+91 85277 09690Enrol

CERT-In Cyber Security Directions, 2022

Six binding directions issued by CERT-In on 28 April 2022 to service providers, intermediaries, data centres, body corporates and Government organisations. They decide what logs exist and how soon an incident is reported, which is the raw material of every network investigation in India.

DirectionsIndian Computer Emergency Response Team2022In forceReviewed 2 November 2026
CERT-In Cyber Security Directions, 2022, DFRTI

The Indian Computer Emergency Response Team is the national agency for cyber security incident response under section 70B of the Information Technology Act, 2000, appointed by notification of 27 October 2009. Sub-section (6) of that section lets it call for information and give directions to service providers, intermediaries, data centres, body corporates and any other person, and sub-section (7) makes failure to comply an offence punishable with imprisonment up to one year or a fine up to one lakh rupees or both.

On 28 April 2022 CERT-In issued directions No. 20(3)/2022-CERT-In under that power, titled Directions relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe and Trusted Internet. The document is eight pages: six numbered directions, an Annexure I listing twenty types of incident that must be reported, an Annexure II format for a point of contact and an Annexure III on KYC documents. CERT-In published a set of 44 frequently asked questions in May 2022 and, on 27 June 2022, a notice extending the timelines for micro, small and medium enterprises and for customer validation.

The directions say they become effective 60 days after issue, which is 27 June 2022. The extension notice made them effective on 25 September 2022 for MSMEs as classified under the notification of 1 June 2020, and deferred to the same date the requirement on data centres, virtual private server, cloud and VPN providers to keep validated names, addresses and contact numbers of customers.

The Six Directions

Paraphrased from the text of 28 April 2022, in the order the document uses.

  1. 01
    Clock Synchronisation

    All service providers, intermediaries, data centres, body corporates and Government organisations must connect to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory or to servers traceable to them, to synchronise all their ICT system clocks. Entities spanning several countries may use another accurate standard time source as long as it does not deviate from NPL and NIC.

  2. 02
    Six-Hour Incident Reporting

    Any of those entities must report the cyber incidents listed in Annexure I to CERT-In within six hours of noticing them or being told of them, by email, telephone or fax, in the format published on the CERT-In website. The FAQ says report what is available within six hours and send the rest within a reasonable time.

  3. 03
    Point of Contact and Information on Order

    When CERT-In orders it for incident response or protective action, the entity must act, provide information or assist in the format and time specified, up to near real time. Each entity must designate a point of contact in the Annexure II format and keep it updated; all CERT-In communications go to that person.

  4. 04
    180 Days of Logs

    All the entities must enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days within Indian jurisdiction and provide them to CERT-In with any incident report or when ordered. The FAQ adds that logs may also be stored outside India so long as they can be produced in reasonable time and lists firewall, intrusion prevention, SIEM, web, database, mail, proxy, event, application, VPN and similar logs as examples.

  5. 05
    Customer Records for Data Centres, VPS, Cloud and VPN Providers

    These providers must register and keep for five years after any cancellation the validated names of customers, the period of hire, the IP addresses allotted, the email, IP address and timestamp at registration, the purpose of hiring, validated address and contact numbers and the ownership pattern of the customer. The FAQ limits VPN to providers of internet proxy-like services to the public; enterprise VPNs are outside it.

  6. 06
    Virtual Asset Records

    Virtual asset service providers, exchanges and custodian wallet providers must keep all KYC information and records of financial transactions for five years, in a form that lets each transaction be reconstructed with the parties' identifiers, IP addresses with timestamps and time zones, transaction IDs, public keys or addresses, the nature, date and amount. Annexure III lists the acceptable KYC documents by reference to RBI, SEBI and Department of Telecommunications procedures.

Incidents That Must Be Reported, Annexure I

Twenty categories, referring back to Rule 12(1)(a) of the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013. The main ones are below.

  • Targeted scanning or probing of critical networks and systems and compromise of critical systems or information
  • Unauthorised access to IT systems or data, and website defacement or intrusion with malicious code or links
  • Malicious code attacks such as virus, worm, Trojan, bots, spyware, ransomware and cryptominers
  • Attacks on servers such as database, mail and DNS, and on network devices such as routers
  • Identity theft, spoofing and phishing; denial of service and distributed denial of service
  • Attacks on critical infrastructure, SCADA and operational technology, and on wireless networks
  • Data breach and data leak as two separate categories
  • Attacks on IoT devices, digital payment systems, malicious and fake mobile apps and unauthorised access to social media accounts
  • Attacks or suspicious activity affecting cloud systems, big data, blockchain, virtual assets, robotics, 3D printing, drones and artificial intelligence and machine learning systems

Who Is Covered

From the directions and the FAQ of May 2022.

