Since June 2022, Indian companies have had to report specified cyber incidents to CERT-In within six hours of noticing them. The rule applies to body corporates of every size, not only banks and telecom firms, and the volume of incidents is large: CERT-In handled over 29.44 lakh cyber incidents in 2025. This guide explains what small companies must report, how to do it, and the logging setup the Directions expect.
What the CERT-In Directions are
CERT-In issued its Directions on information security practices and incident reporting on 28 April 2022, using its powers under Section 70B of the IT Act, 2000. They took effect on 27 June 2022. A later CERT-In order gave Micro, Small and Medium Enterprises until 25 September 2022 to comply, so the extension has long expired and the full rules now apply to small firms.
The Directions cover service providers, intermediaries, data centres, body corporates and government organisations. In practice almost any registered company that runs IT systems is a body corporate. CERT-In has said individual citizens are not covered. CERT-In also published FAQs in May 2022 that clarify several practical questions, covered below.
Which incidents must be reported in six hours
Annexure I lists 20 incident types. Some are obvious, such as ransomware, data breaches and data leaks. Others catch small companies off guard, such as targeted scanning of critical systems, unauthorised access to a company social media account, fake mobile apps that copy your brand, and attacks on cloud systems. Attacks on AI and machine learning systems are also on the list.
- Targeted scanning or probing of critical networks and systems
- Compromise of critical systems or information, and unauthorised access to IT systems or data
- Website defacement or intrusion, and malicious code on sites
- Malware, including ransomware, bots, spyware and cryptominers
- Attacks on servers such as database, mail and DNS, and on routers
- Identity theft, spoofing and phishing; denial-of-service attacks
- Data breach and data leak
- Attacks on payment systems, IoT devices, cloud systems and applications
- Malicious or fake mobile apps; unauthorised access to social media accounts
- Attacks on AI, machine learning, blockchain, virtual asset and drone systems
When the six-hour clock starts and what to send
The six hours run from the time you notice the incident or someone brings it to your notice. You do not need a full investigation before reporting. The FAQs allow you to send the information you have within six hours and add details later within a reasonable time. The FAQs also say the entity that notices the incident must report it, and that this duty cannot be passed to a vendor through a contract or indemnity.
Reports go to CERT-In by email at incident@cert-in.org.in, by phone on 1800-11-4949 or by fax on 1800-11-6969. CERT-In publishes a reporting format on its website, but treats the form as guidance and accepts information in any readable form. Keep a copy of what you sent and the time you sent it.
The logging, clock and contact rules
Reporting is only one part of the Directions. Companies must enable logs on all ICT systems and keep them securely for a rolling 180 days. The text says within Indian jurisdiction, and the FAQs allow storage outside India as long as the logs can be produced to CERT-In within a reasonable time. Clocks must sync with NTP servers of the National Informatics Centre or the National Physical Laboratory, or servers traceable to them.
Each covered entity must name a Point of Contact to deal with CERT-In, using the Annexure II format, and keep the details current. Data centres and cloud, VPS and VPN providers carry an extra duty to keep certain subscriber records for five years after an account ends.
| Obligation | Requirement | Who it applies to |
|---|---|---|
| Incident reporting | Report Annexure I incidents within 6 hours of noticing | All covered entities |
| Log retention | Keep ICT system logs securely for a rolling 180 days | All covered entities |
| Time sync | Sync clocks to NIC or NPL NTP servers, or traceable sources | All covered entities |
| Point of Contact | Designate and update a contact in the Annexure II format | All covered entities |
| Subscriber records | Keep listed subscriber details for 5 years after an account ends | Data centres, cloud, VPS and VPN providers |
| KYC and transactions | Keep KYC and transaction records for 5 years | Virtual asset, exchange and wallet providers |
Penalties for non-compliance
Failing to provide information or comply with a CERT-In direction can lead to imprisonment of up to one year, a fine of up to ₹1 lakh, or both, under Section 70B(7) of the IT Act. Company officers can be liable where the failure happened with their consent, connivance or neglect. MeitY has said the power will be used reasonably and where non-compliance is deliberate, but small companies should not plan around that statement.
A six-hour response plan for a small team
Small teams miss the deadline mainly because nobody knows who decides whether an event is reportable. Write a one-page runbook that names a decision owner and a backup, lists the 20 incident types, and holds a pre-filled report template with company details. Store CERT-In's contact details in the same place as your on-call numbers.
Test the plan. Run a short tabletop exercise each quarter in which someone reports a phishing compromise or a ransomware alert, and time how long the team takes to send a first report. Check that logs from your cloud accounts, firewall and identity provider actually cover 180 days, because default retention settings vary by service and are easy to overlook.
- Name an incident decision owner and a backup
- Keep a pre-filled CERT-In report template ready
- Send a first report with what you know, then follow up
- Confirm 180-day log retention across cloud, identity and network tools
- Point all servers and devices to an approved NTP source
How CERT-In rules connect with DPDP and MSME guidance
A personal data breach can trigger more than one regime. From May 2027 the DPDP Rules add a separate duty to inform the Data Protection Board without delay and send a detailed report within 72 hours. Build one incident process that feeds both reports rather than two separate ones.
CERT-In also publishes help aimed at small firms. Its 2025 output included 15 Elemental Cyber Defense Controls for MSMEs, released in September 2025, and 1,530 security alerts. As of 2025 it had empanelled 231 security audit organisations, which small companies can use for audits. XDQ Labs helps small teams test their detection and logging so they can meet the six-hour window.
This guide summarises the CERT-In Directions, FAQs and public commentary as of November 2026. It is not legal advice. CERT-In can update its directions and reporting formats, so confirm the current requirements on the CERT-In website and with qualified counsel before relying on them.
Frequently asked questions
Do small companies have to report cyber incidents to CERT-In?
Yes. The 2022 Directions apply to body corporates, which includes most registered companies regardless of size. MSMEs got an extension only until 25 September 2022. Any of the 20 incident types in Annexure I must be reported within six hours of noticing it.
What happens if I cannot gather all details within six hours?
CERT-In's FAQs allow you to report the information available within six hours and send further details later within a reasonable time. A late first report is the bigger risk, so send what you know, keep a record of the time, and follow up.
How do I report an incident to CERT-In?
Email incident@cert-in.org.in, call 1800-11-4949 or fax 1800-11-6969. CERT-In publishes a reporting format on its website but accepts information in any readable form. Save a copy of the report and the time you sent it.
What is the penalty for not following CERT-In directions?
Under Section 70B(7) of the IT Act, failing to comply can lead to imprisonment of up to one year, a fine of up to ₹1 lakh, or both. Company officers can be liable if the failure happened with their consent, connivance or neglect.
Sources
- CERT-In Directions, AZB & Partners, 2022
- CERT-In releases FAQs explaining the direction on cybersecurity, Nishith Desai Associates, 2022
- CERT-In issues directions relating to information security practices, TaxGuru, 2022
- CERT-In Directions 2022 explained, Tranquility Cybersecurity, 2026
- CERT-In: India's Frontline Defender against Cyber Threats, Press Information Bureau, 2026
- CERT-In handled over 29.44 lakh cyber incidents in 2025, The Morung Express (IANS), 2026
- ERGO: Digital Personal Data Protection Rules, Khaitan & Co, 2025
