Mastering CERT-In Log Retention for Indian Businesses: 7 Engineering Checks

By Krapton Engineering · Reviewed by a senior engineer · Last updated 12 Oct 2026

In India's rapidly evolving digital landscape, regulatory compliance is no longer an afterthought—it's foundational. With cyber threats escalating and the Digital Personal Data Protection Act (DPDP Act) 2023 now in force, Indian founders, CTOs, and product leaders must prioritise robust security practices. A critical, yet often overlooked, aspect is effective log retention, especially as mandated by the Indian Computer Emergency Response Team (CERT-In).

TL;DR: Implementing CERT-In's log retention requirements is crucial for Indian businesses, not just for compliance but also for effective incident response. This guide provides seven engineering checks covering collection, secure storage, data integrity, cost optimisation, and automation, ensuring your organisation meets its obligations while maintaining operational efficiency and security posture.

Key takeaways

• CERT-In's directions mandate specific log retention periods (generally 180 days) for various types of IT assets and services in India.
• Secure log management involves a structured approach to collection, centralised storage, data integrity, and access control.
• Cost-effective cloud storage tiers (e.g., AWS S3 Glacier, Azure Blob Archive) are vital for managing the financial burden of long-term retention for Indian MSMEs and startups.
• The DPDP Act 2023 adds another layer, requiring careful handling and anonymisation of personal data within logs, especially for retention exceeding CERT-In's 180 days.
• Automated monitoring and alerting on log data are essential for proactive incident detection and meeting CERT-In's six-hour incident reporting window.

Why CERT-In Log Retention Matters for Your Indian Business

The digital economy in India is booming, from D2C brands to deep tech startups and global capability centres (GCCs). However, this growth comes with increased exposure to cyber risks. CERT-In, under the Ministry of Electronics and Information Technology (MeitY), plays a pivotal role in securing India's cyberspace. Their directions on information security practices, particularly regarding log retention, are mandatory for all service providers, data centres, and government organisations.

Beyond mere compliance, a well-engineered log retention strategy is the backbone of effective incident response. When a breach occurs—and it's often a matter of 'when', not 'if'—detailed, tamper-proof logs are your primary source of truth. They enable forensic analysis, help identify the attack vector, scope the impact, and ultimately, recover faster. For businesses handling sensitive customer data, this also intersects with the Digital Personal Data Protection Act 2023, which mandates specific duties for data fiduciaries, including breach notification.

Understanding CERT-In's Log Retention Requirements

CERT-In's directions, issued in April 2022 (and updated periodically), require entities to enable and retain logs of all their ICT systems for a rolling period of 180 days. This includes, but is not limited to, logs of:

• All Information and Communication Technology (ICT) systems.
• Network devices (firewalls, routers, switches).
• Servers (web, application, database).
• Applications.
• Cloud infrastructure (IaaS, PaaS, SaaS).
• User access, including successful and unsuccessful logins.
• Configuration changes.
• Exceptional events and errors.

For certain types of data, such as records related to subscriber registration (e.g., KYC details), the retention period can extend to five years, especially for service providers. This longer retention often aligns with other regulatory frameworks, including aspects of the DPDP Act for personal data. It is important to note that this is general information, not legal advice. Always refer to the official CERT-In website for the latest directions and consult legal counsel for specific interpretations.

Engineering Your Secure Log Management System in India

Building a robust log management system for CERT-In compliance involves a multi-layered approach, focusing on collection, secure storage, and analysis. Here are key engineering checks:

1. Centralised Log Collection and Aggregation

Scattered logs are useless logs. Implement agents (like Fluentd, Filebeat, Splunk Universal Forwarder) on all your servers, applications, and network devices to push logs to a central aggregation point. This ensures a single source of truth for all security events.

