Skip to content
VITI Security
Contact

CERT-In Directions 2022

CERT-In 6-Hour Reporting Clock

How much of the mandatory 6-hour CERT-In incident reporting window do you have left?

Time elapsed since the incident was noticed or brought to your notice.

The 6-hour rule

Under CERT-In's Directions of 28 April 2022 (issued under section 70B(6) of the IT Act), service providers, intermediaries, data centres, body corporates and government organisations must report specified cyber incidents to CERT-In within 6 hours of noticing them, or of someone bringing them to their notice. CERT-In's FAQs say to report what you know within the 6 hours and add details as the investigation progresses.

Which incidents count

Annexure I of the Directions lists 20 incident types. They include:

  • targeted scanning or probing of critical networks and systems;
  • compromise of critical systems, and unauthorised access to IT systems or data;
  • website defacement or intrusion;
  • malicious code attacks, such as ransomware;
  • attacks on servers such as database, mail and DNS servers;
  • identity theft, spoofing and phishing;
  • denial-of-service attacks;
  • data breaches and data leaks.

All 20 types share the same 6-hour window. The clock above covers ten of the most common.

The other duties in the Directions

  • Keep logs of all ICT systems for a rolling 180 days, within India.
  • Synchronise system clocks with the NIC or NPL time servers, so logs line up across systems.
  • Name a point of contact to deal with CERT-In.

CERT-In is not the only clock

WhoDeadline
CERT-In6 hours from noticing a specified incident
RBI (banks, NBFCs and others)6 hours from detection, on the DAKSH platform
SEBI (CSCRF)6 hours, to SEBI as well as CERT-In
Data Protection Board (DPDP Rules, from 13 May 2027)Without delay; detailed report within 72 hours, for personal data breaches

Six hours is short if nobody is watching at 2 a.m. The practical answer is monitoring that notices incidents, a reporting template prepared in advance, and one runbook covering every regulator that applies to you. See incident response and 24x7 monitoring and on-call.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

  1. Time left = 6 hours minus the hours since you noticed the incident or it was brought to your notice (CERT-In Directions of 28 April 2022, clause (ii)).
  2. If that is zero or less, the tool shows how far past the deadline you are. If you have already reported, it switches to the follow-up duties instead.
  3. Colour: 1 hour or less left is red, up to 3 hours amber, more than 3 hours green; past the deadline is red.
  4. The incident type only labels the result: every type in Annexure I of the Directions (20 in total, condensed to 10 here) has the same 6-hour window.

Worked example

The calculator run on its default inputs:

Hours since you noticed the incident
1 hours
Incident type
Unauthorized access to systems / data
Already reported to CERT-In
No

Report to CERT-In before the clock runs out

5h 00m left

Incident type
unauthorized access
Elapsed since detection
1h 00m
Time left in 6-hour window
5h 00m

With the defaults (an unauthorised-access incident noticed 1 hour ago, not yet reported) the tool returns 5h 00m left, in green because more than 3 hours remain.

Sources

Sources last checked September 2026.

Limitations

The clock covers the incident types in Annexure I and the entities the Directions name (service providers, intermediaries, data centres, body corporates and government organisations). Sector regulators such as RBI and SEBI run their own reporting clocks, and the DPDP Rules add a separate report to the Data Protection Board for personal data breaches from 13 May 2027. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.