Unified Startup Enablement & Growth Platform

CERT-In Compliance — Cybersecurity Directions 2022

The Indian Computer Emergency Response Team (CERT-In) issued mandatory Cybersecurity Directions on 28 April 2022 under Section 70B of the IT Act, 2000. These Directions apply to all companies, intermediaries, data centres, government entities, and VPN/VPS/cloud providers operating in India — with no minimum size threshold.

Non-compliance can result in imprisonment up to one year and fines. Corpfy implements end-to-end CERT-In compliance: NTP synchronisation, 180-day IST log retention, 6-hour mandatory breach reporting, annual VAPT, App Check, and incident response procedures.

Authority: CERT-In, Ministry of Electronics and IT (MeitY)
Effective: 28 June 2022 (Directions dated 28 April 2022)
Breach reporting SLA: 6 hours from detection to incidents@cert-in.org.in
Log retention: 180 days in Indian Standard Time (IST) timezone
Penalty: Up to 1 year imprisonment + fine under S.70B(7) IT Act

⏱️

6-Hour Mandatory Reporting Clock

From the moment a cybersecurity incident is detected — breach, ransomware, data leak, unauthorised access, DDoS — you have exactly 6 hours to notify CERT-In at incidents@cert-in.org.in. Most startups miss this because they lack detection infrastructure. Corpfy installs it.

Mandatory Applicability

Covered Entities

All entities operating in India — no revenue or headcount exemption

Entity Type	Examples	Key Obligations
Service providers	SaaS, PaaS, APIs, B2B platforms	All 9 Directions including VAPT, log retention, NTP, IR reporting
Intermediaries	Marketplaces, payment aggregators, social apps	All Directions + enhanced incident categorisation
Data centres & cloud	Managed hosting, colocation, cloud-native apps	Log retention, NTP, breach notification, subscriber KYC
VPN/VPS providers	Corporate VPNs, remote-access tools	5-year subscriber KYC data retention + breach reporting
Crypto exchanges & fintech	WazirX-type platforms, payment gateways	All Directions + RBI/SEBI layered obligations
Government entities	PSUs, e-governance portals	Same as above; CERT-In has direct escalation powers

The 9 CERT-In Directions — Corpfy's Implementation

NTP Synchronisation

All systems must sync time with NPA servers samay.nic.in or time.nplindia.org. Corpfy configures chrony/ntpd on every server and container, validated on CI.

180-Day Log Retention (IST)

All ICT system logs retained for 180 days in IST. Corpfy provisions GCP Cloud Logging sinks or AWS CloudWatch with 180-day lifecycle, mandatory IST timezone stamping.

6-Hour Breach Reporting

20 incident types (ransomware, data breach, DDoS, unauthorised access…) must be reported within 6 hours. Corpfy installs detection alerts and pre-filled CERT-In notification templates.

Annual VAPT

Vulnerability Assessment and Penetration Testing annually, plus after significant changes. Corpfy coordinates CERT-In empanelled agencies, tracks findings, and verifies remediation.

Nodal / CISO Officer

Designated point of contact for CERT-In communications. Corpfy helps draft the designation letter, role charter, and escalation chain.

MFA on Critical Systems

Multi-factor authentication mandated for admin and privileged access. Corpfy implements Entra ID / Google Workspace / Firebase App Check MFA across your tech stack.

Subscriber KYC Retention

VPN/VPS providers must retain subscriber names, IPs, usage patterns for 5 years. Corpfy implements encrypted KYC data stores with access controls and legal-hold flags.

Incident Response Plan

Documented IRP covering detection, containment, evidence collection, CERT-In notification, and post-incident review. Corpfy delivers a tailored IRP playbook and runs your first drill.

App Check & Firestore Security

Firebase App Check (reCAPTCHA Enterprise) enforced on all public endpoints. Firestore security rules validated against CERT-In access-control requirements.

Implementation Roadmap

WEEK 1

Discovery

Asset inventory, current log posture, NTP config audit, existing IRP review.

WEEK 2–3

Infrastructure

NTP sync, 180-day log retention, IST timestamps, MFA rollout on admin systems.

WEEK 4

Detection & IRP

Alert pipelines for 20 incident types; CERT-In notification templates; IRP document.

WEEK 5–6

VAPT

Coordinate empanelled agency, provide asset list, track findings, verify remediation.

WEEK 7

Drill & Certify

Tabletop breach drill, CERT-In submission test, issue compliance attestation.

