CERT-In Compliance Guide for Indian Enterprises

The CERT-In directions (issued under Section 70B(6) of the IT Act, 2000) impose four primary obligations on covered entities: (1) mandatory reporting of 20 categories of cyber incidents to CERT-In within 6 hours of becoming aware, (2) ICT infrastructure log retention for 180 days within India, (3) synchronisation of all ICT system clocks with the Indian Standard Time (IST) server of the NIC, and (4) designation of a Point of Contact for CERT-In coordination.

The 6-hour reporting window is the most operationally demanding requirement. It means the detection-to-triage-to-escalation pipeline must complete in under 3 hours for a confirmed incident, leaving 3 hours for report preparation and submission. Without automated triage, this window is extremely difficult to meet consistently.

The 20 categories include targeted scanning, compromise of critical systems, unauthorised access, defacement, malware propagation, attacks on internet applications, data breach, data leak, attacks on critical infrastructure, attacks on IoT devices, attacks on financial systems, social engineering campaigns, and ransomware. Each category maps to one or more MITRE ATT&CK techniques that ManySignal's detection catalogue covers.

Map each of the 20 categories to the ManySignal detections that would surface it: ransomware maps to T1486 (Data Encrypted for Impact); unauthorised access maps to T1078 (Valid Accounts) and T1110 (Brute Force); data breach maps to T1567 (Exfiltration Over Web Service) and T1048. This mapping document is required evidence for CERT-In compliance.

Meeting the 6-hour reporting SLA requires: detection (under 5 minutes with ManySignal's streaming detections), triage and confirmation (under 30 minutes with agentic triage), human confirmation and escalation (under 30 minutes with approve-gated workflow), and report preparation (under 60 minutes with the investigate agent's preliminary report). Total: under 2 hours for a confirmed incident, leaving 4 hours of buffer.

Document the SLA explicitly in the Incident Response Procedure. Practice it in tabletop exercises using scenarios from the 20 CERT-In categories. The CERT-In directions do not provide relief for technical failures — the obligation runs from the moment the entity 'becomes aware', which includes constructive awareness from monitoring systems.

CERT-In requires logs to be retained for 180 days and stored within India. ManySignal's data residency configuration supports India-region storage. Confirm with your account team that the India data residency option is active before onboarding log sources. The 180-day retention must be for all ICT infrastructure — not just security-relevant systems.

The directions also prohibit VPNs that do not retain logs for 180 days or that allow anonymous use. If your organisation provides VPN services, ensure the VPN log source is connected to ManySignal and retained appropriately.

When ManySignal creates a case that matches a CERT-In reportable category, the case is automatically tagged with the CERT-In category label and escalated to the designated Point of Contact. The investigate agent generates a preliminary incident report in the CERT-In reporting format — incident type, time of detection, systems affected, nature of information involved, and remediation steps taken.

The final CERT-In report is submitted via the CERT-In portal. The ManySignal case timeline export serves as the supporting evidence package. Retain the submission confirmation and the case export together for 180 days as evidence of timely reporting.