What is CERT-In's 6-hour reporting rule?
One of the tightest mandatory-incident-reporting windows in the world, and why the clock starts before your investigation is anywhere near finished.
CERT-In's 6-hour reporting rule, part of its April 2022 cybersecurity directions issued under Section 70B of the IT Act, requires organizations to report specified categories of cyber incidents to India's Computer Emergency Response Team within six hours of noticing them — not six hours after confirming what happened.
Last updated:
The definition
CERT-In (the Indian Computer Emergency Response Team) issued directions in April 2022 under Section 70B of the Information Technology Act, 2000. The best-known provision is the six-hour window: certain categories of cyber incident — data breaches, unauthorized access, ransomware, and others on CERT-In's published list — must be reported "within 6 hours of noticing such incidents or being brought to notice about such incidents." The clock starts on awareness, not on completed root-cause analysis.
The other three provisions people forget
The six-hour rule gets the headlines; three more requirements shape whether you can actually meet it.
180-day log retention
Logs of ICT systems must be enabled and securely maintained for a rolling 180 days within Indian jurisdiction, and produced to CERT-In on request.
NIC/NPL time sync
System clocks must be synchronized to the Network Time Protocol servers of NIC or NPL, or to accurate and traceable NTP servers — a prerequisite for a timeline anyone can actually reconstruct.
5-year retention, but narrower
A separate five-year record-retention requirement applies specifically to data centers, VPN providers, and cloud service providers (customer registration details) and to virtual-asset exchanges (KYC and transaction records) — not to general ICT logs, which fall under the 180-day rule above.
Why the six hours is the hard part
Most incident-response playbooks assume days to triage before anyone outside the security team is told. Six hours barely covers confirming an incident is real, let alone scoping it. The only way to meet the window without reporting on incomplete information is to already have the artifact CERT-In actually wants: a timestamped record of what happened, to what data, and what the system did about it — assembled before the incident, not during it.
That's what a hash-chained audit trail is for. See what PromptSec's audit log captures today, and what's still on the roadmap.
Whether an AI-driven data leak actually counts as a reportable incident is its own question — see where the ambiguity actually lives.
Where AI prompts fit in
A prompt that sends a customer database export to a chatbot is, functionally, a data exfiltration event — the same category of incident CERT-In's directions were written for, just arriving through a browser tab instead of a network breach. An organization that can't see that traffic can't report it within six hours, because it won't know it happened until the customer, or the regulator, tells them.
Find out what your team is
already sending to AI.
The first week of telemetry usually answers that better than any policy document. No credit card, no commitment — you reach the founding team directly.
Want to see it on your own team before talking price? Join the Design Partner Program — free for 30 days