CERT-In’s 6-Hour Cyber Incident Rule: A Compliance Guide for Startups

It’s 2 a.m. and your engineer notices something odd: a spike in outbound traffic, an unfamiliar admin login, a ransom note in a shared drive. Most founders’ first instinct is to fix the problem quietly and decide later what, if anything, to tell anyone.

Under Indian law, that instinct can be expensive. Since 2022, CERT-In’s directions have required most organisations to report specified cyber security incidents within six hours of noticing them. This guide explains the CERT-In 6-hour rule, who it applies to, which incidents must be reported, the 180-day log requirement, how it fits with the DPDP Act’s breach rules, the penalties, and the legal remedies available after a cyber attack.

What the CERT-In 6-hour rule requires

On 28 April 2022, CERT-In (the Indian Computer Emergency Response Team) issued directions under Section 70B(6) of the Information Technology Act, 2000 (CERT-In Directions). The key obligations are:

• Six-hour reporting. Service providers, intermediaries, data centres, body corporates and government organisations must report specified cyber incidents to CERT-In within six hours of noticing them or being told about them.
• 180-day logs. Logs of all ICT systems must be enabled and maintained securely for a rolling period of 180 days and provided to CERT-In on request. The directions require these logs to be kept within Indian jurisdiction, although CERT-In’s later FAQs indicated that logs stored abroad may be acceptable if they can be produced on demand (Wikipedia).
• Clock synchronisation. System clocks must be synchronised with the NTP servers of the National Informatics Centre or the National Physical Laboratory, so logs can be correlated.
• Point of contact. Every organisation must designate a point of contact to liaise with CERT-In.
• Sector-specific record-keeping. Data centres, VPS, cloud and VPN service providers, and virtual asset service providers have extra customer-information and KYC record-keeping obligations, generally for five years. Crypto businesses should read this alongside our guide to FIU-IND registration for crypto exchanges and Web3 businesses.

“Body corporate” covers almost every company, LLP and firm, so the CERT-In 6-hour rule applies to startups of every size, not just large enterprises.

Which incidents must be reported within six hours?

The directions list around 20 categories of reportable incidents. The ones startups encounter most often include:

• targeted scanning or probing of critical networks and systems;
• compromise of critical systems or information;
• unauthorised access to IT systems or data;
• defacement of websites or intrusion into websites;
• malicious code attacks, including ransomware, viruses and spyware;
• attacks on servers, such as database, mail and DNS servers;
• identity theft, spoofing and phishing attacks;
• denial of service and distributed denial of service attacks;
• data breaches and data leaks;
• attacks on cloud computing systems, APIs, IoT devices and AI or blockchain applications.

Practical point: you don’t need the full picture to report. The six-hour clock is about early warning. File an initial report in good faith with what you know, and update CERT-In as your investigation progresses (AMLEGALS). Reports can be made by email or through CERT-In’s portal in the prescribed format.

How CERT-In fits with DPDP and sectoral breach rules

A single cyber incident can trigger several reporting obligations at once, each with its own clock:

Think about how this plays out. A ransomware attack on a health-tech startup’s database is a CERT-In reportable incident, a personal data breach under the DPDP Act, possibly a reportable event for a sectoral regulator, and a breach of its hospital clients’ contracts, all at once. Each recipient will compare what you told them. Build one incident response plan that meets all of these clocks, rather than separate processes that fight each other at 3 a.m. The six-hour CERT-In report usually comes first, and what you say in it should be consistent with what you later tell the Data Protection Board and your customers. Our DPDP Act compliance checklist covers the Board’s breach rules in detail.

Penalties and practical consequences of non-compliance

Failing to provide information to CERT-In, or to comply with its directions, is punishable under Section 70B(7) of the IT Act with imprisonment of up to one year, a fine of up to ₹1 lakh, or both (ManageEngine). Proposals to raise the fine have been discussed, so check the current position.

The bigger risk is how CERT-In compliance interacts with other liabilities. A company that hid an incident, kept no logs and can’t reconstruct what happened will struggle to defend itself against customer claims, show “reasonable security practices” under Section 43A of the IT Act, or argue that it took reasonable security safeguards under the DPDP Act once its penalties of up to ₹250 crore apply from May 2027. Insurers also commonly require prompt notification and cooperation with authorities as conditions of cyber insurance cover.

A CERT-In compliance checklist and remedies after an attack

Compliance checklist for startups

• Designate a CERT-In point of contact and register their details.
• Turn on logging for all ICT systems, including cloud, SaaS admin panels, firewalls and endpoints, and retain the logs for at least 180 days.
• Synchronise system clocks with NIC or NPL NTP servers.
• Write an incident response plan with a six-hour CERT-In reporting step, a DPDP breach notification step and a customer notification step.
• Add incident notification clauses to vendor contracts, requiring vendors to tell you quickly so you can meet your own six-hour deadline.
• Run a tabletop exercise at least once a year.

Leaks can also begin inside the company: employees pasting confidential data into AI tools is a growing source of incidents. See our guide to AI tools at work.

Legal remedies after a cyber attack

• Criminal complaint. Unauthorised access, data theft, ransomware and hacking are offences under Sections 43 and 66 of the IT Act, and extortion or cheating offences may apply under the Bharatiya Nyaya Sanhita, 2023. File an FIR with the cyber police and report on cybercrime.gov.in.
• Civil claims. Claim compensation under Section 43 of the IT Act from the person who caused damage to your computer systems, before the adjudicating officer for claims up to ₹5 crore and the civil court above that.
• Vendor claims. If a breach came through a vendor, enforce the security, indemnity and notification clauses in your contract.
• Insurance. Notify your cyber insurer promptly and follow the policy’s claims process.
• Takedowns. If stolen data is published online, seek takedowns from platforms and, where needed, court injunctions.

Quick answers

Does the CERT-In 6-hour rule apply to small startups?

Yes. It applies to “body corporates”, which includes companies and LLPs of all sizes, as well as service providers, intermediaries and data centres.

What if we don’t know all the facts within six hours?

File an initial report with what you know and update it as the investigation continues.

How long must logs be kept?

At least 180 days on a rolling basis, and they must be produced to CERT-In on request.

Related reading: the Sahyog portal and content takedowns; also ransomware, ransom payments and cyber insurance; also Indian AI teams and US client data; also UK GDPR transfers to India; also Indian scam call centres and UK victims; also the RBI digital payment security directions 2026.

Final word

At Halverton & Co., we advise startups, SaaS companies and technology-driven businesses on cyber security compliance, incident response, data breach notification and cybercrime remedies. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and act as fractional legal counsel for companies that need senior legal support without a full in-house team. Halverton & Co.: Where tech needs law!

Write to us at office@halvertonandco.com, or get in touch, to discuss your situation.

This article reflects the law and developments reported up to early October 2026. Technology regulation changes quickly; please take advice on your specific facts before acting.