Mandatory Rule

MANDATORY CERT-IN COMPLIANCE & 6-HOUR INCIDENT REPORTING

Implement statutory Indian cybersecurity architecture: 180-day tamper-evident system logs, NPL-India NTP synchronization, and rapid incident response runbooks.

The CERT-In Cyber Directives of April 2022 enforce strict operational requirements on all companies operating in India. Non-compliance invites penal sanctions under Section 70B(7) of the IT Act. EDB Global establishes the precise telemetry pipelines, cloud logging architectures, and 6-hour incident disclosure runbooks your organization requires.

Statutory Reference:Section 70B(7) · Information Technology Act 2000 & CERT-In 2022 Directives

Book CERT-In Architecture Review Explore Scope & Deliverables

Operational & Strategic Challenge

The Operational Reality of the CERT-In Directives

Many companies assume standard AWS CloudWatch or application logs satisfy Indian law. In reality, CERT-In mandates strict forensic properties: cryptographic tamper evidence, domestic storage, and 6-hour disclosure windows upon incident detection.

The 6-Hour Reporting SLAFrom the moment a cyber incident or ransomware outbreak is noticed, your enterprise has exactly 6 hours to notify CERT-In via prescribed formats.

180-Day Immutable Log Retention in IndiaLogs across firewalls, user logins, DNS queries, and API gateways must be preserved within the Indian jurisdiction for a minimum of 180 rolling days.

Mandatory NTP Synchronization with NPL-IndiaSystem clocks across servers, databases, and microservices must synchronize with the National Physical Laboratory (NPL) or NIC time servers.

Technical Deliverables

CERT-In Architecture Deliverables

180-Day Immutable Log Vault

Logging

Automated centralized log shipping with write-once-read-many (WORM) storage, AES-256 encryption, and domestic residency on AWS ap-south-1.

Production verified

NTP Synchronization Infrastructure

Time Sync

Configuration of NTP daemons across Linux/Windows hosts locked to NPL-India atomic clock sources with drift telemetry.

Production verified

6-Hour Incident Reporting Runbook

Runbooks

Pre-drafted, statutory CERT-In disclosure templates, communication escalation ladders, and C-suite decision trees.

Production verified

Forensic Preservation Framework

Forensics

Chain-of-custody protocols, memory dump playbooks, and evidence isolation scripts for post-incident investigations.

Production verified

Implementation Lifecycle

Our Engineering Execution Roadmap

Telemetry Gap Analysis

Audit current logging pipelines across cloud, SaaS, and network perimeter against CERT-In mandate.

Immutable Architecture Rollout

Deploy encrypted log shipping, domestic Indian S3 storage with Object Lock, and NPL-NTP sync.

SLA Drill & Tabletop Simulation

Run a mock breach drill testing the 6-hour disclosure pipeline with internal stakeholders.

Frequently Asked Questions

Practice Inquiries & Technical Details

It applies universally to all service providers, intermediaries, data centers, body corporates, and enterprises operating in India.

Verify Your CERT-In Readiness Before an Incident Occurs

Deploy our automated 180-day compliance logging scripts and 6-hour disclosure playbooks in under 7 business days.

Book CERT-In Architecture Review Direct Contact & NDA

Direct access to senior practice engineers · 100% Indian regulatory compliance guarantee