Compliance guide · India

CERT-In rules, without the panic.

CERT-In, India’s national cyber agency, expects you to report serious cyber incidents within six hours, keep 180 days of logs inside India and have your systems audited every year. In 2026 it added guidance for AI. Here is what applies to you, and how to be ready before it matters.

Get CERT-In ready See the six-hour clock
6-hour reporting playbook and drill180-day log checkPre-audit before your empanelled auditor
In plain words

CERT-In, the Indian Computer Emergency Response Team, is the national agency for cyber incidents. Its Directions of 28 April 2022 require service providers, data centres, companies and government bodies to report listed cyber incidents within 6 hours of noticing them, keep system logs for 180 days within India, and sync their clocks to official time servers. Its July 2025 audit guidelines call for a full security audit at least once a year and list AI systems among the things to audit.

Checked against official sources on . General information, not legal advice.

Report incidents
Within 6 hours
Keep logs
180 days, inside India
Audits
At least once a year
Applies to
Most organisations in India
The two rules everyone must meet

Six hours. 180 days.

Most of the CERT-In Directions come down to two numbers. Both need to be set up before an incident: you cannot create old logs, and six hours is not enough time to decide who is in charge.

Two CERT-In rules at a glance. A clock face shows the six hours from noticing a reportable cyber incident to reporting it to CERT-In: decide if it is reportable in the first hour, gather the facts by hour three, report by hour six. A grid of 180 squares shows the 180 days of system logs that must be kept within India, with clocks synced to official time servers. 6 HTO REPORT0 H · YOU NOTICE IT1 H · IS IT REPORTABLE?3 H · GET THE FACTS6 H · REPORT SENT TO CERT-INKEEP 180 DAYS OF LOGS, INSIDE INDIAMONTH 1MONTH 2MONTH 3MONTH 4MONTH 5MONTH 6Logs from all your systems, kept securely for arolling 180 days and given to CERT-In on request.Clocks synced to official time servers (NIC or NPL),so events line up across systems.
From CERT-In’s Directions of 28 April 2022. Six hours is short, so the decision of who reports, and what to send, has to be made before an incident, not during one.
What must be reported

Twenty incident types, including attacks on AI.

If something on this list happens, or someone tells you it has, the six-hour clock starts. When in doubt, report: CERT-In would rather hear early.

The twenty types of cyber incident that must be reported to CERT-In within six hours: 1 scanning of critical systems; 2 compromise of critical systems; 3 unauthorised access; 4 website defacement; 5 malware and ransomware; 6 attacks on servers, DNS and routers; 7 phishing and identity theft; 8 denial of service; 9 attacks on critical infrastructure, operational technology and wireless networks; 10 attacks on applications such as e-governance and e-commerce; 11 data breach; 12 data leak; 13 attacks on IoT devices; 14 attacks on digital payment systems; 15 malicious mobile apps; 16 fake mobile apps; 17 unauthorised access to social media accounts; 18 attacks on cloud systems; 19 attacks on big data, blockchain, virtual assets, robotics, 3D printing and drones; 20 attacks on artificial intelligence and machine learning systems. 01Scanning ofcritical systems02Critical systemcompromised03Unauthorisedaccess04Websitedefacement05Malware andransomware06Attacks on servers,DNS and routers07Phishing andidentity theft08DoS and DDoSattacks09Critical infra,OT and wireless10Attacks on apps,e-gov, e-commerce11Data breach12Data leak13IoT deviceattacks14Digital paymentattacks15Maliciousmobile apps16Fake mobile apps17Social mediaaccount takeover18Cloud systemattacks19Blockchain, crypto,drones, 3D printing20 · AIAI and machinelearning systems
The incident types listed in Annexure I of the Directions, in short form. Number 20, attacks on AI and machine learning systems, has been on the list since 2022.
Key dates

From incident rules to AI guidance.