F
Foreign Entities
FAQ 26 and 27 say the directions apply to any entity in the matter of cyber incidents and cyber security incidents, and FAQ 29 asks providers serving users in India to designate a point of contact whether or not they have a physical presence here.
G
Government Organisations
Named expressly in the clock, reporting and log directions.
I
Individual Citizens
Not covered, according to FAQ 7.
M
MSMEs
Covered, but the 27 June 2022 notice gave them until 25 September 2022 to comply.
S
Service Provider, Intermediary, Data Centre, Body Corporate
The classes named in section 70B(6). Body corporate carries the meaning in section 43A of the Information Technology Act, 2000: any company, and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities. A private forensic laboratory is a body corporate.

How It Touches Forensic Work and a Laboratory

For a network or incident examiner the directions decide what evidence should exist. An Indian organisation that has complied will have 180 days of logs with clocks traceable to NIC or NPL, a named point of contact and an incident report to CERT-In within six hours. Timeline analysis depends on the clock direction more than on any other; a log whose clock drifted by minutes cannot be reconciled with another's. When logs are missing or clocks were never synchronised, that is itself a finding to record, and it may be a contravention the client needs to know about.

A forensic laboratory is also a body corporate in its own right. It must synchronise its own clocks, keep its own logs for 180 days, name a point of contact and report incidents on its own systems within six hours, including a data breach of case material. The duty to report to CERT-In sits alongside, and will in time sit alongside, the breach intimation to the Data Protection Board under the Digital Personal Data Protection Rules, 2025; the two reports have different recipients, different clocks and different content.

The customer record directions matter for attribution. Where an attack came through an Indian VPS, cloud or VPN provider, the provider should hold validated customer details, hire periods and allotted IP addresses for five years. A lawful request through the investigating agency can reach them; the laboratory's role is to tell the investigator what to ask for and for which period.

  • Check clock sources before building a timeline from multiple logs
  • Expect 180 days of logs from a compliant Indian entity and record it when they are absent
  • Run the laboratory's own six-hour reporting and 180-day logging as a body corporate
  • Tell investigators which provider records the direction on VPS, cloud and VPN should have preserved

What the Directions Do Not Do, and Common Misunderstandings

  • They are directions under a statute, not a statute. Their force comes from section 70B(6) and (7) of the Information Technology Act, 2000, and their scope is limited to cyber incidents and cyber security.
  • They do not make CERT-In an investigating agency. CERT-In coordinates response and collects information; criminal investigation remains with the police.
  • Six hours is for the first report, not for a complete one. The FAQ says report what is available and supplement within a reasonable time.
  • The 180-day log requirement does not say which logs. FAQ 37 gives examples and says the list is not exhaustive, so the organisation has to decide and document its own log set.
  • The customer record direction does not apply to a company's internal VPN for its own staff. FAQ 34 limits it to VPN services offered to the public.
  • Following the directions does not make an organisation compliant with any other law, and the directions do not displace sector regulators' own reporting rules.

Common Questions

Are the directions still in force?

Yes. The directions page on the CERT-In website lists the 28 April 2022 directions, the May 2022 FAQ and the 27 June 2022 extension notice, and nothing withdrawing them. Check the page for any later notice before relying on this summary.

Which incidents have to be reported within six hours?

All twenty categories in Annexure I. FAQ 30 highlights severe incidents such as denial of service, intrusion and ransomware on public information infrastructure, data breaches and data leaks, large-scale or frequent intrusions and incidents affecting human safety as the ones that must be in within six hours.

Do the logs have to be in India?

The direction says logs shall be maintained within Indian jurisdiction. FAQ 35 says logs may also be stored outside India so long as the obligation to produce them to CERT-In in reasonable time is met. Read both together and keep a copy that can be produced from India.

What is the penalty for not complying?

Section 70B(7) of the Information Technology Act, 2000: imprisonment up to one year or a fine up to one lakh rupees or both, on a complaint by an officer authorised by CERT-In, besides any other law that applies.

Official sources

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Disciplines where this applies

Courses that teach it

Go deeper with DFRTI

Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.

Explore the AcademyAbout membershipTalk to a counsellor