Why you can trust this course

Types of cyber security incidents mandatorily to be reported by service providers, intermediaries, data centres, body corporate and Government organisations to CERT-In: i. Targeted scanning/probing of critical networks/systems ii. Compromise of critical systems/information iii. Unauthorised access of IT systems/data iv. Defacement of website or intrusion into a website and unauthorised changes such as inserting malicious code, links to external websites etc. v. Malicious code attacks such as spreading of Virus/Worm/Trojan/Bots/Spyware/Ransomware/Cryptominers vi. Attack on servers such as Database, Mail and DNS and network devices such as Routers vii. Identity Theft, spoofing and phishing attacks viii. Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks ix. Attacks on Critical infrastructure, SCADA and operational technology systems and Wireless networks x. Attacks on Application such as E-Governance, E-Commerce etc. xi. Data Breach xii. Data Leak xiii. Attacks on Internet of Things (IoT) devices and associated systems, networks, software, servers xiv. Attacks or incident affecting Digital Payment systems xv. Attacks through Malicious mobile Apps xvi. Fake mobile Apps xvii. Unauthorised access to social media accounts xviii. Attacks or malicious/suspicious activities affecting Cloud computing systems/servers/software/applications xix. Attacks or malicious/suspicious activities affecting systems/servers/networks/software/applications related to Big Data, Block chain, virtual assets, virtual asset exchanges, custodian wallets, Robotics, 3D and 4D Printing, additive manufacturing, Drones xx. Attacks or malicious/suspicious activities affecting systems/servers/software/applications related to Artificial Intelligence and Machine Learning

All service providers, intermediaries, data centres, body corporate and Government organisations shall connect to the Network Time Protocol (NTP) Server of National Informatics Centre (NIC) or National Physical Laboratory (NPL) or with NTP servers traceable to these NTP servers, for synchronisation of all their ICT systems clocks. Entities having ICT infrastructure spanning multiple geographies may also use accurate and standard time source other than NPL and NIC, however it is to be ensured that their time source shall not deviate from NPL and NIC.

Any service provider, intermediary, data centre, body corporate and Government organisation shall mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents or being brought to notice about such incidents.

When required by order/direction of CERT-In, for the purposes of cyber incident response, protective and preventive actions related to cyber incidents, the service provider/intermediary/data centre/body corporate is mandated to take action or provide information or any such assistance to CERT-In, which may contribute towards cyber security mitigation actions and enhanced cyber security situational awareness. The order/direction may include the format of the information that is required (up to and including near real-time), and a specified timeframe. Compliance to such orders/directions is mandatory for the mentioned entities. The entities shall designate a Point of Contact to interface with CERT-In. The information relating to a Point of Contact shall be sent to CERT-In in the format specified at Annexure II and shall be updated from time to time. All communications from CERT-In seeking information and providing directions for compliance shall be sent to the said Point of Contact.

All service providers, intermediaries, data centres, body corporate and Government organisations shall mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days and the same shall be maintained within the Indian jurisdiction. These should be provided to CERT-In along with reporting of any incident or when ordered / directed by CERT-In.

Data Centres, Virtual Private Server (VPS) providers, Cloud Service providers and Virtual Private Network Service (VPN Service) providers, shall be required to register the following accurate information which must be maintained by them for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration as the case may be:, (a) Validated names of subscribers/customers hiring the services; (b) Period of hire including dates; (c) IPs allotted to / being used by the members; (d) Email address and IP address and time stamp used at the time of registration / on-boarding; (e) Purpose for hiring services; (f) Validated address and contact numbers; (g) Ownership pattern of the subscribers / customers hiring services.

The virtual asset service providers, virtual asset exchange providers and custodian wallet providers (as defined by Ministry of Finance from time to time) shall mandatorily maintain all information obtained as part of Know Your Customer (KYC) and records of financial transactions for a period of five years so as to ensure cyber security in the area of payments and financial markets for citizens while protecting their data, fundamental rights and economic freedom in view of the growth of virtual assets. For the purpose of KYC, the Reserve Bank of India (RBI) directed / regulated KYC norms for entities regulated by RBI, SEBI directed / regulated KYC norms for entities regulated by SEBI, and Department of Telecommunication (DoT) approved / regulated KYC norms for entities registered with DoT, may be considered. In any other case, the norms specified in Annexure III shall be considered. With respect to transaction records, accurate information shall be maintained in such a way that individual transaction can be reconstructed along with the relevant elements comprising of, but not limited to, information relating to the identification of the relevant parties including IP addresses along with timestamps and time zones, transaction ID, the public keys (or equivalent identifiers), addresses or accounts involved (or equivalent identifiers), the nature and date of the transaction, and the amount transferred.

No. 20(3)/2022-CERT-In dated the 28th April, 2022. Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet. These directions shall be effective after 60 days from the date on which they are issued.

The Directions dated 28.04.2022 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet shall become effective from 25th September, 2022 in respect of, (i) Micro, Small and Medium Enterprises (MSMEs), as classified in the notification of the Government of India in the Ministry of Micro, Small and Medium Enterprises S.O. 1702(E) dated 01.06.2020; and (ii) validation of subscriber/customer details required in point (v) sub-para (a) and sub-para (f) of the Annexure to the Directions, applicable to Data Centres, VPS, Cloud Service providers and VPN Service providers.

Intermediaries covered under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 are already required to report cyber security incidents. They are expected to consider nature, severity and impact of the incident while reporting cyber security incidents to CERT-In.

The reporting obligation of any entity on noticing a cyber incident applies to that entity itself and is not transferable to any other entity by way of a contract. Every entity that has noticed a cyber incident is obligated to report it, irrespective of the fact that some other entity has also reported the same incident. This is because the obligation is a statutory obligation of every entity that notices an incident.

