CERT-In Compliance Services for India — 6-Hour Incident Reporting, Log Retention, Cyber Hygiene
The CERT-In 2022 Directions made India one of the strictest incident-reporting regimes in the world: 20 categories of cyber incidents must be reported within 6 hours, ICT system logs retained for 180 days inside India, and clocks synchronised to NPL or NIC. Opsio's Bangalore SOC operationalises every CERT-In control end-to-end — from detection through reporting through evidence retention.
Trusted by 100+ organisations across 6 countries
6h
Reporting SLA
180d
Log Retention
20
Incident Categories
24/7
SOC Coverage
What's Included
6-Hour Incident Reporting Automation
Pre-templated CERT-In Incident Reporting Forms pre-mapped to all 20 incident categories. SOC analysts triage every alert against the CERT-In taxonomy within minutes, populate Annex I metadata, and dispatch via the cert-in.org.in portal, email, fax, or phone as the situation requires.
180-Day In-India Log Retention
Centralised log pipeline retained inside AWS ap-south-1 Mumbai or Azure Central India satisfying the data-residency clause of the 2022 Directions. Logs are tamper-evident, indexed for forensic search, and exportable in the metadata format prescribed in CERT-In FAQs.
NTP Synchronisation to NIC and NPL
All servers, workstations, network devices, and cloud workloads synchronised to the National Physical Laboratory or National Informatics Centre NTP servers, with continuous drift monitoring and alerting on any clock that drifts beyond the documented tolerance.
Cyber Incident Playbooks
Documented playbooks for every CERT-In incident category — ransomware, unauthorised access, identity theft, IoT compromise, critical-infrastructure attacks — with named responsibilities, escalation timers, and pre-approved external communications mapped to regulator and customer obligations.
KYC Record Management
For VPN, data-centre, and cloud-service operators, Opsio operates the five-year KYC record system the Directions require, integrating with your customer onboarding workflow so KYC capture happens once and is retained inside India.
Quarterly Evidence Packages
Board-ready quarterly evidence packs covering incident counts, reporting timeliness, log retention health, NTP drift, and KYC sample audits — the exact format CERT-In, RBI, SEBI, and ISO 27001 auditors expect during examinations.
Free consultation
Talk to an expert about CERT-In Compliance Services for India
Tell us briefly what you need. A specialist replies within one business day — free and without obligation.
- Reply within one business day
- No obligation
- Certified cloud engineers
Opsio's focus on security in the architecture setup is crucial for us. By blending innovation, agility, and a stable managed cloud service, they provided us with the foundation we needed to further develop our business. We are grateful for our IT partner, Opsio.
Jenny Boman
CIO · Opus Bilprovning
CERT-In Compliance Done Right for Indian Enterprises
The CERT-In Directions issued on 28 April 2022 under Section 70B(6) of the Information Technology Act fundamentally reshaped India's cybersecurity reporting regime. Every body corporate, government organisation, service provider, intermediary, and data centre operating in India must report any one of 20 enumerated cyber incidents within 6 hours of detection — far shorter than the 72-hour windows familiar from GDPR or the 24-hour SEBI cyber circular. For boards and audit committees, the practical implication is straightforward: detection, classification, and reporting workflows must be rehearsed, automated, and demonstrable, not improvised during a crisis. Opsio's CERT-In compliance service is built around this 6-hour reality. Our Bangalore cloud security team operates a 24/7 SOC where every alert is triaged against the 20 CERT-In incident categories within minutes, an internal escalation clock starts on first notice, and a pre-templated CERT-In Incident Reporting Form is auto-populated with the metadata required by Annex I of the Directions. We integrate with your SIEM (Microsoft Sentinel, Splunk, Elastic, or AWS Security Hub) and your incident management platform so the same alert that triggers your engineering team also starts the regulatory clock.
Beyond reporting, the 2022 Directions impose technical controls that many Indian enterprises are still operationalising: ICT logs must be retained securely inside India for 180 days, system clocks must be synchronised to the NIC or NPL NTP servers, and KYC records for VPN, data-centre, and cloud-service subscribers must be maintained for five years. Opsio operates the log retention pipeline inside AWS ap-south-1 Mumbai and Azure Central India regions, satisfying residency requirements without adding latency to your application stack, and we publish quarterly evidence packages your auditors and regulators can rely on.
CERT-In compliance does not exist in isolation. It overlaps with DPDPA compliance for personal data breach notification, with RBI cybersecurity circulars for regulated financial entities, and with ISO 27001 Annex A controls for incident management. Our team maps every control once and reuses the evidence across frameworks, so compliance budgets compound rather than fragment. The Bangalore delivery centre operates in IST aligned with your business hours, and English remains the working language for every escalation, board report, and regulator interaction.
Mid-market enterprises typically reach a defensible CERT-In posture in 8 to 12 weeks: a 2-week current-state assessment, 4 to 6 weeks implementing log retention, NTP synchronisation, and incident-reporting automation, followed by a tabletop exercise where we simulate two of the 20 CERT-In incident categories end-to-end and produce reporting artefacts your team can present to CERT-In if required. Continuous compliance then runs as a managed service with monthly evidence updates and quarterly reviews.
