Regulatory Playbooks 🇮🇳 Indian Mandate Aligned 10 min read

CERT-In Mandatory 6-Hour Cyber Incident Reporting Guidelines & Annexure-1 Template

Practical compliance breakdown of the Indian Computer Emergency Response Team (CERT-In) Cyber Security Directions. Details the mandatory 6-hour incident reporting window, 20 reportable incident types, official Annexure-1 submission format, and the 180-day log retention rule.

By BlueCiphr Incident Response Desk • Lead CEH & PenTest+ Auditors

📥 Download Offline Artifact: Audit-Ready Formats

Interactive Technical Checklist (7 Verification Checkpoints)

[Mandatory Clock] Notify CERT-In within 6 hours of noticing or being brought to notice of any cybersecurity incident.

Mandate: 6-Hour Rule
[Reporting Channels] Report via email to incident@cert-in.org.in or by calling 1800-11-4949 / Fax: 1800-11-6969.

Mandate: Official Channels
[Annexure-1 Form] Complete Annexure-1: Entity details, contact person, incident category, timestamp in IST.

Mandate: Annexure-1 Mandatory
[Technical Details] Document affected assets, IP addresses, malicious domains, file hashes (SHA-256), and attack vectors.

Mandate: IoC Documentation
[Containment Actions] Detail immediate containment steps taken (isolated hosts, revoked credentials, patched CVEs).

Mandate: Remediation Status
[180-Day Log Mandate] Ensure all firewall, server, database, and VPN logs are securely maintained within India for 180 days.

Mandate: 180-Day Log Retention
[NTP Time Sync] Synchronize all ICT system clocks with National Physical Laboratory (NPL) or NIC NTP servers.

Mandate: Indian NTP Standard

🇮🇳 CERT-In Mandatory 6-Hour Clock: Section 70B(6) IT Act 2000

Any service provider, intermediary, data centre, body corporate, or government organization in India must report cyber security incidents to CERT-In within 6 hours of noticing or being brought to notice of the incident.

The 20 Mandatory Reportable Incident Types

1. Targeted scanning/probing of critical networks

2. Compromise of critical systems/information

3. Unauthorized access of IT systems/data

4. Defacement of website or intrusion

5. Malicious code attacks (Virus/Worm/Ransomware)

6. Attack on Database, Mail, DNS, Routers

7. Identity theft, spoofing and phishing attacks

8. Denial of Service (DoS) & DDoS attacks

9. Attacks on Critical Information Infrastructure (CII)

10. Attacks on E-Governance & E-Commerce apps

11. Data Breach / Data Leak

12. Attacks on IoT devices & industrial networks

13. Attacks on Digital Payment & UPI systems

14. Attacks on AI/ML solutions & cloud compute

Official Annexure-1 Submission Format

To: incident@cert-in.org.in

Subject: Incident Report [Sec 70B] - [Entity Name] - [Date]

1. Name of Entity: [Entity Registered Name]

2. Designated Contact: [Name, CISO Title, Mobile, 24x7 SOC Contact]

3. Incident Category: [e.g., Ransomware / Data Breach / DDoS]

4. Timestamp Incident Noticed: [YYYY-MM-DD HH:MM IST]

5. Affected Assets: [IP Ranges, URLs, Servers in AWS ap-south-1]

6. Malicious IoCs: [SHA-256 Hashes, Attacker IPs, Malicious Domains]

7. Immediate Containment Status: [Host Isolated, Credentials Rotated]

### CERT-In Cybersecurity Directions: Complete Guide The CERT-In Directions 2022 establish mandatory reporting requirements across 20 incident categories within 6 hours. #### The 180-Day Log Mandate All organizations must maintain logs of all ICT systems for a rolling period of 180 days within Indian territory. Logs must include: - Inbound and outbound firewall traffic - User authentication events (AD, Okta, VPN) - Database administrative queries and schema modifications

        🛡️ AUDIT DEFENSE & TECHNICAL VERIFICATION
      

Need Accredited Auditors to Execute This Audit or Gap Assessment?

BlueCiphr's certified lead auditors (CEH Master, PenTest+, ISO 27001 Lead Auditors) conduct deep technical verification and produce board-ready evidence binders complying with RBI, SEBI CSCRF, CERT-In, and the DPDP Act 2023.

Request Audit Scoping & Consultation → ⚡ Quick Response SLA • Board-Ready Evidence