Cyber Incident Reporting, CERT-In & IT Act Statutory Mandates

Ensuring strict legal compliance with the mandatory 6-hour reporting window to CERT-In for 20 specified categories of cybersecurity incidents, maintaining 180-day ICT system logs in India, and implementing Reasonable Security Practices under Section 43A.

All service providers, intermediaries, data centres, body corporates, and digital businesses operating ICT systems in India experiencing ransomware, DDoS, unauthorized data access, or system compromise.

• ICT system architecture diagram and server hosting topology (indicating Indian server footprint)
• Incident telemetry data: compromised IP addresses, timestamped error logs, indicators of compromise (IoC)
• System log architecture verifying 180-day rolling log retention within Indian jurisdiction
• Network time synchronization verification with NTP servers of National Physical Laboratory (NPL)
• Internal Incident Response Plan (IRP) and designated Point of Contact (PoC) registered with CERT-In
• Technical root-cause analysis (RCA) and containment measures initiated

1. Step 1: Detect and triage incident against CERT-In 20 mandatory reportable cyber incident categories
2. Step 2: Collect forensic telemetry, isolate affected systems, and notify internal breach response team
3. Step 3: Compile Initial Incident Report in prescribed CERT-In format (Form Annexure-1)
4. Step 4: Transmit initial report to CERT-In Incident Desk (`incident@cert-in.org.in`) within the strict 6-hour statutory window
5. Step 5: Maintain and preserve 180-day forensic server logs within India for government regulatory inspection
6. Step 6: Submit Final Root Cause Analysis (RCA) and mitigation report to CERT-In within statutory follow-up timelines