# Example Fluentd configuration for application logs

  @type tail
  path /var/log/krapton_app/*.log
  pos_file /var/log/td-agent/krapton_app.pos
  tag krapton.app.logs
  format json



  @type forward
  send_timeout 60s
  recover_wait 10s
  hard_timeout 60s
  
    host log_aggregator.yourcompany.in
    port 24224
  

2. Secure, Immutable Storage with Access Control

Once collected, logs must be stored securely and immutably. Cloud providers offer services like AWS S3 with object lock (WORM - Write Once Read Many) or Azure Blob Storage with immutability policies. This prevents unauthorised modification or deletion, crucial for forensic integrity. Access to these storage buckets must be strictly controlled using IAM policies (Least Privilege Principle) and multi-factor authentication (MFA).

3. Data Integrity and Tamper Detection

To prove logs haven't been altered, implement mechanisms like cryptographic hashing (checksums) upon ingestion. Regularly verify these hashes against stored logs. Any discrepancy indicates potential tampering. Using WORM storage is the primary defence here, but integrity checks add an extra layer of assurance.

4. Anonymisation and Encryption of Sensitive Data

Logs often contain Personal Identifiable Information (PII) or other sensitive data. For long-term retention, especially beyond 180 days, consider anonymising or pseudonymising this data to comply with the DPDP Act. Encrypt logs both in transit (TLS) and at rest (AES-256) to protect against unauthorised access. This is particularly important for Indian businesses handling customer data, where data fiduciaries have clear responsibilities.

5. Time Synchronisation Across Systems

Accurate timestamps are paramount for correlating events during an incident. Ensure all your systems, from servers to network devices, are synchronised using Network Time Protocol (NTP). Discrepancies can severely hamper forensic investigations.

6. Regular Log Review and Audit Trails

It's not enough to just collect logs; you must review them. Implement a schedule for security teams to regularly review critical logs for suspicious activity. Also, ensure your log management system itself generates audit trails of who accessed which logs, when, and from where. This demonstrates accountability and adherence to internal security policies.

7. Disaster Recovery and Backup Strategy

Even secure storage can fail. Have a robust disaster recovery plan for your log management system and ensure backups of your critical log data are maintained in geographically separate locations. This protects against data loss due due to regional outages or catastrophic events.

When NOT to use this approach

While comprehensive log retention is vital for most businesses, very small startups or hobby projects with minimal user data and no regulatory obligations might find a full-scale SIEM or enterprise-grade cloud logging setup to be overkill initially. For such cases, basic server-side logging with periodic backups might suffice. However, as soon as you handle sensitive customer data, process payments via UPI, or scale your operations, implementing these checks becomes non-negotiable.

Cost-Effective Log Storage Strategies for Indian Startups and MSMEs

Retaining vast amounts of log data can become expensive. Indian businesses, especially MSMEs and startups, need to balance compliance with cost-efficiency. Cloud providers offer tiered storage solutions that can significantly reduce costs for data accessed infrequently.

Note: Costs are indicative as of 2026 and can vary based on region, provider, and data transfer charges. Always check current pricing for AWS, Azure, or Google Cloud in their India regions (e.g., Mumbai, Hyderabad).

In a recent client engagement, a D2C brand processing millions of UPI transactions needed to retain payment and user activity logs for 180 days for CERT-In and longer for specific fraud detection purposes. Our team measured their daily log volume at approximately 50 GB. By implementing an intelligent-tiering strategy, moving logs older than 30 days to infrequent access and then to archive after 90 days, we reduced their monthly storage costs by nearly 70% compared to keeping all logs in standard storage. This allowed them to stay compliant without incurring prohibitive infrastructure costs.

Integrating Legacy Systems and Diverse Log Sources

Many Indian businesses, particularly established MSMEs, operate with a mix of modern cloud-native applications and legacy on-premise systems. Integrating logs from such diverse environments presents unique challenges:

• Proprietary Log Formats: Older systems often generate logs in non-standard, cryptic formats. Custom parsers or log agents configured with regex patterns are often required to normalise this data into a structured format like JSON.
• Network Constraints: Tier-2 and Tier-3 cities might have variable network connectivity, making reliable log transmission challenging. Implement local caching for log agents and robust retry mechanisms to prevent data loss during network interruptions.
• Resource Limitations: Legacy servers might have limited CPU or memory. Lightweight log agents are crucial to avoid performance degradation.

