Keep incident-readiness and record-keeping work organised
Bring response responsibilities, logging checks and evidence into a programme your teams can review.
Overview
The directions apply to the following, wherever an incident involves computer resources in India:
The FAQs clarify that individual users are not covered, and that the VPN subscriber record-keeping duty does not apply to enterprise or corporate VPNs. Check the current FAQs for how the directions apply to your organisation.
Structure
Six operative directions, two annexures, and the FAQs that explain them. Later CERT-IN guidelines are summarised at the end.
All ICT systems must connect to the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to servers traceable to them, for clock synchronisation. Organisations spread across geographies may use other accurate and standard time sources, provided they do not deviate from NPL and NIC.
Incidents of the types in Annexure I must be reported to CERT-IN within 6 hours of noticing them or of being brought to notice. CERT-IN publishes the reporting channels and format on its website. The FAQs allow initial reports with the information available, followed by further details.
Twenty types of incident, described here in summary.
Organisations must take action, provide information or give other assistance as CERT-IN orders for cyber incident response, mitigation and situational awareness, within the time it specifies. Each must designate a point of contact to liaise with CERT-IN, and send the details in the Annexure II format, keeping them up to date.
Logs of all ICT systems must be enabled and maintained securely for a rolling period of 180 days within Indian jurisdiction. They must be provided to CERT-IN with an incident report or when CERT-IN orders. The FAQs give an indicative list of the logs to keep, which depends on the organisation’s systems.
Data centres, VPS providers, cloud service providers and VPN service providers must register and keep accurate subscriber information for five years or longer as the law requires, even after a registration is cancelled or withdrawn.
Virtual asset service providers, exchanges and custodian wallet providers must keep KYC information and records of financial transactions for five years, in line with the KYC norms of RBI, SEBI and the Department of Telecommunications. Transaction records must be detailed enough to reconstruct each transaction, including IP addresses, time stamps and time zones, transaction IDs, public keys, addresses or accounts involved, and the nature, date and amount of the transfer.
Implementation roadmap
A practical route to meeting the directions. Most of the work is in detection, logging and the ability to report quickly.
Audit and evidence guide
The directions do not set up a certification. Compliance is tested when an incident happens, when CERT-IN asks for information, and through audits by sector regulators, internal audit or CERT-IN empanelled auditors.
Step 1
Notice and record the time
The six-hour window runs from noticing the incident or being told about it, so the time must be recorded.
Step 2
Classify against Annexure I
Decide whether the event falls within one of the 20 reportable types.
Step 3
Report to CERT-IN within 6 hours
Report through CERT-IN’s published channels with the information available, and follow up with details.
Step 4
Provide logs and information
Provide logs and other information when reporting or when CERT-IN orders, and act on its directions within the time it sets.
Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.
How Netra helps
Netra loads the CERT-IN directions as requirements, tasks and policies, so readiness work, checks and evidence stay on one record.
Netra organises readiness work and evidence. It is not a SIEM, a log storage service or a reporting channel to CERT-IN, and it does not by itself establish compliance. Incident reports must be made to CERT-IN through its own channels.