Section 81 of Information Technology Act, 2000 states that the provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in any other law for the time being in force. Therefore, non-disclosure agreements shall not override the reporting obligation under these Directions.

The time period of 6 hours for reporting cyber incidents to CERT-In shall be reckoned from the time of noticing the cyber incident or being brought to notice about such incidents.

The term "body corporate" has been defined in explanation (i) to sub-section (1) of section 43A of the Information Technology Act, 2000 as "any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities". The same definition applies for the Directions.

The Directions apply to all service providers, intermediaries, data centres, body corporates and Government organisations that provide services or operate in India, regardless of the jurisdiction of registration. Foreign entities that serve users in India are expected to designate a Point of Contact and comply with reporting.

Cyber security incident, in relation to cyber security, means any real or suspected adverse event that is likely to cause or causes an offence or contravention, harm to critical functions and services across the public and private sectors by impairing the confidentiality, integrity, or availability of electronic information, systems, services or networks resulting in unauthorized access, denial of service or disruption, unauthorized use of a computer resource for processing or storage of information or changes to data, information without authorization.

In case complete information is not available at the time of reporting a cyber incident, the entities may provide information to the extent available at the time of reporting. Additional information about the cyber incident may be reported to CERT-In in due course as and when it becomes available.

The Directions are meant for VPN Service providers who provide Internet proxy-like services through the use of VPN technologies, standard or proprietary, to general internet subscribers/users. The Directions do not apply to enterprise or corporate VPNs.

The logs may be stored outside India also as long as the obligation to produce logs to CERT-In is adhered to by the entities in a reasonable time.

Logs to be maintained include, but are not limited to, Firewall logs, Intrusion Prevention Systems logs, SIEM logs, web/database/mail/FTP/proxy server logs, event logs of critical systems, application logs, ATM switch logs, SSH logs, VPN logs. Both successful as well as unsuccessful events shall be recorded.

The logs are to be provided to CERT-In only when directed by an officer of CERT-In not below the rank of Deputy Secretary or equivalent.

These Directions cover service providers, intermediaries, data centres, body corporates and Government organisations, which includes both service providers and their users as legal entities except individual citizens.

"personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.

Schedule (Section 33): Item 1 (Section 8(5) reasonable security safeguards): may extend to two hundred and fifty crore rupees. Item 2 (Section 8(6) breach intimation to Board and affected Data Principals): may extend to two hundred crore rupees. Item 3 (Section 9 additional obligations for children's personal data): may extend to two hundred crore rupees. Item 4 (Section 10 additional obligations for Significant Data Fiduciary): may extend to one hundred and fifty crore rupees. Item 5 (Section 15 duties of Data Principal): may extend to ten thousand rupees. Item 6 (breach of any term of voluntary undertaking accepted by Board under Section 32): may extend to the extent applicable for the relevant Item. Item 7 (any other breach of the provisions of this Act or rules): may extend to fifty crore rupees.

DPDP Rules 2025 Rule 7. On becoming aware of any personal data breach, the Data Fiduciary shall intimate each affected Data Principal in a concise, clear and plain manner and without delay; and shall intimate the Data Protection Board without delay of the initial description, followed by an updated and detailed report within seventy-two hours of becoming aware (extendable on written request to the Board).

Cyber incidents shall be reported to CERT-In within 6 hours of noticing/detecting the same in accordance with the CERT-In Directions dated 28 April 2022. A copy of every such report shall be furnished to the Authority.

70B. (1) The Central Government shall, by notification in the Official Gazette, appoint an agency of the Government to be called the Indian Computer Emergency Response Team.

70B. (4) The Indian Computer Emergency Response Team shall serve as the national agency for performing the following functions in the area of cyber security,, (a) collection, analysis and dissemination of information on cyber incidents; (b) forecast and alerts of cyber security incidents; (c) emergency measures for handling cyber security incidents; (d) coordination of cyber incidents response activities; (e) issue guidelines, advisories, vulnerability notes and whitepapers relating to information security practices, procedures, prevention, response and reporting of cyber incidents; (f) such other functions relating to cyber security as may be prescribed.

70B. (6) For carrying out the provisions of sub-section (4), the agency referred to in sub-section (1) may call for information and give direction to the service providers, intermediaries, data centres, body corporate and any other person.

70B. (7) Any service provider, intermediaries, data centres, body corporate or person who fails to provide the information called for or comply with the direction under sub-section (6), shall be punishable with imprisonment for a term which may extend to one year or with fine which may extend to one crore rupees or with both.

In section 70B of the Information Technology Act, 2000, in sub-section (7), for the words "one lakh rupees", the words "one crore rupees" shall be substituted.

Regulated entities shall have in place a Board approved Incident Response and Recovery Plan and shall proactively notify unusual cyber security incidents to the CERT-In and to the Reserve Bank of India as per the regulatory requirements. Detailed root cause analysis and remediation report shall be submitted to the Reserve Bank of India as per the timelines specified by the Reserve Bank of India.

Cyber Incident Reporting: All SEBI Regulated Entities shall report cyber security incidents to SEBI within six hours of detection, aligned with the reporting timeline under the CERT-In Directions dated 28 April 2022. Reporting shall be via the SEBI Incident Reporting portal. A separate report shall be filed with CERT-In in the format prescribed by CERT-In. Detection of an incident, not confirmation, starts the six-hour clock.

A telecommunication entity shall report every cyber security incident affecting its telecommunication network or telecommunication service to the Central Government within six hours of becoming aware of it, followed by such other details as may be sought, within twenty-four hours of the report.