Non-compliance carries criminal exposure
Section 70B(7) provides for imprisonment of up to one year, a fine, or both. It is among the few cyber obligations in India where individual liability is explicit.
Loading page content
Fast facts
The CERT-In Directions of April 2022, issued under Section 70B(6) of the Information Technology Act, 2000, are among the most operationally demanding cyber rules in force anywhere. They are legally binding, and non-compliance can attract imprisonment of up to one year or a fine under Section 70B(7).
Three requirements dominate. Specified cyber incidents must be reported to CERT-In within six hours of noticing them or being brought to notice — a window that assumes an incident process already exists and is rehearsed. All ICT system clocks must be synchronised to NPL or NIC NTP sources. And logs of all ICT systems must be maintained securely for a rolling 180 days within Indian jurisdiction.
The reportable incident list is broad, covering far more than data breaches: targeted scanning of critical systems, unauthorised access, website defacement, malware, identity theft, DDoS, data breach or leak, rogue wireless access points, attacks on IoT and cloud, and incidents affecting digital payment systems.
Who it applies to
Penalties
Non-compliance with directions issued under Section 70B(6) is punishable under Section 70B(7) of the IT Act with imprisonment of up to one year, or a fine of up to one lakh rupees, or both.
The commercial and regulatory argument, rather than a restatement of the text. If none of these apply to you, the honest answer is that this framework is not your priority.
Section 70B(7) provides for imprisonment of up to one year, a fine, or both. It is among the few cyber obligations in India where individual liability is explicit.
Organisations lose the window waiting for someone empowered to file. On unannounced test, the sequence from detection to submitted report routinely takes eight to eleven hours — almost all of it spent finding an authoriser.
Targeted scanning of critical systems, website defacement, rogue wireless access points and attacks on IoT are all reportable. A decision tree built only around personal data breach will systematically under-report.
Scope is the decision that sets the cost, and it is usually made in week one when the team knows least. Both columns matter equally.
In scope
Out of scope
How the boundary is decided: The obligation attaches to the entity, not the system. An organisation with Indian operations carries it across its estate, including infrastructure hosted abroad — which is what makes the in-country log retention requirement an architecture question rather than a policy one.
Stated as the duty rather than the clause number, because clause numbers do not tell an engineering team what to build.
Mandatory reporting of any incident in the specified list to CERT-In within six hours of noticing or being notified, using the prescribed format and channel.
All ICT systems must synchronise to the Network Time Protocol servers of the National Informatics Centre or National Physical Laboratory, or to sources traceable to them.
Logs of all ICT systems maintained securely for a rolling 180 days, retained within Indian jurisdiction and produced to CERT-In on order.
A designated point of contact registered with CERT-In, with changes communicated promptly.
Data centres, VPS providers, cloud providers and VPN providers must register and retain accurate subscriber information for five years after cancellation or withdrawal.
Virtual asset service providers and exchanges must maintain KYC and transaction records for five years.
The areas your teams will actually be building in, with control counts where the framework defines them.
Monitoring capable of noticing reportable incidents fast enough for a six-hour clock to be achievable.
Pre-approved decision tree, prepared templates, named authorisers and out-of-hours escalation.
NTP architecture pointing at NPL or NIC sources, with monitoring for drift and failure.
Centralised, tamper-evident log retention for 180 days with Indian data residency and rapid retrieval.
Where applicable, KYC capture and five-year retention meeting the specified data fields.
Phases overlap deliberately. Design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Week 1
Run an unannounced out-of-hours exercise and time the sequence from detection to submitted report. This establishes the real starting position.
Weeks 1–3
A one-page classification aid a duty engineer can run alone, pre-approved by legal so following it is the legal position.
Weeks 2–4
Standing delegation to a named authoriser and two alternates, documented from the board or executive committee, with contact details in the runbook.
Weeks 3–8
Three-tier retention meeting 180 days in Indian jurisdiction with immutability, plus NTP synchronisation verified across every system class.
Weeks 6–10
One incident assessment that fires CERT-In, DPDPA, sectoral and contractual notifications from a single determination, then re-test the clock.
Named artefacts, listed in the statement of work. If something is not on this list, we will tell you before you sign rather than after.
In force since 28 June 2022. Compliance is continuous; the operational readiness work typically takes 6–10 weeks.
Baseline test
Week 1
The uncomfortable measurement that makes the rest fundable.
Decision and authorisation
Weeks 1–4
Fixes the actual bottleneck. Cheap, fast and the highest-value phase.
Log architecture
Weeks 3–8
The costly phase. Tiering keeps it affordable.
Unification and re-test
Weeks 6–10
One assessment firing all obligations, validated by a second timed exercise.
The sequence we follow, and the parts where first-time implementations most often lose time.
Test the six-hour clock with an unannounced exercise — most organisations discover they cannot meet it.
Build a decision tree that lets a duty engineer classify a reportable incident without waking a lawyer.
Verify NTP configuration across every system class, including cloud instances and network devices.
Design log retention that satisfies 180 days and Indian residency without unaffordable storage cost.
Pre-position reporting templates and CERT-In channel credentials so the first hour is not spent on logistics.
Integrate CERT-In reporting with DPDPA and contractual breach notification so one incident triggers one coordinated response.
Defensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityCertification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilitySecure the control plane, not just the workloads.
Landing-zone design, identity hardening, posture management and Kubernetes security across AWS, Azure and Google Cloud — with guardrails engineers do not route around.
Explore capabilityThe requirement is not the expensive part — the architecture is. A three-tier design that meets 180 days in Indian jurisdiction at roughly a fifth of the licensing-led cost.
The failure is never detection. It is authorisation — nobody knows who can file, and the person who does is asleep. Here is how to build a reporting capability that survives a Saturday.
Sequencing matters. Running these together off one control library costs meaningfully less than running them apart.
Including the questions where the honest answer is less convenient than the marketing one.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a question