Request a callback

Glossary · CERT-In · Directions No. 20(3)/2022-CERT-In under s. 70B(6) of the IT Act 2000

CERT-In Directions 2022

Definition

CERT-In · Directions No. 20(3)/2022-CERT-In under s. 70B(6) of the IT Act 2000

The binding directions CERT-In issued on 28 Apr 2022 to all service providers, intermediaries, data centres, body corporates and government organisations, effective 60 days after issue. They require you to report the cyber security incidents listed in Annexure I to CERT-In within 6 hours of noticing them, keep logs of all ICT systems for a rolling 180 days within India, synchronise system clocks to the NIC or NPL time servers, and designate a point of contact; data centre, VPS, cloud and VPN providers must also keep validated customer records for five years. Non-compliance is punishable under s. 70B(7) of the IT Act with imprisonment of up to one year, a fine, or both.

Also called CERT-In 6-hour ruleCyber Security Directions 2022
Read the source

Sources: CERT-In Directions No. 20(3)/2022-CERT-In, 28 Apr 2022; CERT-In, FAQs on Cyber Security Directions, May 2022

In other laws

LawTermNote
DPDP Act 2023Personal data breach intimation, s. 8(6)A second clock for the same event where personal data is involved: without delay to the Board and affected individuals, with a detailed report within 72 hours.
GDPR (EU)Notification of a personal data breach, Art. 3372 hours to the supervisory authority, and only for personal data; CERT-In's 6 hours covers any listed incident.

Where it appears

Annexure I

Types of cyber security incidents to be reported within 6 hours

s. 70B(6)

IT Act 2000: CERT-In's power to issue directions

Related terms

Cyber security incident (CERT-In)Personal data breachSEBI CSCRFRBI IT governance directions 2023

This page explains the law in plain English. It is not legal advice.