Cyber Incident Reporting in India — The 6-Hour Clock, Across Five Regulators

Six hours is the number that governs most of the economy. CERT-In’s Direction 20(3)/2022 requires reporting within six hours of noticing an incident, and SEBI’s CSCRF, IRDAI’s guidelines and DoT’s Telecom Cyber Security Rules each adopt the same six-hour window for their sectors. The power sector adds a separate 24-hour clock for sabotage under the CEA’s 2021 guidelines, and a personal-data breach under the DPDP Act must be notified without delay with full detail inside 72 hours — though that rule does not commence until roughly May 2027.

No, and this is the most expensive misreading of the rule. CERT-In’s language is “within 6 hours of noticing such incidents or being brought to notice about such incidents”. Triage and investigation happen inside the window, not before it starts. DoT’s rules are wider still: Rule 2(e) defines an incident as an event with real or potential risk, so a suspicion can start the clock.

It depends on the sector, and getting this wrong is a common failure. Most organisations report to CERT-In. SEBI regulated entities report per Annexure-O of the CSCRF. Insurers and intermediaries report to CERT-In with a copy to IRDAI. Telecom entities report to the Central Government under Rule 7 — filing only with CERT-In does not discharge that rule. Power utilities report sabotage to CERT-In, the sectoral CERT and NCIIPC. A personal-data breach also goes to the Data Protection Board.

In the two regimes that address it directly, yes. SEBI’s CSCRF mandates a SOC for almost every regulated entity and then offers three models: the entity’s own or group SOC, the Market SOC operated by the exchanges and depositories, or any third-party managed SOC. Small-size and self-certification REs are directed onto the Market SOC. DoT’s Rule 4(4)(h) permits a SOC operated “by itself or in collaboration with other telecommunication entities”. IRDAI and the CEA require the function without addressing who staffs it. One caveat for SEBI entities, stated precisely: the CSCRF FAQ of June 2025 requires ISO 27001 scope to cover the SOC including where it is outsourced, but a technical clarification of 28 August 2025 made certification recommended rather than mandatory for Qualified REs, leaving it mandatory for market infrastructure institutions. Either way, ask your provider for the certificate and check the scope statement, not just the logo.

For CERT-In purposes, yes. The Directions require ICT system logs to be maintained for a rolling 180 days within Indian jurisdiction. That is a residency requirement on the data. It is worth separating from a claim you will hear often — that your analysts must also sit in India. That is not a legal requirement. SEBI’s framework goes the other way, exempting IT and cyber-security data sent to a global or international SOC from data-localisation, subject to annual IT Committee review and Board approval. Log residency is law; analyst geography is an operational choice.

CERT-In non-compliance is actionable under section 70B(7) of the IT Act 2000. Under the DPDP Act, failure of reasonable security safeguards attracts penalties up to ₹250 crore and failure to notify a breach up to ₹200 crore. In the power sector the CEA guidelines state plainly that the CISO is held liable for non-reporting. For protected systems, section 70 of the IT Act carries imprisonment of up to ten years.

Three things, and the first is the one people skip. You need monitoring that notices — because the clock runs from noticing, an incident nobody sees is not a clock you have paused. You need an incident timeline you can reconstruct quickly, which in practice means centralised logs with enough retention. And you need a named person and a filed point of contact, because CERT-In requires a designated PoC and six hours is not the moment to work out who signs. We build all three; see our SOC services and compliance services.

We prepare and support it. Our SOC produces the incident reconstruction and the evidence pack the report depends on, and we work to your escalation matrix so the right person at your organisation signs and files within the window. The regulatory obligation stays with you — no service provider can absorb it — but the part that usually causes the miss, which is not having the facts in time, is the part we remove.