The CISO's Guide to CERT-In Directions: 6-Hour Reporting Without the Panic
India's CERT-In Directions changed incident response from a best-effort discipline into a clock-driven legal obligation: specified cyber incidents must be reported to CERT-In within six hours of noticing or being notified. Four years on, most enterprises still discover the gaps in their pipeline during a live incident, the most expensive possible time.
What the Directions actually require
- 6-hour reporting of specified incidents, including ransomware, data breaches, data leaks, identity theft, website defacement, attacks on critical infrastructure, and unauthorized access to systems or data.
- 180-day log retention of ICT system logs, maintained within Indian jurisdiction and produced to CERT-In on demand.
- Clock synchronization to NIC/NPL NTP servers, so evidence timelines are legally coherent.
- A designated point of contact registered with CERT-In, with current details.
Why teams miss the window
The six hours are rarely lost to slow detection, they're lost to ambiguity. Nobody is sure whether the event maps to a reportable category, who is authorized to file, what legal wants redacted, and where the evidence lives. Each open question burns an hour.
The playbook that works at 2 a.m.
Pre-map your taxonomy. Every alert category in your SOC should carry a pre-decided flag: reportable / not reportable / escalate-to-counsel. The classification debate happens once, in daylight, not per incident.
Pre-draft the report. CERT-In's format is known. Maintain templates with your organization's constants filled in, so the on-call engineer completes fields instead of composing prose.
Automate the evidence bundle. Your SIEM should export the incident timeline, affected assets, and indicators in one action. This is exactly what an agentic SOC does well, our platform drafts the CERT-In submission as a byproduct of triage.
Drill quarterly. Run a timed tabletop from "alert fires" to "report filed." If the drill takes longer than four hours, the real one will miss six.