CERT-In Rules as Engineering Tasks: Logs, Clocks and a 6-Hour Clock

If you run infrastructure for an Indian organisation, some compliance rules land directly on your desk. A security vendor's global package may not cover them by default, so it helps to translate them into concrete engineering work.

What the CERT-In Directions (April 2022) ask for

• Report cyber incidents to CERT-In within 6 hours of noticing them
• Keep ICT system logs for 180 days, stored within India
• Synchronise system clocks
• Name a point of contact for CERT-In

Turning that into tasks

• Logs: list every system that produces security-relevant logs, confirm where they are stored, and check retention is at least 180 days in an Indian location. If you use a SIEM or a managed SOC, ask the provider exactly where data lives.
• Clocks: make sure servers, network devices and cloud services sync to a common time source, so timelines line up during an investigation.
• Reporting: write down who decides an incident is reportable and who files the report. Then rehearse it in a yearly tabletop exercise.
• Audits: CERT-In's July 2025 audit guidelines call for annual audits by empanelled auditors, plus extra audits after major changes. Plan these into release schedules.

Other rules that may stack on top

• DPDP Act 2023 and DPDP Rules 2025 (reasonable safeguards, breach intimation; main duties from May 2027)
• RBI IT Governance Master Direction, SEBI CSCRF or IRDAI guidelines for regulated entities

A practical order of work: list the rules that apply, map each obligation to a control, audit what exists, and fix the gaps with legal deadlines first. This is not legal advice, so confirm the scope with your adviser.

More detail: mapping Indian cyber security obligations to services

Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.