Ask any Indian CISO what keeps them awake in April and the answer is usually the same: the 6-hour rule. That rule was not created by a new statute. It was issued by a directive of the Indian Computer Emergency Response Team, dated the 28th of April, 2022, under Section 70B(6) of the Information Technology Act, 2000. Before you can operate the rule, you have to see where the power to make it came from.
Why the source matters
Section 70B is not just administrative text. It is the constitutional-level authority for the CERT-In regime, which lets the government act on a national-security-adjacent basis without the delay of a fresh Parliamentary process. Understanding the source lets a CISO predict how the regime will evolve — new advisories, new penalty ceilings, new operational obligations — all can be issued under the same statutory authority without amending the underlying Act. This is why FY 2024-25 CERT-In enforcement pattern is a better predictor of FY 2027-28 posture than reading the 2022 Directions text alone.
The statute in one paragraph
Section 70B was inserted into the IT Act in 2008. The Central Government constitutes CERT-In as the national agency for cyber incident response [L1-C1]. CERT-In has six statutory functions: it collects and analyses information on cyber incidents, issues forecasts and alerts, takes emergency measures, coordinates incident response, issues guidelines and advisories, and performs such other cyber-security functions as may be prescribed [L1-C2]. To do those things, sub-section (6) gives CERT-In the power to "call for information and give direction to the service providers, intermediaries, data centres, body corporate and any other person" [L1-C3]. Sub-section (7) attaches teeth: non-compliance is punishable with imprisonment up to one year and a fine [L1-C4].
What actually happened in April 2022
CERT-In exercised the sub-section (6) power on the 28th of April, 2022. The instrument was numbered No. 20(3)/2022-CERT-In. It carried a long title: "Directions relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet" [L1-C5]. The Directions were to become effective 60 days from the date of issue, that is the 27th of June, 2022.
Six substantive Directions were issued. Direction (i) required NTP time synchronisation to NIC or NPL. Direction (ii) imposed the 6-hour incident reporting rule. Direction (iii) gave CERT-In the right to demand information and required every entity to designate a Point of Contact. Direction (iv) imposed a 180-day log retention obligation within Indian jurisdiction. Direction (v) required a five-year customer-record regime for Data Centre, VPS, Cloud and VPN Service providers. Direction (vi) imposed a five-year KYC and transaction record obligation on virtual asset service providers. Each of these is covered in its own module later in the course.
The fine ceiling changed in 2023
When the Directions were first issued, non-compliance under Section 70B(7) attracted imprisonment up to one year and a fine which could extend to one lakh rupees. The Jan Vishwas (Amendment of Provisions) Act, 2023 (Act No. 18 of 2023) substituted the words "one crore rupees" for "one lakh rupees" in Section 70B(7) [L1-C6]. In other words, the maximum fine went up a hundredfold. The imprisonment ceiling is unchanged. This is the reason a course on the 2022 Directions is worth taking in 2026 and not in 2022. The obligations are the same. The consequences of ignoring them are not.
Note on gazette verification. Sources are unanimous that the Jan Vishwas Act 2023 was enacted and its schedules staged into commencement. Practitioners advising a client on maximum exposure should still confirm the specific commencement date for the IT Act entry against the e-gazette on the day of the advice. This is on the course's manual-verification checklist.
Nothing has superseded the 2022 Directions
Between the 28th of April, 2022 and August 2026, one extension order was issued (the 27 June 2022 extension for MSMEs and specific sub-clauses of Direction (v)) but no superseding Direction has replaced the substantive obligations. The DPDP Act 2023 and DPDP Rules 2025 created a parallel breach notification regime aimed at personal data, but they did not modify the CERT-In clock [L1-C7]. Practitioners should re-check the CERT-In "Directions70B" index page on the day they publish any advice to confirm no new instrument has been issued in the interim. This is also on the manual-verification checklist.
Why this matters
Most public commentary treats the 6-hour rule as if it were a standalone rule of the road. It is not. It is a specific direction issued under the statutory authority of Section 70B(6). If you understand the source, you can predict how the regime will evolve. When Parliament raises the Section 70B(7) fine, every existing Direction becomes correspondingly more expensive to ignore. When CERT-In issues a new Direction under sub-section (6), it will attach to the same penalty ceiling automatically.
That is what changed in 2023. Nothing about the six Directions changed. The cost of ignoring them changed. This is the pattern to watch.
Reading Section 70B alongside the broader IT Act architecture
Section 70B does not sit in isolation. The IT Act 2000 organises cyber-security responsibilities across multiple sections: Section 43A creates the "reasonable security practices" obligation on body corporates handling sensitive personal data; Section 66 creates specific cyber-offence categories; Section 69 empowers interception and monitoring; Section 69B empowers monitoring and collection of traffic data. Section 70B sits at the incident-response coordination layer. Practitioner reading: understand where Section 70B fits so you can identify when a specific incident implicates additional IT Act provisions beyond the 6-hour reporting obligation.
CERT-In's operational rhythm
CERT-In publishes advisories, vulnerability notes, and best-practice documents at cert-in.org.in on a rolling basis. Its operating budget and staffing under MeitY have grown substantially since 2020, reflecting the elevated national attention to cyber-security. As of September 2026, CERT-In runs specialised cells for banking-sector cyber, critical-infrastructure protection, and inter-country coordination. Practitioner action: bookmark the CERT-In advisories page and monitor weekly; new advisories often carry practical guidance that shapes how the 2022 Directions are read in specific contexts.
The evolving supervisory tone
Between 2022 and 2026 CERT-In's supervisory tone has shifted from initial educational-outreach to targeted enforcement. Early 2022-2023 focus was on awareness and PoC-designation compliance; 2023-2024 focus shifted to log-retention adequacy; 2024-2025 saw the first material enforcement actions on delayed reporting; 2025-2026 has emphasised Annexure I completeness (particularly cloud, blockchain, AI/ML categories). Practitioner posture: the FY 2026-27 supervisory year is expected to focus on cross-check between reported incident rates and the underlying entity's technology exposure — an entity with a large cloud footprint reporting few cloud incidents will attract inquiry.
The regulator ecosystem alongside CERT-In
CERT-In operates alongside sectoral regulators (RBI for banking, SEBI for securities, IRDAI for insurance, TRAI for telecom) and specialised bodies (NCIIPC for critical information infrastructure, DPDP Board once operational). Reporting obligations to CERT-In do not substitute for sectoral reporting obligations; they run in parallel. Practitioner design: build the unified incident-record discipline that fires all applicable clocks from a single source, rather than treating each regulator separately.