CERT-In: Reporting incidents, building response

In April 2022, India’s cyber-response agency set a six-hour clock for reporting specified cyber incidents after an organisation noticed them or was informed of them. The direction sought to get evidence to CERT-In quickly enough to support a coordinated response. Its later clarification allowed an initial report with the information available, followed by further details within a reasonable time. [1] [2]

The change strengthened obligations around an existing institution. The Indian Computer Emergency Response Team had been operational since January 2004. India’s National Cyber Security Policy was released on 2 July 2013, before the Modi government took office. Neither the agency nor the original policy began with the 2022 directions. [3] [4]

Evidence that can travel quickly

CERT-In issued the directions under section 70B(6) of the Information Technology Act. They applied to service providers, intermediaries, data centres, companies and government organisations, with an annexure identifying reportable incident types. The May FAQs explained the six-hour criteria, including data breaches, severe incidents affecting public infrastructure, large-scale or frequent incidents, and incidents affecting human safety. [1] [2]

The rules also required designated points of contact and retention of system logs for a rolling 180 days. Logs can supply the sequence of events needed to investigate an intrusion. Although the order referred to Indian jurisdiction, the FAQ clarified that logs could also be stored outside India if they could be produced to CERT-In within a reasonable time. [1] [2]

Implementation had qualifications. A June order extended the deadline to 25 September 2022 for specified MSMEs and certain subscriber-validation requirements. It was a limited extension, rather than a postponement of the whole framework for every organisation. [9]

A disputed retention requirement

For data-centre, cloud, virtual-server and VPN providers, the directions also specified subscriber information to retain for five years after cancellation or withdrawal of registration, or longer where required by law. That brought privacy and business models into the debate about incident response. [1]

On 2 June 2022, ExpressVPN announced that it would remove its physical servers from India, arguing that the requirements conflicted with its privacy model. It said users would still have virtual India locations served from Singapore and the UK. This was a company’s response to regulation, not the disappearance of its service for Indian users. [8]

CERT-In’s own FAQ said information would be sought case by case for its statutory work, rather than collected continuously under a standing arrangement. That stated the agency’s position; it did not independently settle the privacy implications of retaining the data. [2]

Response beyond the rule book

Operational work had expanded through other channels. Cyber Swachhta Kendra, launched in February 2017, offered malware analysis, botnet notifications and free removal tools. It added a remediation service to the older policy framework. A downloaded tool, however, does not by itself establish that an infection was successfully removed. [5]

For 2025, a government account reported 122 cybersecurity drills and exercises involving about 1,570 organisations, alongside training for 20,799 officers and professionals. These are concrete preparedness activities. They do not measure how quickly every participating organisation recovered from a real incident or how much loss it avoided. [7]

The threat workload remained substantial. A March 2026 parliamentary reply reported 29,44,248 cyber incidents reported to and tracked by CERT-In in 2025, compared with 20,41,360 in 2024. These are incident records, not unique victims, criminal cases or attacks prevented. Changes can reflect detection and reporting as well as underlying threats. The reply also said CERT-In did not maintain estimated financial-loss details for those incidents. [6]

The framework made reporting, evidence retention and coordination more explicit. The next test was what happened after an alert: an organisation identifying the affected systems, containing the intrusion and restoring a service people could safely use.