CERT-In 6-Hour Reporting Rule: Who Must Report Cyber Incidents and How

Under the CERT-In Directions of 28 April 2022, issued under s.70B(6) of the Information Technology Act, 2000, service providers, intermediaries, data centres, body corporates and government organisations must report listed cyber incidents (ransomware, unauthorised access, data breaches, phishing and 16 other types) to CERT-In within 6 hours of noticing them or being told of them. They must also keep logs of all their ICT systems for 180 days within India, synchronise system clocks and name a point of contact. Non-compliance is punishable under s.70B(7) with up to 1 year, or fine up to ₹1 lakh, or both.

What CERT-In is and where the power comes from

The Indian Computer Emergency Response Team (CERT-In) is the national agency for responding to cyber security incidents, designated under s.70B of the IT Act. Section 70B(6) allows CERT-In to call for information and give directions to service providers, intermediaries, data centres, body corporates and any other person. Section 70B(7) makes failure to provide information or comply with a direction punishable.

Using this power, CERT-In issued Directions on 28 April 2022, effective from 27 June 2022, and clarified them in FAQs in May 2022.

Who is covered, and what must be reported

The Directions apply to service providers, intermediaries, data centres, body corporates and government organisations. Additional record-keeping duties fall on data centres, VPS, cloud and VPN providers (subscriber details for 5 years) and on virtual asset exchanges and wallet providers (KYC and transaction records for 5 years). Individuals are not covered.

Annexure I lists 20 types of reportable incidents. The ones an ordinary office is most likely to face:

• Malicious code attacks, including ransomware, viruses, trojans and spyware
• Unauthorised access to IT systems or data, and to social media accounts
• Data breaches and data leaks
• Identity theft, spoofing and phishing attacks
• Website defacement or intrusion
• Denial of service attacks and attacks on mail, database or DNS servers
• Attacks on e-governance, e-commerce and digital payment systems

The rest cover cloud, IoT, critical infrastructure, blockchain, virtual assets, drones and AI systems.

The 6-hour clock in practice

The 6 hours run from when the incident is noticed or brought to notice, not from when the damage is fully understood. The CERT-In FAQs say the first report may contain whatever information is available at that time, and further details can follow within a reasonable time. Reporting methods and the incident reporting form are published on the CERT-In website (cert-in.org.in).

On a Monday morning, the IT cell of a public institution in Bhopal finds the administrative server encrypted, with a ransom note in every folder. The instinct is to restore from backups first and report later. That is legally the wrong order. The correct sequence is:

1. Isolate. Disconnect affected machines from the network to stop the spread. Do not wipe them.
2. Preserve logs. Secure firewall, server, VPN, email and application logs.
3. Report. Send the initial report to CERT-In within 6 hours through the nodal officer. Register a police complaint as well; ransomware with an extortion demand is a crime under IT Act ss.43 and 66 and BNS s.308.
4. Restore. Rebuild from clean, tested backups only after the entry point is understood, or the attacker simply returns.

Lessons from the AIIMS attack, 2022

On 23 November 2022, five servers running the e-Hospital system of AIIMS, New Delhi were compromised and about 1.3 terabytes of data was encrypted. For about two weeks, registration, admission and discharge had to be run largely by hand. The Delhi Police’s IFSO unit registered a case of extortion and cyber terrorism; cyber terrorism under IT Act s.66F is punishable with imprisonment up to life.

On 16 December 2022, the Minister of State for Electronics and IT told the Rajya Sabha that the attackers had exploited improper network segmentation, and that all data was restored from a backup server the attack had not reached. Two lessons follow for every office:

• Segmentation contains the attack. If systems are not separated, one breach reaches all of them.
• Tested, separate backups save the data. A backup on the same network is often encrypted along with everything else.

Common mistakes

• Waiting for a “full picture” before reporting. The rule asks for a report within 6 hours with the information then available.
• Keeping logs for 30 or 60 days because that is the device default. The Directions require 180 days.
• Treating it as only an IT matter. Officers in charge can face personal exposure under IT Act s.85 where an offence is committed by a company, unless they prove the offence happened without their knowledge or that they exercised all due diligence. A written incident procedure, training records and a timely report are that diligence on file.
• Forgetting the data protection side. From 13 May 2027, a personal data breach must also be intimated to the Data Protection Board and to each affected person under the DPDP Act and Rules.

Frequently asked questions

Does the 6-hour rule apply to government offices?

Yes. The Directions expressly apply to government organisations along with service providers, intermediaries, data centres and body corporates.

What if we do not know the full details within 6 hours?

Report what you know. The FAQs allow further information to follow within a reasonable time.

Must logs be stored in India?

The Directions require logs to be maintained within Indian jurisdiction for 180 days. The FAQs say logs may be kept abroad if they can be produced to CERT-In within a reasonable time, so the safest course is storage in India.

What is the penalty for not reporting?

Up to 1 year, or fine up to ₹1 lakh, or both (IT Act s.70B(7)).

Quick quiz

Staff who want a shorter course on personal online safety can take the Cyber Fraud Safety certificate course (₹299). For IT cells, administrators and nodal officers: Cyber Crime Law for Offices and Institutions, ₹599. These are certificates of completion, not professional qualifications.

Sources

• Information Technology Act, 2000: ss.43, 66, 66F, 70B(6), 70B(7), 85
• CERT-In Directions under s.70B(6) relating to information security practices, procedure, prevention, response and reporting of cyber incidents, dated 28 April 2022, with Annexure I
• CERT-In, Frequently Asked Questions on the Cyber Security Directions, May 2022
• Bharatiya Nyaya Sanhita, 2023: s.308
• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
• Written reply of the Minister of State for Electronics and IT in the Rajya Sabha, 16 December 2022, on the AIIMS cyber attack

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.