20 Reportable Incident Categories

Incident Types Requiring 6-Hour Reporting

CERT-In Directions Clause 3(i) — all must be reported to incidents@cert-in.org.in within 6 hours of detection

#	Incident Type	Corpfy Detection Coverage
1	Targeted scanning / probing of critical networks	Cloud Armor / WAF anomaly alert
2	Compromise of critical systems / information	SIEM correlation rule
3	Unauthorised access to IT systems/data	Firestore audit log alert + SIEM
4	Defacement of website / intrusion	Uptime + integrity monitor
5	Malicious code attacks (ransomware, malware)	EDR + Cloud Security Command Centre
6	Attack on servers & network equipment	Network flow anomaly alert
7	Identity theft, spoofing, phishing	Email gateway + phishing feed
8	Denial of service (DoS/DDoS)	Cloud Armor rate limit + GCP DDoS alert
9	Data breach / personal data leak	DLP + Firestore exfil alert
10	Attacks on Internet of Things (IoT)	Asset discovery + anomaly detection
11–20	BGP hijack, DNS poisoning, supply chain attacks, OT/SCADA attacks, crypto-mining misuse, GPS spoofing, and more	Covered by Corpfy extended SIEM ruleset

⚠️ Consequences of Non-Compliance

Section 70B(7) IT Act: imprisonment up to 1 year AND/OR fine for the person in charge
Failure to report within 6 hours is itself a separate offence from the underlying incident
CERT-In can demand logs from any 180-day window at any time — if you don't have them, you're immediately non-compliant
Repeat failures can result in CERT-In directing ISPs to block your services
FIR exposure: non-compliance can be cited in FIR/PIL proceedings under the IT Act

What Corpfy Delivers

Deliverables & Artefacts

Everything needed for a defensible, auditable CERT-In compliance posture

Deliverable	Description	Format
NTP Configuration	chrony.conf / ntpd.conf targeting samay.nic.in + time.nplindia.org for all servers	Config + IaC
Log Retention Setup	GCP Cloud Logging / AWS CloudWatch 180-day retention with IST zone; Terraform scripts	IaC (Terraform / gcloud)
Incident Detection Alerts	20 CERT-In incident-type rules in your SIEM / Cloud Security Command Centre	JSON ruleset + docs
Incident Response Plan (IRP)	Tailored IRP with detection → containment → CERT-In notification → post-incident review	PDF Playbook
CERT-In Notification Template	Pre-filled incident report form matching CERT-In's required format	DOCX + PDF
VAPT Coordination	Scope document, empanelled-agency engagement, finding tracker, remediation sign-off	Project + Report
Nodal Officer Designation	Designation letter template + CERT-In submission guidance	PDF
MFA Implementation	Firebase App Check / Entra ID MFA for admin and privileged-access systems	Code + Docs
Breach Drill Report	Tabletop exercise results, gaps found, and remediation actions	PDF Report
CERT-In Compliance Certificate	Corpfy-signed attestation of Directions implementation for due diligence	PDF

Frequently Asked Questions

Do CERT-In Directions apply to my startup? We are very small.+

Yes — there is no size exemption. The Directions apply to all "service providers, intermediaries, data centres, body corporates, and Government organisations" operating in India. There is no minimum revenue, headcount, or server count threshold.

If your startup provides a SaaS product, hosts data in India, operates an API used by Indian users, or provides any digital service to Indian customers — you are covered.

What information must be included in the 6-hour CERT-In incident report?+

CERT-In's format requires:

Organisation details: name, address, sector, Nodal Officer name and contact
Incident type: one of the 20 categories
Date and time of detection (in IST)
Systems affected: IP addresses, hostnames, OS, applications
Nature of attack: vector, exploit used, payload if known
Impact: data exfiltrated, systems down, users affected
Containment actions taken so far
Evidence preserved: logs, malware samples, forensic images

Corpfy provides a pre-filled template with all required fields mapped to your asset register, so your team can complete and submit within minutes of detection.

What are the NTP requirements and how do we implement them?+

All ICT systems must synchronise their clocks with samay.nic.in and time.nplindia.org — the National Physical Laboratory's servers. This ensures all log timestamps are in IST and traceable to a single authoritative time source.

On Linux servers, configure /etc/chrony.conf with server samay.nic.in iburst prefer and server time.nplindia.org iburst. For GKE or EKS, node-level NTP config propagates to containers. Corpfy provides the exact configuration files validated against CERT-In requirements for your cloud provider.

What does "180-day log retention in IST" mean in practice?+

CERT-In requires all ICT system logs be retained for a minimum of 180 days, and critically that timestamps are in Indian Standard Time (IST, UTC+5:30) — not UTC, not the cloud provider's default timezone.

