Surviving the CERT-In 6-Hour Clock: A Practical Incident Telemetry & Reporting Runbook
From initial IOC trigger to Ministry notification: An operational timeline, NTP synchronization setups, and 180-day immutable log vaulting.
How Indian IT and DevOps teams must structure their logging, NTP synchronization, and escalation protocols to meet statutory 6-hour disclosure mandates without operational chaos.
- The 6-hour notification clock begins from the precise moment an incident is noticed or brought to notice, not after root cause is resolved.
- All enterprise servers, cloud instances, and network appliances must synchronize with NPL-India or NIC time sources.
- System logs must be retained within the Indian jurisdiction for 180 rolling days in a tamper-proof state.
- Failing to comply with CERT-In directives carries criminal penalties under Section 70B(7) of the IT Act 2000.
- Pre-approved Annexure I reporting templates and automated telemetry triage cut reporting preparation time from 14 hours to 45 minutes.
1. What Triggers the 6-Hour Clock?
On 28th April 2022, the Indian Computer Emergency Response Team (CERT-In) issued landmark directions under Section 70B(6) of the Information Technology Act, 2000. Among these, the most operationally demanding requirement is Section 5(i): all cybersecurity incidents specified in Annexure I must be reported to CERT-In within six hours of being noticed.
Crucially, "noticed" does not mean "fully investigated". If an automated SIEM alert identifies ransomware execution, unauthorized admin access, or a massive exfiltration event at 02:00 AM, the statutory deadline to transmit the incident report to incident@cert-in.org.in is 08:00 AM.
Waiting until your engineering team discovers the initial access vector or finishes server rebuilds is a direct statutory violation punishable by imprisonment up to one year or a fine up to ₹1,00,000 under Section 70B(7).
Non-compliance with CERT-In directions is a cognizable criminal offense under Section 70B(7) of the IT Act, 2000. C-level executives and IT Directors bear direct statutory accountability.
2. The 360-Minute Tactical Timeline
Without automated playbooks, six hours evaporates rapidly during panic. Here is the operational cadence engineered by EDB Global for enterprise Security Operations Centers (SOC):
| Time Window | SOC Phase | Mandatory Operational Actions |
|---|---|---|
| T+00 to T+45 min | Detection & Freeze | Verify IOC authenticity, isolate affected VPC subnets, take non-destructive memory dumps, alert Incident Commander. |
| T+45 to T+120 min | Impact Scoping | Query centralized log vault to quantify affected assets, exfiltrated records, and affected customer accounts. |
| T+120 to T+240 min | Disclosure Assembly | Populate CERT-In Annexure I form with known facts: attack vector, impacted IP ranges, timestamps, and containment steps. |
| T+240 to T+330 min | Legal & Executive Sign-off | CISO and Legal Counsel review report draft; ensure technical facts are accurate without speculative admissions. |
| T+330 to T+360 min | Transmission & Receipt | Submit encrypted disclosure to CERT-In portal / email and archive the PGP acknowledgment token. |
3. Mandatory NTP Synchronization with NPL-India
Under Section 5(ii) of the Cyber Directives, all service providers, intermediaries, data centers, and corporate bodies must connect to the Network Time Protocol (NTP) servers of the National Physical Laboratory (NPL) or National Informatics Centre (NIC).
If your forensic investigation uses server clocks that drifted by even 800 milliseconds from official Indian Standard Time (IST), the timeline reconstruction loses evidentiary integrity in Indian courts and CERT-In audits.
# NPL-India Primary Atomic Reference Clocks
server time1.nplindia.org iburst prefer
server time2.nplindia.org iburst
# National Informatics Centre (NIC) Secondary Sync
server ntp.nic.in iburst
# Fallback stratum pools
pool in.pool.ntp.org iburst maxsources 2
# Maximum allowable offset tolerance
maxdistance 0.05
driftfile /var/lib/chrony/chrony.drift
makestep 0.1 3
rtcsync4. 180-Day Tamper-Proof Log Vaulting on AWS ap-south-1
Section 5(iii) mandates that system logs of all ICT systems must be securely maintained for a rolling duration of 180 days within the Indian jurisdiction.
To satisfy the "securely maintained" criterion, logs cannot reside on production hosts where an attacker with root privileges could execute `rm -rf /var/log` or disable logging daemons.
The architecture requires streaming daemon logs in real time via FluentBit or Vector directly to an isolated AWS S3 bucket in Mumbai (`ap-south-1`) with S3 Object Lock enabled in Compliance Mode. In this mode, no user—including the AWS root account—can overwrite or delete log objects before the 180-day retention timer expires.
- Log destination strictly residing in Indian sovereign regions (e.g. AWS ap-south-1 / Azure Central India).
- S3 Object Lock Compliance Mode active with a minimum 180-day retention lock.
- Multi-Factor Authentication (MFA) Delete enabled on IAM storage buckets.
- Audit trail enabled for IAM log-reader permissions with instant alerting on unauthorized queries.
5. Pre-Drafted CERT-In Incident Disclosure Checklist
When submitting disclosures under pressure, omissions and errors can lead to regulatory reprimands. EDB Global recommends maintaining a pre-templated disclosure artifact containing the statutory fields required by CERT-In Annexure I:
1. Identity and contact details of reporting entity and designated CISO.
2. Exact timestamp of initial incident observation (IST synchronized with NPL).
3. Impacted infrastructure: IP ranges, domain names, OS versions, and cloud providers.
4. Incident classification (e.g. unauthorized network access, ransomware infection, data breach, DDoS).
5. Remedial actions already completed (isolation, revoked credentials, patched CVEs) and ongoing actions.
6. Conducting Continuous Cyber Simulation Drills
A runbook that sits in a PDF binder is worthless when ransomware locks your primary domain controller at midnight. High-performing security teams run quarterly unannounced tabletop exercises simulating sudden zero-day disclosures.
By practicing the 360-minute response drill under simulated pressure, your engineering, executive, and communications teams identify bottlenecks before real regulators are holding the clock.
Review Your Architecture with Our Practice Leads
Have specific technical questions regarding your compliance stack, log pipelines, or automation workflows? We offer confidential technical evaluations.
Recommended Technical Briefings
Digital Personal Data Protection (DPDP) Act 2023: The 11-Section Engineering Blueprint
A comprehensive guide for Indian Data Fiduciaries: lawful consent architecture, notice in 22 languages, Data Principal rights, and avoiding the ₹250 crore penalty tier.
The Modern API Security Playbook: 6 Vulnerabilities Penetration Testers Target in Indian Fintech
A hands-on technical breakdown of high-impact logic flaws discovered during real-world penetration tests of Indian fintech APIs and payment gateways.
Bridging Security with Workflow Automation: Why Compliance as Code Outperforms Manual Audits
Eliminating the friction between security teams and product teams by embedding consent verification and PII redaction directly into automated CI/CD and CRM pipelines.