What is the CERT-In 6-hour incident reporting mandate?

Under Direction No. 20(3)/2022-CERT-In issued on April 28, 2022 under Section 70B(6) of the Information Technology Act, 2000, all service providers, intermediaries, data centers, body corporate, and government organizations in India must mandatorily report cybersecurity incidents to CERT-In within 6 hours of noticing or being brought to notice of such incidents.

Which cybersecurity incident types must be reported under Annexure I?

Annexure I specifies 20 incident categories, including targeted scanning/probing, compromise of critical systems, unauthorized access of IT systems, website defacement, ransomware and malware attacks, attacks on databases/mail/DNS, identity theft/phishing, DoS/DDoS attacks, attacks on Critical Information Infrastructure (CII), data breaches/leaks, attacks on digital payment systems (UPI/AePS), and supply chain compromises.

What is the mandatory 180-day system logs retention requirement?

CERT-In Directions 2022 require all service providers, intermediaries, data centers, and body corporate to enable and maintain logs of all their ICT systems securely within the Indian jurisdiction for a rolling period of 180 consecutive days. The logs must be furnished to CERT-In upon order.

Why is time synchronization with NPL-India mandatory?

ICT systems must synchronize their system clocks with the Network Time Protocol (NTP) servers of the National Physical Laboratory (NPL) or Inter-University Centre for Astronomy and Astrophysics (IUCAA), or servers traceable to them. This ensures legal defensibility and forensic synchronization of timestamps across logs during incident investigation.

What is the difference between Section 65B (Evidence Act) and Section 63 (BSA 2023)?

Section 65B of the Indian Evidence Act, 1872 required a written certificate confirming lawful custody, normal device operation, and cryptographic integrity for electronic records to be admissible in court. Effective July 1, 2024, the Bharatiya Sakshya Adhiniyam, 2023 (BSA) replaced the Evidence Act, with Section 63 now governing electronic evidence admissibility under identical high standards of custodial certification and cryptographic verification.

CERT-In 6-Hour Incident Reporter & Section 65B Evidence Generator

Track mandatory 6-hour CERT-In cybersecurity incident reporting deadlines under IT Act § 70B, audit 180-day log retention capacity with NPL NTP, and generate Section 65B / BSA 2023 evidence certificates.

⚡ Interactive Calculation Engine Active

Please enable JavaScript in your browser to run live computations, 2D envelope diagrams, and export PDF reports.

How to Use CERT-In 6-Hour Incident Reporter & Evidence Manifest Generator

Set the timestamp when your organization first noticed or became aware of the cybersecurity incident.
Monitor the live statutory 6-hour countdown clock indicating time remaining to submit the initial incident report to CERT-In.
Select the statutory incident classification from the 20 official Annexure I types under CERT-In Directions 2022.
Review and customize the pre-filled CERT-In Statutory Incident Report draft, and copy or email directly to incident@cert-in.org.in.
Navigate to the "180-Day Log Retention" tab to calculate storage capacity and generate Linux/Windows NTP configuration for NPL-India clock sync.
Open the "Sec 65B / BSA 63 Evidence Certificate" tab to compute SHA-256 hashes of digital logs client-side and generate court-admissible electronic evidence certificates.

Statutory Powers of CERT-In under Section 70B of the IT Act, 2000

The Indian Computer Emergency Response Team (CERT-In) functions as the national nodal agency for responding to computer security incidents. Under Section 70B(6) and Directions 2022, failure to report designated incidents within the mandatory 6-hour window or failure to retain logs for 180 days constitutes an offense punishable under Section 70B(7) with imprisonment up to 1 year, a fine up to ₹1,00,000, or both.

Forensic Time Synchronization Architecture with NPL-India NTP Stratum

Discrepancies in system time between distributed microservices, firewalls, and cloud load balancers can invalidate forensic timelines. CERT-In Directions 2022 mandate time synchronization with the National Physical Laboratory (NPL-India, time.nplindia.org) or IUCAA (time.iucaa.in). Enterprise infrastructure must configure Chrony or NTP daemons to synchronize with Indian Stratum-1 time servers.

Admissibility of Digital Evidence under BSA 2023 Section 63 / Sec 65B

In legal proceedings before Indian courts, digital logs, database exports, and packet captures are classified as secondary electronic evidence. Under the Supreme Court landmark ruling in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020), a formal certificate signed by the person in lawful control of the computer system is mandatory for admissibility. The certificate identifies the device, affirms normal operational integrity, and provides cryptographic SHA-256 digests.

180-Day Rolling Log Retention Strategies and Cold Storage Archival

To fulfill the 180-day retention mandate cost-effectively, organizations implement tiered data lakes. Hot logs (Syslog, CloudTrail, VPC Flow Logs, WAF) remain searchable in Elasticsearch/OpenSearch for 30–60 days, then transition to append-only, immutable WORM (Write Once Read Many) cold storage (such as AWS S3 Glacier Vault Lock or Azure Immutable Blob) with SHA-256 integrity checksums within Indian sovereign data centers.

Frequently Asked Questions

What is the CERT-In 6-hour incident reporting mandate?: Under Direction No. 20(3)/2022-CERT-In issued on April 28, 2022 under Section 70B(6) of the Information Technology Act, 2000, all service providers, intermediaries, data centers, body corporate, and government organizations in India must mandatorily report cybersecurity incidents to CERT-In within 6 hours of noticing or being brought to notice of such incidents.
Which cybersecurity incident types must be reported under Annexure I?: Annexure I specifies 20 incident categories, including targeted scanning/probing, compromise of critical systems, unauthorized access of IT systems, website defacement, ransomware and malware attacks, attacks on databases/mail/DNS, identity theft/phishing, DoS/DDoS attacks, attacks on Critical Information Infrastructure (CII), data breaches/leaks, attacks on digital payment systems (UPI/AePS), and supply chain compromises.
What is the mandatory 180-day system logs retention requirement?: CERT-In Directions 2022 require all service providers, intermediaries, data centers, and body corporate to enable and maintain logs of all their ICT systems securely within the Indian jurisdiction for a rolling period of 180 consecutive days. The logs must be furnished to CERT-In upon order.
Why is time synchronization with NPL-India mandatory?: ICT systems must synchronize their system clocks with the Network Time Protocol (NTP) servers of the National Physical Laboratory (NPL) or Inter-University Centre for Astronomy and Astrophysics (IUCAA), or servers traceable to them. This ensures legal defensibility and forensic synchronization of timestamps across logs during incident investigation.
What is the difference between Section 65B (Evidence Act) and Section 63 (BSA 2023)?: Section 65B of the Indian Evidence Act, 1872 required a written certificate confirming lawful custody, normal device operation, and cryptographic integrity for electronic records to be admissible in court. Effective July 1, 2024, the Bharatiya Sakshya Adhiniyam, 2023 (BSA) replaced the Evidence Act, with Section 63 now governing electronic evidence admissibility under identical high standards of custodial certification and cryptographic verification.