CERT-In Incident Reporting Requirements Explained

Imagine discovering a data breach or a cyberattack affecting your systems. The immediate panic is real, but beyond containing the damage, a critical clock starts ticking for your business to comply with CERT-In's stringent incident reporting requirements. For small and mid-sized organisations across India, understanding and adhering to these mandates isn't just about good practice; it's a legal obligation that, if neglected, can lead to significant penalties and reputational damage.## What are CERT-In Incident Reporting Requirements?The Indian Computer Emergency Response Team (CERT-In) is the national nodal agency for responding to computer security incidents. In April 2022, CERT-In issued sweeping directions under Section 70B of the Information Technology Act, 2000, significantly tightening cybersecurity incident reporting requirements for all service providers, data centres, corporate bodies, and government organisations in India. These directions introduced a strict 6-hour deadline for reporting certain types of cyber incidents, fundamentally changing the incident response landscape for businesses. The goal is to enhance India's cyber resilience by enabling rapid information sharing and coordinated responses to emerging threats.### Who Needs to Report Cyber Incidents to CERT-In?The scope of entities covered by CERT-In's directions is broad and inclusive. If your organisation operates in India and falls under categories such as service providers, data centres, corporate bodies, or any government organisation, you are likely subject to these mandates. This includes a wide range of businesses, from IT and consulting firms to manufacturing and healthcare providers, as well as those managing critical information infrastructure.Essentially, if your business collects, processes, stores, or transmits digital data, you have a responsibility to report. The directions aim to cover any entity that could be a target or a conduit for cyber threats, ensuring a comprehensive national security posture.### What Types of Incidents Must Be Reported?CERT-In has specified an extensive list of incident types that mandate reporting. These are not limited to major data breaches but also include a range of activities that could compromise systems or data. Key categories include:1. System Compromises: Incidents affecting servers, networks, or applications that lead to unauthorised access, data alteration, or disruption.2. Data Breaches: Unauthorised access, acquisition, or disclosure of sensitive personal or organisational data.3. Denial of Service (DoS) / Distributed Denial of Service (DDoS) Attacks: Incidents aimed at making services unavailable to legitimate users.4. Malware Incidents: Detection of malicious software like ransomware, viruses, or spyware.5. Unauthorised Access: Any instance where an unauthorised party gains access to systems or data.6. Identity Theft, Spoofing, and Phishing: Incidents involving fraudulent attempts to acquire sensitive information.7. Attacks on Critical Infrastructure: Incidents targeting essential services like power, water, or telecommunications.8. Vulnerability Exploitation: Discovery and exploitation of security flaws in systems.9. Incidents Affecting Cloud Computing Systems: Any compromise of data or services hosted in the cloud.This list is not exhaustive and is regularly updated through CERT-In advisories. It is crucial for organisations to monitor these updates and ensure their incident response plans cover all reportable types.## The 6-Hour Deadline: Why It's CrucialThe most challenging aspect for many organisations is the stringent 6-hour deadline for reporting. From the moment an incident is detected or brought to notice, your team has a very limited window to initiate the reporting process. This short timeframe is designed to enable CERT-In to: * Gather intelligence quickly about emerging threats. * Issue advisories to other organisations to prevent widespread attacks. * Coordinate national responses more effectively.Failing to report an incident within this timeframe can lead to severe consequences, including penalties under Section 70B(7) of the Information Technology Act, 2000, which can amount to substantial fines and even imprisonment in certain cases. The message is clear: swift, decisive action is not just recommended; it's legally mandated.### What Information Do You Need to Report to CERT-In?When an incident occurs, CERT-In requires specific details to be provided within the 6-hour window. While a preliminary report focuses on immediate facts, it should generally include: * Nature of the Incident: A brief description of what happened. * Affected Systems: IP addresses, domains, and types of systems compromised. * Impact: Estimated or known damage, data loss, or service disruption. * Observed Indicators: Any signs like error messages, unusual network traffic, or suspicious logins. * Contact Details: For the person handling the incident within your organisation.The reporting format often involves an initial email or phone call, followed by a more detailed submission through the CERT-In reporting portal. Accuracy is paramount; providing misleading information can lead to further penalties.### How Do You Report an Incident to CERT-In?Reporting to CERT-In typically involves these steps:1. Immediate Contact: As soon as an incident is detected, the designated team member should prepare to make initial contact.2. Email Reporting: Send an email to the official CERT-In reporting address (incident@cert-in.org.in) with preliminary details.3. Phone Reporting: Simultaneously, or if email is not feasible, contact the CERT-In incident helpline.4. Online Portal: For more detailed submissions, use the CERT-In incident reporting portal, which requires registration.It's important to have an established internal process to gather and verify information rapidly before making the report.## Beyond Reporting: The Broader Compliance LandscapeCERT-In's directions are part of a larger push for stronger cybersecurity and data protection in India. Understanding how these mandates integrate with other regulatory frameworks, particularly the recently enacted Digital Personal Data Protection Act, 2023 (DPDP Act), is crucial for comprehensive compliance.### How Does the DPDP Act Relate to Incident Reporting?The Digital Personal Data Protection Act, 2023, is India's landmark data privacy law. It introduces significant obligations for organisations that process personal data, termed 'Personal Data Fiduciaries'. A key provision of the DPDP Act is the requirement to notify the Data Protection Board of India (DPBI) and affected Data Principals (individuals) in the event of a personal data breach.While CERT-In focuses on cyber incidents in a broader sense, a data breach that involves personal data will likely trigger obligations under both CERT-In's directions and the DPDP Act. This means: * CERT-In Reporting: Report the cyber incident (e.g., system compromise leading to the breach) within 6 hours of detection to CERT-In. * DPDP Act Notification: Notify the Data Protection Board of India and potentially the affected individuals