CERT-In Cyber Security Directions: An Operational and Legal Compliance Guide for Indian Digital Businesses

Introduction: The Operational Reality of Cyber Regulations in India

For technology startups and digital businesses, cybersecurity was historically treated as an internal DevOps hygiene issue. Security architecture evolved around customer uptime, commercial service level agreements (SLAs), and standard software patches.

In India, that approach changed permanently with the notification of the Cyber Security Directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, 2000 (IT Act).

Cyber incidents are now subject to strict, time bound statutory reporting and architectural logging rules. Unlike international regimes such as GDPR, which permit a 72 hour notification window, Indian law imposes a mandatory 6 hour reporting deadline coupled with domestic log retention obligations.

This guide outlines the statutory framework, identifies core operational obligations, and provides a compliance roadmap for founders, Chief Technology Officers (CTOs), and compliance officers.

The Statutory Framework and Applicability

CERT-In operates as the national nodal agency under Section 70B of the IT Act for responding to computer security incidents. The Directions issued in April 2022 apply horizontally across the digital ecosystem, binding:

• Service providers and application operators.
• Intermediaries and social media networks.
• Data centers and hosting providers.
• Cloud computing service providers and Virtual Private Server (VPS) vendors.
• All bodies corporate operating digital systems in India.

Failure to furnish information or comply with directions issued by CERT-In is an offence under Section 70B(7) of the IT Act, punishable by imprisonment for up to one year, financial penalties, or both. Furthermore, non compliance compromises an intermediary’s statutory safe harbour protection under Section 79 of the IT Act.

Core Operational Mandates for Digital Services

The Directions establish four strict architectural and procedural duties:

A. The 6-Hour Mandatory Incident Notification Clock

Under Annexure I of the Directions, organizations must report any cybersecurity incident falling into 20 specified categories to CERT-In within 6 hours of noticing the incident or being informed of it.

Key covered incident categories include:

• Unauthorized access to IT systems, servers, or databases.
• Ransomware attacks and destructive malware propagation.
• Data breaches, data leaks, and identity theft incidents.
• Targeted scanning or probing of critical networks.
• Distributed Denial of Service (DDoS) and availability outages.
• Compromise of critical systems or infrastructure tokens.

Operational Implication: The 6 hour reporting window means technical triaging, legal risk assessment, and regulatory drafting must occur concurrently. Organizations cannot wait for a forensic root-cause analysis to finish before notifying CERT-In.

B. Mandatory 180-Day System Log Retention in India

All covered entities must enable and maintain system, server, and application logs for a rolling period of at least 180 days.

• Jurisdictional Mandate: These logs must be maintained securely within Indian territorial jurisdiction.
• Scope of Logs: Covers firewall logs, API gateway access logs, user authentication records, database modification logs, and administrator access traces.
• On Demand Production: Logs must be produced to CERT-In upon direction to assist in cyber forensic investigations.

Operational Implication: Companies hosting their infrastructure on multi region public clouds (such as AWS, Google Cloud, or Microsoft Azure) must configure centralized log forwarding pipelines to S3-compatible buckets or storage nodes physically located in Indian data center regions (e.g., Mumbai or Hyderabad).

C. System Clock Synchronization via Designated NTP Servers

All digital servers, network hardware, and containerized cloud environments must synchronize their system clocks to the Network Time Protocol (NTP) servers of:

• The National Physical Laboratory (NPL), or
• The National Informatics Centre (NIC).

Entities with infrastructure outside India may use alternative standard NTP servers, provided their timestamps are strictly traceable to coordinated universal time (UTC) without drift.

Legal Implication: In forensic investigations and judicial proceedings, server logs serve as electronic evidence governed by Sections 61 to 63 of the Bharatiya Sakshya Adhiniyam, 2023. Timestamp deviations across distributed microservices can render logs inadmissible in court.

D. Specific KYC Obligations for Cloud and VPS Providers

Cloud infrastructure providers, VPS vendors, and VPN operators must maintain verified subscriber records for a minimum of 5 years after the cancellation or termination of services. This data includes:

• Verified subscriber names, physical addresses, and contact numbers.
• Duration of service and ownership dates.
• IP addresses allocated and email addresses registered.
• Validated payment records, including bank account details and transaction identifiers.

Dual Regulatory Tracks: Interplay with the DPDP Act, 2023

Technology platforms must manage a dual track notification workflow when an incident involves personal data:

1. The Technical Track (CERT-In): Notification focuses on vector of attack, impacted IP blocks, systems compromised, and remediation actions within 6 hours.
2. The Privacy Track (DPDP Act): Under Section 8(6) of the Digital Personal Data Protection Act, 2023, a Data Fiduciary must notify personal data breaches to the Data Protection Board of India (DPB) and affected Data Principals in the prescribed form and manner.

Engineering, legal, and PR teams must harmonize both disclosures to avoid conflicting factual statements regarding breach severity and affected user scope.

Operational Compliance Checklist for Digital Platforms

To ensure readiness before a security incident occurs, tech organizations should implement the following steps:

1. Establish an Incident Response Playbook:

▸ Define clear internal escalation matrix: on call DevOps alerts Lead Security Engineer, General Counsel, and CEO within 30 minutes of a confirmed anomaly.

▸ Pre draft standard incident notification templates aligning with CERT-In’s Incident Reporting Form.

2. Verify Cloud Log Archival Policies:

▸ Audit serverless functions, Kubernetes pods, and database clusters to verify logs are retained for 180 days.

▸ Ensure log archives are stored in encrypted, append only, immutable storage within Indian data center boundaries.

3. Configure NTP Synchronization:

▸ Instruct DevOps teams to configure chrony or ntp daemons across all virtual machines and container base images to point directly to NIC or NPL NTP endpoints.

4. Revise Vendor & Sub-Processor Agreements:

▸ Insert contractual clauses in Master Service Agreements (MSAs) requiring third-party SaaS vendors and sub-processors to notify you of unauthorized access within 2 hours.

5. Designate a Single Point of Contact (PoC):

▸ Register an official Point of Contact with CERT-In who is reachable around the clock for regulatory inquiries.

The regulatory climate in India prioritizes rapid incident containment, auditable domestic trails, and national cybersecurity posture over corporate opacity. Digital businesses that integrate CERT-In compliance into standard DevOps architectures safeguard their corporate leadership from penal liabilities while building enterprise trust.