CERT-In Empanelled VAPT & Mandatory 6-Hour Reporting: Complete Compliance Guide
Authoritative compliance manual dissecting CERT-In Cyber Security Directions (Section 70B(6) IT Act 2000). Covers the 20 reportable cyber incident categories, the mandatory 6-hour incident disclosure window, Annexure-1 reporting formats, 180-day NTP-synchronized log retention within Indian jurisdiction, and what makes a VAPT report legally defensible under Indian law.
Interactive Technical Checklist (4 Verification Checkpoints)
-
[Incident Readiness] Designate primary and secondary CERT-In Point of Contact (PoC) with 24x7 phone reachability.Mandate: Sec 70B Compliance
-
[Log Infrastructure] Configure NTP synchronization to National Physical Laboratory (NPL) or NIC time servers across all infrastructure.Mandate: NTP Mandate
-
[Log Archival] Archive all firewall, DNS, IAM, and web proxy logs for 180 days in immutable WORM storage within India.Mandate: 180-Day Log Rule
-
[Audit Attestation] Conduct bi-annual VAPT by qualified ethical penetration testers and maintain clean closure certificates.Mandate: VAPT Mandate
Issued by the Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology (MeitY), the 2022 Directions represent mandatory statutory law in India. Non-compliance is a punishable offence under Section 70B(7) of the IT Act, carrying financial penalties and up to 1 year imprisonment for corporate officers.
1. The Mandatory 6-Hour Reporting Window
Under Direction 2(i), any service provider, intermediary, data center, body corporate, or government organization must report cyber security incidents to CERT-In within 6 hours of noticing such incidents or being brought to notice about them.
2. The 20 Mandatory Reportable Incident Categories
3. 180-Day Immutable Sovereign Log Retention Requirement
Direction 2(v) mandates that all system logs across all ICT systems (firewalls, routers, domain controllers, cloud IAM, databases) must be securely maintained for a rolling period of 180 days within Indian jurisdiction. Furthermore, all system clocks must be synchronized with NTP servers of the National Physical Laboratory (NPL) or National Informatics Centre (NIC).
Need Accredited Auditors to Execute This Audit or Gap Assessment?
BlueCiphr's certified lead auditors (CEH Master, PenTest+, ISO 27001 Lead Auditors) conduct deep technical verification and produce board-ready evidence binders complying with RBI, SEBI CSCRF, CERT-In, and the DPDP Act 2023.