-Hour Reporting Window

Meeting the six-hour reporting window for CERT-In incident reporting for Indian businesses is a significant technical undertaking. It demands more than just a security team; it requires security baked into your engineering culture and infrastructure. The clock starts ticking from the moment an incident is "noticed or detected."

1. Rapid Detection & Alerting

You can't report what you don't know. This means investing in:

• Security Information and Event Management (SIEM) Systems: Centralise logs from all your systems – servers, applications, network devices, cloud infrastructure. Tools like Splunk, ELK Stack (Elasticsearch, Logstash, Kibana), or cloud-native options like AWS Security Hub and Azure Sentinel are crucial.
• Endpoint Detection and Response (EDR): Monitor individual endpoints (laptops, servers) for malicious activity.
• Cloud Security Posture Management (CSPM): Continuously scan your cloud environments for misconfigurations that could lead to breaches.
• Automated Alerts: Configure real-time alerts for suspicious activities with clear severity levels. Integrate these with on-call rotation tools like PagerDuty or Opsgenie to ensure immediate notification to the right team members.

In a recent client engagement, we found that simply having a SIEM wasn't enough; the critical factor was the tuning of alert thresholds and the clarity of the alert messages. Overly noisy alerts led to fatigue, while vague alerts delayed triage. Our team spent weeks refining these to ensure high-fidelity, actionable notifications that directly mapped to potential CERT-In reportable incidents.

2. Streamlined Incident Response Playbooks

Six hours leaves no room for improvisation. Your team needs:

• Pre-defined Playbooks: Documented, step-by-step procedures for common incident types (e.g., suspected data breach, malware infection, DDoS attack). These should include initial containment, forensic data collection, and communication protocols.
• Clear Roles and Responsibilities: Everyone on the incident response team must know their role and who to escalate to.
• Communication Channels: Establish secure, out-of-band communication channels for incident coordination (e.g., a dedicated Slack channel, encrypted messaging).

3. Automated Triage and Data Collection

To accelerate the reporting process, consider:

• Security Orchestration, Automation, and Response (SOAR): Platforms that can automate initial incident triage, gather relevant logs, and even perform initial containment actions. For Indian startups, custom scripts using cloud APIs can offer a cost-effective alternative to full-blown SOAR platforms.
• Pre-filled Reporting Templates: Have templates ready with your organisation's details and common incident parameters to quickly populate information for the CERT-In reporting portal.

Implementing Robust Log Retention for Compliance

Beyond the 6-hour window, the CERT-In directions 2026 also mandate strict log retention. This is where long-term planning and cost-effective storage solutions come into play.

1. What Logs to Retain?

The directions specify retaining various types of logs for 180 days, including:

• Network logs (firewall, router, load balancer)
• System logs (OS, server event logs)
• Application logs (web server, database, custom application logs)
• User access logs (authentication, authorisation events)
• Configuration change logs

Additionally, subscriber or customer registration data (e.g., KYC details collected via Aadhaar eKYC, contact information) must be retained for five years. This data falls under the purview of both CERT-In and the DPDP Act.

2. Storage and Security Considerations

Storing vast amounts of logs securely and cost-effectively is a challenge:

• Cloud Object Storage: Services like AWS S3 Glacier, Google Cloud Storage Coldline, or Azure Blob Storage offer scalable, durable, and relatively inexpensive long-term storage. Ensure logs are encrypted at rest and in transit.
• Log Management Platforms: Managed services (e.g., Sumo Logic, Datadog) can handle retention, indexing, and search, but come with a higher cost.
• Tamper-Proofing: Implement measures to ensure logs cannot be altered or deleted, such as write-once-read-many (WORM) storage or cryptographic hashing.
• Access Control: Restrict access to log archives to only authorised personnel, following the principle of least privilege.

When NOT to over-engineer your CERT-In compliance

For very early-stage Indian startups with minimal data processing or limited user bases, a full-blown SIEM and SOAR setup might be an overkill. In such cases, start with essential cloud-native logging (e.g., AWS CloudWatch, Google Cloud Logging), implement robust manual incident response playbooks, and ensure your team is well-trained on immediate steps and escalation. Prioritise basic hygiene like MFA, regular backups, and employee security awareness before investing heavily in complex security tooling.

