Six Hours to Report: The CERT-In Directions of 2022 and the Making of India's Incident Governance

B.A.P-I Retrospective, 2020 to 2024. This paper looks back at 2022 and the lesson it holds for the protection of India's critical infrastructure.

1. Introduction

On 28 April 2022 the Indian Computer Emergency Response Team (CERT-In) issued a set of directions under sub-section (6) of Section 70B of the Information Technology Act, 2000, on information security practices and the reporting of cyber incidents (CERT-In, 2022, Apr. 28). The document ran to eight pages and contained six directions. It drew vigorous comment from the technology industry at home and abroad, and CERT-In responded within three weeks with a detailed set of frequently asked questions that clarified how the directions would operate, while holding firm on their core.

With hindsight, the 2022 directions deserve to be read as the moment India established a uniform, economy-wide discipline of incident governance. This commentary sets out what the directions required and why, how industry responded, what the clarifications settled, and what they mean for corporate compliance and for the protection of critical infrastructure today.

2. What the Directions Required

The six directions were brief and demanding. Entities were to synchronise the clocks of their information and communication technology systems with the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or with servers traceable to them. They were to report incidents of the kinds listed in an annexure to CERT-In "within 6 hours of noticing such incidents". They were to designate a point of contact for CERT-In. They were to enable logs of all their systems and maintain them securely "for a rolling period of 180 days" within Indian jurisdiction. Data centres, virtual private server providers, cloud service providers and VPN service providers were to retain validated subscriber names, periods of hire, allotted IP addresses, contact details and ownership patterns for five years or longer. Virtual asset service providers, exchanges and custodian wallet providers were to keep know-your-customer information and transaction records for five years (CERT-In, 2022, Apr. 28).

The annexure listed twenty categories of reportable incident, ranging from data breaches, ransomware and attacks on digital payment systems to targeted scanning and probing of critical networks. The directions applied to service providers, intermediaries, data centres, body corporates and government organisations, came into effect sixty days after issue, and warned that non-compliance could invite punitive action under sub-section (7) of Section 70B (CERT-In, 2022, Apr. 28). The government's stated reason was that CERT-In had "identified certain gaps causing hindrance in incident analysis" (PIB, 2022, Apr. 28).

3. The Government's Rationale and the Industry Response

The government set out its reasoning plainly. The Minister of State for Electronics and Information Technology stated that "Rapid & Mandatory reporting of incidents is a must and a primary requirement for remedial action", and observed that the existing cyber security rules were around eleven years old (PIB, 2022, May 18). The case was that cyber incidents were being reported regularly, but the information needed to investigate them was not always readily available from service providers (Business Today, 2022, Jun. 3). Industry bodies nonetheless sought changes. The Information Technology Industry Council, a global association of technology firms, asked that the six-hour window be extended to 72 hours, criticised the 180-day local log requirement and argued that the reportable categories were too broad because probes and scans are everyday occurrences (Greig, 2022, May 9). The Internet and Mobile Association of India sought a one-year deferment and a longer reporting window, following a joint representation by eleven industry associations earlier the same week (Business Today, 2022, Jun. 3).

Some foreign VPN providers chose to relocate rather than comply; ExpressVPN, for instance, announced in June 2022 that it would remove its India-based servers and serve Indian locations from Singapore and the United Kingdom (The Hacker News, 2022, Jun. 2). The government held its position on the core obligations, which was the correct call. A sovereign incident reporting regime cannot be calibrated to the business models of offshore providers, and the directions applied equally to domestic and foreign entities for so far as cyber incidents in India were concerned (CERT-In, 2022, May 18).

4. What the FAQs Changed

The FAQs released on 18 May 2022 showed CERT-In listening to stakeholders while preserving the purpose of the directions. They stated that individual citizens were not covered; that the VPN registration obligation did not apply to enterprise or corporate VPNs but to providers of internet proxy-like services to the general public; that logs "may be stored outside India also" provided they could be produced to CERT-In in a reasonable time; that system clocks need not be set to Indian Standard Time, since NTP supplies coordinated universal time and the time zone could be recorded with the timestamp; and that an entity could report within six hours "to the extent available at the time of reporting" and supply the rest later (CERT-In, 2022, May 18). On 28 June 2022 CERT-In extended the timeline for micro, small and medium enterprises, and for the subscriber validation obligations of data centre, cloud and VPN providers, to 25 September 2022 (PIB, 2022, Jun. 28).

Read side by side, the directions and the FAQs show responsive regulation at work: a firm text, followed by practical clarification of its most debated points while the core was preserved. The six-hour window survived. So did the clock synchronisation requirement and the point of contact. What changed was the practical burden: an early notification with partial facts, rather than a full report, became the six-hour obligation, and the log localisation requirement became one of production rather than of storage. That is a sound outcome, and it offers a model for future rule-making in which structured consultation before issue can secure the same result with less friction.

5. Incident Governance and Corporate Compliance

For so far as corporate compliance is concerned, the directions converted cyber security from a technical function into a board-level reporting obligation with a clock attached. A six-hour window cannot be met by an organisation that discovers an incident through its information technology team and then convenes a meeting to decide whether to tell anyone. It presupposes a defined incident classification aligned to the annexure, a designated contact empowered to report without escalation, logging that already exists when the incident is noticed, and clocks synchronised so that the timeline can be reconstructed. These are, in substance, the elements of an incident governance system, and the directions forced many Indian firms to build one.

The threat data has since vindicated the urgency. CERT-In tracked 13,91,457 cyber security incidents in 2022, 15,92,917 in 2023 and 20,41,360 in 2024 (PIB, 2025, Mar. 28). The six-hour standard has also spread into sectoral regulation: the draft cyber security regulations for the power sector published in October 2025 would require each entity's chief information security officer to report incidents to the sector's response team within six hours (Power Line, 2025, Oct. 8). Meanwhile the Digital Personal Data Protection Rules, notified in November 2025 with an 18-month phased timeline, impose a separate duty to inform affected individuals of personal data breaches (PIB, 2025, Nov. 14). One finds, as a result, that a single serious incident at an Indian company may now trigger several reporting duties to different authorities, on different clocks and in different formats.

6. From Directions to a Statute: Recommendations

The 2022 directions settled the principle that rapid, mandatory incident reporting is a national security function. What they could not do, as executive directions under a single section of a general statute, was build the architecture around that principle. Three recommendations follow. First, India should harmonise its reporting obligations into a single notification with a common format and one portal that routes the report to CERT-In, the sectoral regulator and, where personal data is involved, the data protection authority, so that the six-hour clock measures detection and not paperwork. Second, the reportable categories should be tiered by severity, preserving rapid reporting of significant incidents and attacks on critical systems while relieving entities of the obligation to report routine scanning. Third, these obligations should be placed on a statutory footing for critical sectors, as part of a Critical Infrastructure Protection Act that defines operators, duties and penalties in one instrument and links compliance to measurable resilience outcomes of the kind the Bharat National Resilience Index was designed to capture (Dash, 2025, Oct. 28).

The directions of April 2022 were debated, clarified and, in their essentials, upheld. Their lasting contribution was to make Indian organisations treat the hours after an incident as a matter of public duty, and to give CERT-In the timely information on which national cyber defence depends. The task now is to build that duty into a coherent statutory system.