How Opsio Compares
| Capability | DIY (In-House) | Generic IT Consultant | Opsio CERT-In Compliance |
|---|---|---|---|
| 6-hour reporting automation | Manual, error-prone under stress | Templates only, no SOC integration | Pre-templated forms, SOC-integrated, all 20 categories |
| Log retention residency | Often discovers logs are abroad post-incident | Generic AWS/Azure setup | AWS Mumbai / Azure Central India by design |
| NTP synchronisation | Public NTP, drift untracked | Configured once, never monitored | NPL/NIC NTP with continuous drift monitoring |
| Cross-framework reuse | Each framework rebuilt separately | Limited mapping | CERT-In, DPDPA, RBI, SEBI, ISO 27001 unified |
| Tabletop exercises | Rarely conducted | Generic templates | CERT-In-specific scenarios annually |
| Quarterly evidence packages | Reconstructed before audits | Generic compliance report | Board-ready, regulator-tested format |
Ready to get started?
What You Get
Pricing & Investment Tiers
Transparent pricing. No hidden fees. Scope-based quotes.
CERT-In Gap Assessment
₹6-12 lakh
2-week current-state assessment + roadmap
Implementation (8-12 weeks)
₹15-35 lakh
Log retention, NTP, reporting automation, tabletop
Managed CERT-In Compliance
₹6-18 lakh / year
24/7 SOC, monthly reports, quarterly evidence packages
Enterprise / Multi-Entity
From ₹40 lakh
Holding companies and multi-subsidiary estates
Transparent pricing. No hidden fees. Scope-based quotes.
Questions about pricing? Let's discuss your specific requirements.
Why Choose Opsio for Cloud Services
Bangalore SOC Operating in IST
24/7 monitoring in the same time zone your incidents will happen, with English as the working language for every escalation.
All 20 CERT-In Categories Pre-Mapped
Every alert is triaged against the 20 incident categories within minutes, not after a war-room meeting.
Data Residency by Design
Log retention and KYC records anchored in AWS Mumbai and Azure Central India regions — never leave India, never trigger transfer obligations.
Cross-Framework Evidence Reuse
One evidence pipeline that satisfies CERT-In, DPDPA, RBI, SEBI, and ISO 27001 simultaneously, so compliance spend compounds rather than duplicates.
Tabletop Exercises Included
Annual two-scenario tabletop exercises where we simulate real CERT-In incidents end-to-end and rehearse the 6-hour clock with your team.
INR Billing, Indian Contracting Entity
Transparent INR pricing, Indian invoicing, and master services agreements governed by Indian law and Indian jurisdiction.
Not sure yet? Start with a pilot.
Begin with a focused 2-week assessment. See real results before committing to a full engagement. If you proceed, the pilot cost is credited toward your project.
Our 4-Phase Delivery Process
Current-State Assessment
Two-week gap assessment against the 2022 Directions covering reporting workflows, log retention, NTP synchronisation, and KYC records. Output: prioritised remediation roadmap.
Build & Integrate
Four to six weeks deploying log pipelines into AWS Mumbai or Azure Central India, integrating SIEM with our SOC, automating incident-reporting forms, and synchronising NTP across your estate.
Rehearse
Tabletop exercise simulating two CERT-In incident categories with your CISO, legal, and communications teams. Reporting artefacts produced as if dispatched to CERT-In.
Operate & Attest
Continuous managed operation with monthly SOC reports and quarterly board-ready evidence packages your regulators can rely on during examinations.
Key Takeaways
- 6-Hour Incident Reporting Automation
- 180-Day In-India Log Retention
- NTP Synchronisation to NIC and NPL
- Cyber Incident Playbooks
- KYC Record Management
Industries Served by Opsio
BFSI & NBFC
Banks, NBFCs, and payment processors must reconcile CERT-In's 6-hour clock with RBI's parallel incident-reporting obligations; Opsio operates a single workflow that satisfies both.
E-commerce & Marketplaces
Indian marketplaces handling crore-scale daily transactions face every CERT-In category from website defacement to data breach. Our playbooks cover the full spectrum.
ITeS & GCC
Global Capability Centres serving multinational parents must demonstrate Indian regulatory compliance alongside parent-company frameworks. Cross-framework evidence reuse is built in.
Manufacturing & Critical Infrastructure
OT environments, ICS/SCADA systems, and connected manufacturing increasingly fall under CERT-In's critical-infrastructure scope; our playbooks address IT-OT incident coordination.
Related Cloud Insights & Articles
NIS2 for Indian Manufacturing IT: Industry 4.0 Compliance
NIS2 for Indian Manufacturing IT: Industry 4.0 Compliance Manufacturing is a major NIS2 target.