In practice: configure GCP Cloud Logging or AWS CloudWatch to (1) use IST timestamps, (2) set a 180-day retention policy, and (3) restrict access to authorised personnel only. Corpfy delivers Terraform scripts for both platforms that configure all three requirements in a single apply.

What is the penalty for not complying with CERT-In Directions?+

Under Section 70B(7) of the IT Act, 2000, any person who fails to comply is punishable with imprisonment of up to one year, or a fine, or both. The person in charge of the company — CEO, CTO, or CISO — can be personally liable.

Failing to report within 6 hours is itself a separate offence from the underlying incident. CERT-In can also direct ISPs to restrict traffic to non-compliant entities.

Who must be designated as the Nodal Officer?+

CERT-In requires every covered entity to designate a Nodal Officer / Point of Contact for all CERT-In communications — incident reports, information requests, and audit notices. This is typically the CISO, CTO, or Head of IT Security.

The Nodal Officer must be designated by name, role, email, and phone number in a formal letter submitted to CERT-In. They must be reachable 24x7 during incidents. Corpfy provides the designation letter template, CERT-In submission guidance, and an escalation matrix so the role is covered even during absences.

Key Takeaways — CERT-In Compliance for Indian Startups

The 6-hour reporting clock cannot be recovered once missed:

From the moment an incident is detected, you have exactly 6 hours to submit to incidents@cert-in.org.in. There is no extension or grace period. The only way to reliably meet this is detection infrastructure that fires within minutes of an incident, and a pre-filled notification template your Nodal Officer can complete and send in under an hour.

NTP synchronisation to Indian government servers is a hard technical requirement:

Pointing your servers at pool.ntp.org or your cloud provider's default NTP is not compliant. CERT-In specifically mandates samay.nic.in and time.nplindia.org. For incident forensics, log timestamps that drift even seconds can render your evidence inadmissible.

180-day IST log retention must be provisioned before an incident occurs:

If CERT-In requests your logs from 6 months ago and you only retain 30 days, you are immediately non-compliant. Cloud providers default to 7–30 day retention windows. You must explicitly provision 180-day retention with IST timezone stamping before going live — not after an incident.

Annual VAPT is a compliance requirement, not a best practice:

CERT-In Directions require VAPT at least annually and after significant infrastructure changes. The VAPT must be conducted by a CERT-In empanelled agency. Findings must be tracked to remediation and evidence retained. Corpfy coordinates the full VAPT lifecycle including agency selection, scope document, finding tracker, and sign-off evidence.

CERT-In and ISO 27001 incident management controls overlap significantly:

ISO 27001:2022 Annex A controls A.5.24–A.5.28 (incident management planning, assessment, response, learning, and evidence collection) address the same requirements as CERT-In's IRP mandate. Implementing both together reduces duplicated effort by approximately 40% and produces a single incident response playbook that satisfies both auditors.

Inside Corpfy CERT-In Audit

Corpfy's CERT-In Audit dashboard tracks all CERT-In Directions (April 2022) compliance requirements — incident reporting, log management, NTP configuration, Nodal Officer designation, and VAPT — in a single live gap register your CISO works from daily.

Capability	What it does	Output
6-Hour Incident Reporting Kit	Pre-filled incidents@cert-in.org.in notification template with all required fields	CERT-In submission evidence with dispatch timestamp
Log Compliance Register	Tracks 180-day IST retention status across all ICT systems	Log retention compliance matrix per system type
NTP Configuration Tracker	Validates sync to samay.nic.in and time.nplindia.org	NTP compliance evidence for audit
Nodal Officer Register	Records designation with name, role, contact, and CERT-In submission proof	Designation letter in CERT-In expected format
VAPT Tracker	Tracks annual VAPT schedule, empanelled agency, scope, and remediation status	VAPT programme evidence for CERT-In compliance

Corpfy natively handles your CERT-In compliance evidence trail. The 180-day IST log retention register, NTP configuration tracker, Nodal Officer designation record, incident notification templates, and VAPT programme log are all built into Corpfy — no external monitoring tool is needed to maintain your compliance posture.

Cloud provider integrations are supported for automated evidence collection. For teams running on AWS, Corpfy connects with CloudWatch to pull log retention status automatically. On GCP, Cloud Logging integration validates IST timestamp compliance. On Azure, Azure Monitor and Log Analytics Workspace are supported for the same purpose. Datadog and Grafana integrations are also available for multi-cloud and hybrid environments. CERT-In empanelled VAPT vendors can push scan findings directly into Corpfy's compliance tracker via API. All integrations are optional — the compliance register works fully without them.