Regulatory directionIndia

CERT-In Directions (April 2022) (CERT-In Directions)

Directions on cyber-incident reporting, log retention and related measures.

Request an Assessment

Classification

Regulatory direction

Issuing authority

Indian Computer Emergency Response Team (CERT-In), MeitY

Jurisdiction

India · Sector: All

Status / edition

In force

Key dates

Issued 28 April 2022 (under s.70B(6) of the IT Act)

Mandatory or voluntary

Mandatory (in scope)

Who it applies to

Service providers, intermediaries, data centres, body corporate and government organisations in India.

Purpose

Directions on cyber-incident reporting, log retention and related measures.

Major requirements / obligations

  • Report specified cyber incidents to CERT-In within 6 hours
  • Maintain ICT logs (rolling 180 days)
  • Time synchronisation (NTP)
  • KYC/record retention for certain providers

Control domains

Incident responseLogging and monitoringGovernance

Official reference

https://www.cert-in.org.in/ ↗

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.