CERT-In Directions of 28 April 2022 under Section 70B(6) of the IT Act

Every service provider and intermediary in the sense of the IT Act, including platforms that host or transmit content and data for users. Edtech platforms, LMS and online-exam providers fall here.

Any data centre, including an on-campus server room that hosts services for others. Data centres also carry the 5-year subscriber-record duty described below.

A "body corporate" is any company, and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities (CERT-In FAQ 25, citing Section 43A of the IT Act). Private universities and school groups run by companies are covered. CERT-In's FAQ states the Directions are applicable to any entity whatsoever in the matter of cyber incidents, so we advise trust- and society-run institutions to comply in full. The position of a trust or society that is not a company has not been confirmed by counsel on this page.

Ministries, departments and government organisations, which in practice includes central and state universities, state boards and government-run colleges and schools.

Data centres, Virtual Private Server providers, cloud service providers and VPN service providers must also keep validated subscriber records for 5 years. CERT-In's FAQ clarifies that "VPN service provider" means a provider of internet proxy-like VPN services to the public, not an institution's own enterprise VPN.

The Directions reach any entity, Indian or foreign, in the matter of cyber incidents affecting India (FAQ 26). Foreign SaaS used by Indian campuses is expected to maintain logs in Indian jurisdiction (FAQ 36). Individual citizens are not covered (FAQ 7).

Report any of the 20 incident types in Annexure I within 6 hours of noticing the incident or of it being brought to your notice. They include targeted scanning of critical systems, compromise of critical systems, unauthorised access to IT systems or data, website defacement, malware and ransomware, attacks on servers and network devices, identity theft and phishing, DoS and DDoS, attacks on applications, data breaches and data leaks, attacks on cloud systems and on AI/ML systems. Report by email to incident@cert-in.org.in, phone 1800-11-4949 or fax 1800-11-6969, using the CERT-In reporting format.

If the full reporting form cannot be completed within 6 hours, report the information available and send the rest later within a reasonable time (FAQ 30). Where an incident hits a vendor's systems but your data, whoever notices it must report; the duty cannot be transferred or contracted away (FAQ 13).

Enable logs on all ICT systems and keep them securely for a rolling 180 days within Indian jurisdiction, to be produced with any incident report or on CERT-In's direction. Examples in the FAQ: firewall, IPS, SIEM, web, database, mail, proxy, VPN, SSH, application and critical-system event logs. CERT-In's FAQ says copies may also be stored abroad as long as logs can be produced to CERT-In in reasonable time.

Connect all ICT systems to the NTP servers of the National Informatics Centre (NIC) or National Physical Laboratory (NPL), or to NTP servers traceable to them. Multi-region infrastructure may use another accurate source that does not deviate from NIC and NPL. Record the time zone with each timestamp.

Name a Point of Contact to interface with CERT-In and send their details (name, designation, organisation, address, email, mobile, office phone and fax) in the Annexure II format to info@cert-in.org.in. Keep it updated; all CERT-In directions will be sent to this person.

When CERT-In orders it, take action or provide information or assistance within the format and timeframe specified, which may be up to near real-time. Missing the timeframe is treated as non-compliance.

Register and keep, for 5 years or longer after a subscription ends, validated customer names, period of hire, IPs allotted, the email, IP and timestamp used at registration, the purpose of hiring, validated address and contact numbers, and the ownership pattern of the customer.

CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (Version 1.0, 25 July 2025) state that auditee organisations are expected to ensure a comprehensive audit covering all aspects of their ICT systems at least once a year, carried out under the guidelines by CERT-In empanelled auditing organisations. How far these guidelines bind an institution that is not otherwise required by a regulator to commission such an audit has not been confirmed by counsel on this page.

A detection-to-report workflow with pre-filled CERT-In reporting forms, an on-call rota and decision rules for which events count as Annexure I incidents. We run tabletop drills each term so the first real report is not the first attempt.

Central log collection from firewalls, servers, LMS, ERP, mail and VPN into tamper-evident storage in India, retained for a full year so it also covers the DPDP Rules, and searchable when CERT-In asks.

We map every ICT asset on campus and in the cloud, point each one at NIC or NPL-traceable NTP, and keep the inventory current, because you cannot log or report on systems you do not know you have.

CIO-as-a-service support to name and register your Point of Contact, draft the incident response policy for your governing body, and fold CERT-In duties into vendor contracts so suppliers alert you in time for the 6-hour clock.

Bit2Bit is not a CERT-In empanelled auditor. We prepare your institution for audit and coordinate the comprehensive audit with a CERT-In empanelled auditing organisation of your choice, then track the remediation through to closure. An empanelled audit partner is not named on this page.

Immutable, 3-2-1 backups and recovery drills, so an attack becomes a reporting duty and a restore, not a lost semester.