India cyber rules, CERT-In, RBI and SEBI in plain English
Understand incident reporting and security requirements that apply in India.
Official sources
Use these official places to read the text and find the latest version.
Official website
CERT-In publishes directions on incident reporting. Sector regulators publish their own rules.
Visit cert-in.org.in ↗Get the document
Directions are published free by each regulator, including CERT-In, the RBI and SEBI.
Open the official page ↗What India cyber rules is
India has several overlapping security rules. CERT-In directions require many organisations to report cyber incidents quickly. Financial regulators such as the RBI and SEBI add their own security frameworks.
Which rules apply depends on your sector and activities.
How India cyber rules got to where it is today
The milestones that changed what organisations have to do.
IT Act
India’s Information Technology Act becomes law.
CERT-In directions
CERT-In issues directions on 28 April 2022 requiring reporting within six hours and log retention for 180 days.
DPDP Act
Data protection law passed. See the DPDP page.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You operate in India.
You are a bank, NBFC, broker or fintech.
You host or manage IT systems in India.
You need to report incidents.
What it asks of you
The requirements fall into six areas.
Incident reporting
Report within the set time.
Log retention
Keep logs for the required period.
Sector rules
RBI and SEBI frameworks.
Vendor oversight
Manage outsourced IT risk.
Governance
Board and CISO responsibilities.
Audits and testing
Periodic reviews and testing.
2 parts, 6 topics and 15 obligations
India's CERT-In Directions require fast incident reporting, long log retention and clock synchronisation, and sit under the IT Act, which also creates compensation liability for poor security.
6 topics · 15 obligations
CDCERT-In Directions of 28 April 2022 (section 70B(6))Duties on service providers, intermediaries, data centres, body corporates and government organisations.4 topics · 9 obligations
D1Incident reportingReport listed cyber incidents quickly to CERT-In.4 obligations
- Direction (ii)
Report listed cyber security incidents to CERT-In within 6 hours of noticing them or being told about them.
What you do
- Add a 6 hour reporting step to the incident runbook
- Report by email to incident@cert-in.org.in or the listed channels
- Annexure I
Treat the listed incident types as reportable, such as targeted scanning, system compromise, unauthorised access, data breach and leak, ransomware-type attacks, DDoS and attacks on IoT or AI systems.
What you do
- Map your incident categories to the Annexure list
- Train the SOC on triage
- Direction (ii) (details)
Give the information CERT-In asks for when reporting and further information on request.
What you do
- Pre-build a report template
- Keep logs ready for submission
- Direction (vii)
Provide information and assistance to CERT-In when it asks for it for investigation or protective action.
What you do
- Name a responder for CERT-In queries
- Keep evidence handling procedures
Evidence to keep
- Incident register with timestamps
- CERT-In report copies
- Annexure I mapping
D2Point of contact and time synchronisationName a contact and keep clocks aligned.2 obligations
- Direction (iii)
Designate a point of contact and give CERT-In their name and contact details, and update on change.
What you do
- Choose a role-based mailbox and phone
- Keep it current
- Direction (i)
Synchronise all ICT system clocks to the NTP servers of NIC or NPL, or to servers traceable to them.
What you do
- Point NTP at NIC or NPL servers
- Audit drift quarterly
Evidence to keep
- Point of contact notification
- NTP configuration evidence
D3Log retentionKeep logs available for investigation.1 obligation
- Direction (iv)
Enable logs of all ICT systems and keep them securely for 180 days rolling within Indian jurisdiction, or produce them to CERT-In when asked.
What you do
- Set 180 day retention on SIEM and cloud logs
- Store logs in India or be able to provide them
Evidence to keep
- Log retention configuration
- Storage location evidence
D4Subscriber and customer records for specific providersExtra record-keeping for data centres, VPS, cloud and VPN providers, and virtual asset firms.2 obligations
- Direction (v)
Data centres, VPS providers, cloud service providers and VPN service providers must keep accurate validated subscriber details, such as names, addresses, IPs, usage periods and purpose, for 5 years or longer after cancellation.
What you do
- Capture verified records at onboarding
- Retain for 5 years minimum
- Direction (vi)
Virtual asset service providers, exchanges and custodian wallet providers must keep KYC and transaction records for 5 years.
What you do
- Maintain KYC files
- Retain transaction logs
Evidence to keep
- Subscriber record database
- KYC records
ITAInformation Technology Act, 2000: key sectionsStatutory powers and liabilities underlying the Directions.2 topics · 6 obligations
T1CERT-In powers and penalties (s. 70B)The statutory basis of the Directions.2 obligations
- s.70B(4) and (6)
Understand CERT-In is the national agency for incident response and may call for information and give directions to service providers, intermediaries, data centres and body corporates.
What you do
- List the Directions in your legal register
- Assign an owner
- s.70B(7)
Know that failing to give information or comply with CERT-In directions is punishable with imprisonment up to one year, a fine up to INR 1 lakh, or both.
What you do
- Brief leadership on the exposure
- Link to the incident process
Evidence to keep
- Legal register entry
T2Compensation for data protection failures (ss. 43, 43A)Civil liability for damage and for failing to protect sensitive data.4 obligations
- s.43
Be aware that unauthorised access, data extraction, introducing malware and similar acts attract compensation liability.
What you do
- Maintain access controls and monitoring
- Train staff on prohibited acts
- s.43A
A body corporate handling sensitive personal data must maintain reasonable security practices or compensate the person for wrongful loss caused by negligence.
What you do
- Adopt a documented security programme
- Align with an accepted standard
- SPDI Rules 2011, Rule 8
Reasonable practices can be shown by a comprehensive documented information security programme such as one based on ISO/IEC 27001, with audits.
What you do
- Certify or align to ISO 27001
- Audit annually
- SPDI Rules 2011, Rules 4-5
Publish a privacy policy, get written consent for collecting sensitive data and name a grievance officer.
What you do
- Publish the policy and officer details
- Record consents
Evidence to keep
- Reasonable security practices evidence
- Privacy policy
Nothing matches. Clear the search or pick another part.
Outcomes and implementation examples are from CERT-In: Directions under section 70B(6) of the IT Act, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Find your regulators
By sector.
- 2
List obligations
One register.
- 3
Assess gaps
And prioritise.
- 4
Set reporting process
Roles and timers.
- 5
Review
As rules change.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Incident reporting | Incident workflow with timers |
| Log retention | Log retention records |
| Sector rules | Obligations register |
| Vendor oversight | Vendor register |
| Governance | Governance records |
| Audits and testing | Test records |
Free India cyber rules readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Obligations register
- Incident reporting template
- Log retention checklist
- Vendor oversight form
Share or cite this page
Writing about India cyber rules? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/india-cyber-rules/">India cyber rules explained in plain English - Optimus CyberX</a>Common questions
Which rules apply to us?
It depends on your sector and activities. CERT-In directions cover service providers, intermediaries, data centres and companies. Use the scope check.
Is there a certificate?
No. These are legal directions, not a certification. You show compliance through reporting incidents on time and keeping the required logs.
How does it relate to ISO 27001?
ISO 27001 helps you cover many of the technical duties, but sector regulators and CERT-In have their own specific requirements.
Do the rules change?
Yes. Regulators issue new directions and circulars from time to time, so check each regulator’s site for the latest.
Related frameworks
See how ready you are for India cyber rules
Answer questions across every area. We email you a report showing where you comply and where you do not.