The Ministry of Electronics and Information Technology’s (“MeitY”) Indian Computer Emergency Response Team (CERT-In) has issued a circular dated April 28, 2022 (“Circular”) which has detailed directions for the reporting of cyber incidents. This circular has been issued under Section 70B(6) of the Information Technology Act, 2000.

CERT-In is the national agency for performing the following functions in the area of cyber security:- a) collection, analysis and dissemination of information on cyber incidents; b) forecast and alerts of cyber security incidents; c) emergency measures for handling cyber security incidents; d) coordination of cyber incidents response activities; e) issue guidelines, advisories, vulnerability notes and whitepapers relating to information security practices, procedures, prevention, response and reporting of cyber incidents.

Vide the Circular, CERT-In has issued a set of directions to augment and strengthen the cyber security in the country. Of these, the most important is that all service providers, intermediaries, data centres Government organisations and enterprises engaged in commercial or professional activities shall mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents or being brought to notice about such incidents. The incidents can be reported to CERT-In via email (incident@cert-in.org.in), Phone (1800- 11-4949) and Fax (1800-11-6969). The details regarding methods and formats of reporting cyber security incidents is also published on the website of CERT-In www.cert-in.org.in and will be updated from time to time.

Some of the other important directions are:

1. All service providers, intermediaries, data centres, body corporate and Government organisations shall connect to the Network Time Protocol (NTP) Server of National Informatics Centre (NIC) or National Physical Laboratory (NPL) or with NTP servers traceable to these NTP servers, for synchronisation of all their ICT systems clocks. Entities having ICT infrastructure spanning multiple geographies may also use accurate and standard time source other than NPL and NIC, however it is to be ensured that their time source shall not deviate from NPL and NIC.
2. All service providers, intermediaries, data centres, body corporate and Government organisations shall mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days and the same shall be maintained within the Indian jurisdiction. These should be provided to CERT-In along with reporting of any incident or when ordered / directed by CERT-In.
3. Data Centres, Virtual Private Server (VPS) providers, Cloud Service providers and Virtual Private Network Service (VPN Service) providers, shall be required to register the following accurate information which must be maintained by them for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration as the case may be: a. Validated names of subscribers/customers hiring the services b. Period of hire including dates c. IPs allotted to / being used by the members d. Email address and IP address and time stamp used at the time of registration / on-boarding e. Purpose for hiring services f. Validated address and contact numbers g. Ownership pattern of the subscribers / customers hiring services.

Please find attached a copy of the Circular, which has a number of other procedural directions from CERT-In.

This update has been contributed by Vinod Joseph (Partner) and Protiti Basu (Associate).

Argus Knowledge Centre is now on WhatsApp! Send us a message on +91 8433523504 to receive updates from our Knowledge Centre.