APR 2022Directions issuedJUN 2022Six-hour rule in forceJUL 2025Audit guidelines: AI in scopeMAY 2026AI security blueprintJUN 2026AI flaw rules for vendors TODAY · NOV 2026
  1. APR 2022Directions issued
  2. JUN 2022Six-hour rule in force
  3. JUL 2025Audit guidelines: AI in scope
  4. MAY 2026AI security blueprint
  5. JUN 2026AI flaw rules for vendors

The Directions took effect 60 days after they were issued. The AI security blueprint is advice; the 2022 Directions are binding.

What CERT-In has issued

Four documents worth knowing.

  • Directions, April 2022

    Six-hour incident reporting, 180-day logs kept in India, clock sync, and extra records for VPN, cloud, data centre and crypto service providers.

  • Audit policy guidelines, July 2025

    How audits by CERT-In empanelled auditors should run: at least yearly and after major changes, with AI systems and software and AI bills of materials among the audit types.

  • AI security blueprint, May 2026

    Advice for organisations using AI: keep an AI inventory, control shadow AI, set clear limits for AI agents, keep an AI bill of materials and patch fast.

  • AI vulnerability guidelines, June 2026

    For technology vendors: report critical and high flaws that AI could exploit to CERT-In and Indian customers straight away, patch on set timelines and keep bills of materials.

How we get you ready

Ready before the clock starts.

  1. Week 1

    Log check

    Are logs from every system kept for 180 days, inside India, with synced clocks? We check, and fix the gaps.

  2. Weeks 1–2

    Reporting playbook

    Who decides, who reports, what to send. One playbook for CERT-In, the DPDP Board and your sector regulator.

  3. Week 3

    Six-hour drill

    A realistic incident, run against the clock with your team, so the first real one is not the first try.

  4. Weeks 3–6

    Pre-audit

    We test and review the way an auditor will, including your AI systems, so you fix issues before the audit.

  5. Audit week

    Audit support

    We work alongside the CERT-In empanelled auditor you appoint, and help close their findings fast.

HanulSec is not a CERT-In empanelled auditor. We get you ready and work alongside the empanelled auditor you choose, which keeps the final audit independent.
Questions

CERT-In questions, answered.

Q01Who has to follow the CERT-In Directions?
Service providers, intermediaries, data centres, companies (body corporates) and government organisations. In practice, almost any organisation running IT systems in India. VPN, cloud, data centre and virtual asset providers have extra record-keeping duties.
Q02What must be reported within six hours?
Any of the twenty incident types in the Directions, from ransomware, phishing and data leaks to attacks on cloud, payment and AI systems. The six hours run from when you notice the incident or are told about it. Reports go to CERT-In by email at incident@cert-in.org.in or through its other official channels.
Q03What logs must we keep, and where?
Logs from all your ICT systems, kept securely for a rolling 180 days within India and handed to CERT-In when asked. Your system clocks must be synced to the time servers of NIC or NPL, or to servers traceable to them, so that events can be matched up.
Q04Is a yearly security audit mandatory?
CERT-In’s July 2025 guidelines call for a comprehensive audit at least once a year, and again after major changes. Sector regulators such as the RBI and SEBI require audits by CERT-In empanelled auditors. Check what your regulator asks for, and plan the audit early: good auditors book up.
Q05Are you a CERT-In empanelled auditor?
No. We are honest about that. We prepare you, test your systems including AI, fix gaps and support you through the audit, while a CERT-In empanelled auditor of your choice performs the formal audit.
Q06What does CERT-In say about AI?
Attacks on AI and machine learning systems are one of the twenty reportable incident types. The 2025 audit guidelines list AI system audits and AI bills of materials. The May 2026 blueprint gives advice on AI governance, shadow AI and AI agents, and the June 2026 guidelines tell vendors how to handle flaws that AI could exploit.
Q07How does this fit with the DPDP Act?
One incident can trigger both: six hours to CERT-In, plus a notice to the Data Protection Board and affected people without delay and a full report within 72 hours. Banks and insurers may also owe a six-hour report to the RBI or IRDAI. We build one playbook that covers all of them.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings