CERT-In 6-Hour Rule: What Indian Organisations Must Get Ready

CERT-In 6-hour cyber incident reporting rule checklist

Most Indian organisations know that CERT-In wants cyber incidents reported quickly. Far fewer have checked whether they could actually do it within six hours, at 2 AM on a Sunday, with the right logs in hand. This post is a short overview. The full checklist is on the Affix Center blog.

What the rule asks for, in brief

The CERT-In directions of 28 April 2022, issued under Section 70B(6) of the IT Act, 2000, apply to service providers, intermediaries, data centres, body corporates and government organisations. The core duties are:

  • Report specified cyber incidents within six hours of noticing them
  • Keep logs for 180 days, stored within India
  • Sync system clocks with NIC or NPL time servers
  • Name a point of contact for CERT-In

Why six hours is harder than it sounds

In practice, teams miss the deadline for three reasons: nobody is sure who can approve the report, the logs needed to understand the incident were never switched on or have already been overwritten, and device clocks disagree so the timeline cannot be rebuilt quickly.

Where to start this week

  • Name a CERT-In point of contact and a backup, and write a one-page escalation matrix
  • Turn on logging for firewalls, VPNs, servers, email and cloud consoles, and store it centrally
  • Prepare a short incident report template so the first report can go out with what you know
  • Run one timed tabletop exercise a year

One more point: once the DPDP Rules, 2025 fully apply, a single incident involving personal data may need two reports, one to CERT-In and one to the Data Protection Board.

Read the complete readiness checklist, incident list and FAQ here: CERT-In 6-Hour Rule: Cyber Incident Readiness Checklist

Published by Affix Center, a Mumbai-based IT services company working with government bodies, enterprises and SMEs. Learn more about our cybersecurity and compliance services.


Comments

Post a Comment

Popular posts from this blog

Self-Hosted GitLab? CVE-2026-97229 Is Being Exploited, Check Your Version

Image
If your team runs its own GitLab server, this one needs attention this week. CVE-2026-97229 is a CVSS 10.0 integer overflow in the regular expression compiler used by GitLab CI/CD. A crafted regex in a CI/CD configuration can let an attacker run code on the server. GitLab shipped fixes on 12 October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 October 2026. Which versions are affected 19.2 branch: fixed in 19.2.8 19.3 branch: fixed in 19.3.5 19.4 branch: fixed in 19.4.2 GitLab.com and GitLab Dedicated are already patched The root cause sits in Onigmo, the regex engine inside Ruby, so source or custom builds with their own Ruby may need a separate Ruby update. A short action list List every self-managed GitLab instance, including test and forgotten ones Upgrade each one to the fixed version for its branch Turn off open sign-up and limit who can push to public projects until patched Review recent .gitlab-ci.yml changes, unknown users and o...
Read more

Hiring a Website Developer? Six Warning Signs to Spot Before You Sign

Image
Many business websites get built twice. The first vendor wins on price, and a few months later the site is slow on mobile, the contact form stops working, and nobody can reach the developer. Most of this can be avoided with the right questions before signing. Warning signs in a website quote A fixed price given before anyone asks about content, integrations or users No live examples, or examples that no longer load Reluctance to register the domain and hosting in your company's name No mention of testing, backups or updates Pressure to sign fast with a "this month only" discount A launch plan with no redirects for old URLs, which can wipe out search traffic What to ask for instead An itemised proposal: pages, templates, features, integrations, revisions, testing, hosting and support A meeting with the project manager and lead developer, not only sales Written ownership of domain, hosting, source code, design files and content A short paid discovery phase that p...
Read more

Laravel Projects That Need a Rebuild After 18 Months: Five Causes and How to Avoid Them

Image
A common story: a business picks a Laravel vendor for a low quote, and about eighteen months later the app is slow, small changes break other features, and the next vendor says it must be rebuilt. Laravel is rarely the problem. The way the vendor was chosen usually is. Five causes behind costly rebuilds Business rules stuffed into controllers, so a new GST field touches many files No automated tests, even though Laravel supports PHPUnit and Pest The N+1 query problem: a list of 100 orders running 101 queries Security left to chance: debug mode on in production, or secrets stored in the code repository The vendor, not the client, holding the repository, servers and domain Version support matters too Per the official Laravel documentation, each major release gets bug fixes for 18 months and security fixes for 2 years. Laravel 13 came out in March 2026, and security support for Laravel 12 runs until February 2027. Plan upgrades in your maintenance contract. Before you sign Have an ...
Read more