Integrating with India's Broader Compliance Landscape

CERT-In compliance doesn't exist in a vacuum. It intertwines with other critical Indian regulations:

• Digital Personal Data Protection Act 2023 (DPDP Act): While CERT-In focuses on technical incident reporting, the DPDP Act mandates data fiduciaries to notify the Data Protection Board of India and affected data principals in case of a personal data breach. Your incident response plan must integrate both reporting streams to ensure timely and accurate notifications under both frameworks. You can read more about how Krapton helps Indian businesses with secure software solutions.
• RBI Cybersecurity Framework: For Indian fintech companies, the Reserve Bank of India (RBI) has its own stringent cybersecurity framework, including specific requirements for payment data localisation and incident management. Your CERT-In strategy should align with these RBI mandates to avoid duplication and ensure comprehensive coverage.

This is general information, not legal advice. Always consult with legal and compliance experts for specific guidance on Indian regulations. You can find official texts on indiacode.nic.in.

Key Technical Controls and Best Practices

Building a resilient system for CERT-In incident reporting for Indian businesses involves several technical pillars:

• Threat Intelligence Integration: Subscribe to CERT-In advisories and integrate relevant threat intelligence feeds into your SIEM to proactively detect known attack patterns targeting Indian entities.
• Secure Software Development Life Cycle (SSDLC): Incorporate security from the design phase itself. Conduct regular code reviews, static application security testing (SAST), and dynamic application security testing (DAST) as part of your CI/CD pipeline. This proactive approach reduces vulnerabilities that could lead to reportable incidents. Krapton's teams excel at building secure SaaS products with SSDLC principles.
• Network Segmentation: Isolate critical systems and data stores within your network to limit the blast radius of any breach.
• Regular Backups & Disaster Recovery: Ensure critical data is regularly backed up and test your disaster recovery plans to minimise downtime and data loss during an incident.

Verifying Your Incident Readiness

Compliance is a continuous journey, not a one-time setup. To ensure your organisation can genuinely meet the 6-hour reporting window and log retention rules:

• Regular Drills and Tabletop Exercises: Simulate various cyber incident scenarios. Test your playbooks, communication channels, and the team's ability to act under pressure. This helps identify gaps before a real incident occurs.
• Penetration Testing and Vulnerability Assessments: Engage third-party security firms to conduct ethical hacking exercises. These can uncover vulnerabilities that your internal teams might miss, providing crucial insights into potential attack vectors.
• Audit Log Review: Periodically review your log retention policies and ensure that logs are indeed being collected, stored, and secured according to CERT-In requirements.

Our team measured the time-to-detection and time-to-containment in a simulated ransomware incident for an Indian D2C brand. We found that while their technical tools were good, the human element – clear communication and decision-making under stress – was the biggest bottleneck. Iterative drills significantly improved their response metrics.

FAQ

What types of incidents must be reported to CERT-In?

CERT-In mandates reporting for a wide range of cyber incidents, including targeted scanning, compromised servers, data breaches, ransomware, phishing attacks, website defacements, and denial-of-service attacks. The full list is detailed in the official directions.

Does CERT-In apply to all Indian businesses?

Yes, the CERT-In directions apply broadly to all service providers, data centres, corporate bodies, and government organisations operating in India. This includes startups, SMEs, MSMEs, and enterprises, regardless of their size or sector.

What are the penalties for non-compliance with CERT-In?

Non-compliance with CERT-In directions can lead to severe penalties under the Information Technology Act, 2000, including imprisonment for up to one year or a fine of up to ₹1 lakh, or both, for the defaulting entity and its responsible officers.

How does CERT-In incident reporting differ from DPDP breach notification?

CERT-In focuses on technical cyber incident reporting to a national agency for threat intelligence and coordination. The DPDP Act, on the other hand, mandates reporting personal data breaches to the Data Protection Board of India and affected data principals to protect individual privacy rights. Both are critical but serve different purposes.

Secure Your Organisation: Partner with Krapton Engineering

Navigating the complexities of CERT-In incident reporting for Indian businesses and ensuring robust cybersecurity isn't just a compliance burden; it's a strategic imperative. A strong security posture builds trust, protects your assets, and ensures business continuity. Don't leave your organisation vulnerable to threats or regulatory non-compliance. Get a security-minded engineering team — talk to Krapton about software security services and share your project brief with Krapton to secure your digital future.