Our team recently worked with a manufacturing SME in Pune that had critical production machinery running on decades-old control systems. Their logs were written to local files in an obscure format. We deployed a custom Filebeat agent with specific grok patterns to extract relevant data, then forwarded it securely over a VPN to a cloud-based log aggregation platform. This enabled them to meet CERT-In requirements for operational technology (OT) logs without a complete system overhaul.

Automating Log Monitoring and Incident Detection

Collecting logs is only half the battle. To be truly effective, logs must be monitored for anomalies and potential security incidents. This is where automation comes in, especially for meeting CERT-In's stringent six-hour incident reporting window.

• Alerting Rules: Configure your log management platform (e.g., ELK Stack, Splunk, cloud-native SIEMs like Azure Sentinel or AWS Security Hub) to trigger alerts on suspicious patterns: multiple failed login attempts, unusual data access, critical system errors, or known attack signatures.
• Security Information and Event Management (SIEM): For larger enterprises or those with stringent compliance needs (e.g., fintech regulated by RBI, SEBI), a SIEM solution provides centralised security monitoring, threat detection, and incident response capabilities. While potentially costly, many cloud-based SIEMs offer pay-as-you-go models that can scale with your business.
• Automated Response: Beyond alerting, consider automating basic responses, such as blocking an IP address after a brute-force attempt or isolating a compromised server. This significantly reduces response time and limits potential damage.

FAQ

What type of logs does CERT-In require Indian businesses to retain?

CERT-In mandates retention of logs from all ICT systems, including network devices, servers, applications, and cloud infrastructure. This covers user access, configuration changes, system events, and security logs, generally for a rolling 180-day period.

How much does log retention typically cost in India for a startup?

Costs vary significantly based on log volume, retention period, and storage tier. For a startup generating ~10GB of logs daily, using a tiered cloud storage strategy (e.g., AWS S3 Intelligent-Tiering) could range from ₹5,000 to ₹15,000 per month, plus GST, depending on retrieval patterns.

Is cloud storage compliant with CERT-In's log retention requirements?

Yes, cloud storage can be compliant, provided it offers features like data immutability (WORM), robust access controls (IAM), encryption at rest and in transit, and adherence to data residency requirements where applicable. You must ensure your implementation uses these features effectively.

What's the difference between CERT-In log retention and DPDP Act data retention?

CERT-In focuses on the retention of system and security logs for incident response and cybersecurity. The DPDP Act governs the retention of personal data. While logs may contain personal data, the DPDP Act primarily addresses data minimisation, consent, and purpose limitation for personal data, often requiring deletion when no longer needed, which can conflict with long-term log retention. Anonymisation is key here.

Can a small Indian business implement CERT-In log retention effectively?

Absolutely. While enterprise-grade solutions exist, smaller businesses can leverage cost-effective cloud logging services (like AWS CloudWatch, Azure Monitor) or open-source tools (e.g., ELK Stack on a low-cost VM) combined with tiered cloud storage to meet the requirements without a huge budget. Krapton can also help build SaaS development solutions that are secure by design.

Building a Security-First Culture with Krapton

Navigating the complexities of CERT-In directions, the DPDP Act, and general cybersecurity best practices requires deep engineering expertise. At Krapton, we don't just build software; we build secure software. Our approach integrates DevSecOps principles from the ground up, ensuring that security is baked into every stage of development, not bolted on as an afterthought. From architectural design to deployment and monitoring, our teams are proficient in implementing robust log retention, incident response, and data protection mechanisms tailored for the Indian market.

Ready to secure your applications and ensure compliance? Get a security-minded engineering team — share your project brief with Krapton today and let's build something secure together.