HIPAA for MSPs: Compliance Guide & FAQs
Indian IT leaders evaluating HIPAA MSPs Compliance consistently raise three questions: how do we maintain cost discipline as the rupee fluctuates, how do we…
Managed NIS2 compliance for SMEs: 2026 Guide
As we move further into 2026, the landscape of European digital regulation has shifted from a series of recommendations to a set of strict, enforceable…
CERT-In Compliance Services for India — 6-Hour Incident Reporting, Log Retention, Cyber Hygiene — FAQ
What incidents must be reported to CERT-In within 6 hours?
The CERT-In Directions of 28 April 2022 enumerate 20 categories including targeted scanning and probing, compromise of critical systems, unauthorised access, defacement of websites, malicious code attacks, attacks on servers and network appliances, identity theft, data breach and data leak, attacks on IoT and associated systems, attacks on systems related to digital payment, attacks through malicious mobile apps, fake mobile apps, unauthorised access to social media accounts, attacks or malicious activities affecting cloud computing systems, and attacks or malicious activities affecting AI and machine learning systems among others. The 6-hour clock starts the moment your organisation notices or is notified of any one of these.
Can we host CERT-In logs outside India?
No. The 2022 Directions require logs of all ICT systems to be maintained securely within the Indian jurisdiction for a rolling 180-day period. Opsio operates the log retention pipeline inside AWS ap-south-1 Mumbai and Azure Central India regions specifically to satisfy this residency requirement without introducing latency into your application stack.
How does CERT-In compliance interact with DPDPA and RBI requirements?
CERT-In, <a href='/in/dpdpa-compliance-services/'>DPDPA</a>, and RBI cybersecurity circulars each have their own reporting clocks and disclosure obligations. The Data Protection Board under DPDPA, CERT-In under the IT Act, and the Reserve Bank of India under its IT governance framework can all be in scope for the same incident. Opsio runs a single workflow that satisfies all three concurrently, with evidence packages tailored to each regulator.
Does CERT-In compliance apply to GCCs and foreign-owned entities?
Yes. The 2022 Directions apply to body corporates, government organisations, intermediaries, data centres, and service providers operating in India regardless of ownership. Global Capability Centres and Indian subsidiaries of multinationals are explicitly in scope, and many parent-company frameworks already require alignment with local cyber reporting laws in operating jurisdictions.
What happens if we miss the 6-hour reporting window?
Section 70B(7) of the IT Act provides for imprisonment up to one year, a fine up to one lakh rupees, or both, for any person failing to comply with CERT-In requirements. Beyond statutory penalties, regulated entities face sectoral consequences: RBI can restrict business activities for banks and NBFCs, SEBI can take action against market intermediaries, and IRDAI can act against insurers. Reputational and contractual consequences with enterprise customers are often the larger impact.
How does NTP synchronisation work in practice?
The Directions require all ICT system clocks to be synchronised to the NTP servers operated by the National Physical Laboratory at samay1.nplindia.org and samay2.nplindia.org, or to the National Informatics Centre NTP service. Opsio configures every server, workstation, network device, and cloud workload in your estate to these NTP sources and operates continuous drift monitoring so any clock skew is detected before it compromises log timestamp integrity.
What evidence do CERT-In auditors typically request?
Auditors typically request the Incident Reporting Forms dispatched in the audit period along with timestamps proving the 6-hour clock was met, log retention attestations covering all 180 days inside India, NTP drift logs showing clock synchronisation health, KYC records for any data-centre or VPN customers, and tabletop exercise reports demonstrating preparedness. Opsio's quarterly evidence packages bundle exactly these artefacts.
Do we need ISO 27001 to comply with CERT-In?
ISO 27001 is not a prerequisite for CERT-In compliance, but the two frameworks share extensive control overlap — incident management, log retention, access control, and time synchronisation appear in both. Indian enterprises pursuing both certifications typically reuse Opsio's <a href='/in/nist-compliance/'>NIST CSF</a> and ISO 27001 controls as the foundation, layering CERT-In-specific reporting and residency controls on top, which is significantly more efficient than building each framework in isolation.
How long does CERT-In compliance implementation take?
Mid-market enterprises typically reach a defensible CERT-In posture in 8 to 12 weeks: a 2-week current-state assessment, 4 to 6 weeks implementing log retention pipelines, NTP synchronisation, and incident-reporting automation, followed by a tabletop exercise rehearsing the 6-hour clock. Continuous compliance then runs as a managed service from our Bangalore SOC with monthly reports and quarterly board-ready evidence packages.
What does CERT-In compliance cost for a mid-market Indian enterprise?
Typical mid-market engagements range from ₹15-35 lakh for the initial 8-12 week implementation, followed by ₹6-18 lakh annually for managed SOC operation, log retention, and quarterly evidence packages. Pricing scales with the size of your estate, the number of CERT-In incident categories you can plausibly face, and the depth of regulator interaction required. All pricing is in INR, billed by our Indian contracting entity.
Still have questions? Our team is ready to help.
Meet CERT-In's 6-hour clock with confidence.
Talk to our Bangalore team about an end-to-end CERT-In compliance assessment for your Indian estate.
CERT-In Compliance Services for India — 6-Hour Incident Reporting, Log Retention, Cyber Hygiene
Free consultation