Cybersecurity incident obligations

Identify the applicable reporting framework

CERT-In’s directions apply to the specified service providers, intermediaries, data centres, bodies corporate and government organisations. Assess the incident against the notified categories and the accompanying official FAQs. Sector regulation, contracts and applicable data-protection provisions can create separate duties.

Do not assume that notifying a customer or a sector regulator also completes CERT-In reporting. Maintain a reporting matrix with the trigger, recipient, time limit and responsible person for each applicable obligation.

Record the reporting clock

The directions prescribe reporting covered cyber incidents within six hours of noticing them or being informed of them. Record when the organisation first became aware, what was known at that point and who received the information.

CERT-In’s FAQ addresses incomplete information: report available details within the required time and supply further information as it becomes available. Do not wait for a finished forensic report before assessing and making the required initial report.

Prepare an initial incident record

• Time of discovery and source of the alert.
• Affected systems, services and known impact.
• Known incident type and indicators, clearly separating facts from hypotheses.
• Immediate containment actions and their timestamps.
• Contact person and technical response owner.
• Information still being investigated.
• Reports submitted, reference numbers and follow-up requests.

Preserve evidence while containing harm

Coordinate isolation, access changes and recovery with the response team so relevant logs and artefacts are preserved. Keep a record of actions taken and maintain the integrity of evidence used for investigation.

For example, rebuilding an affected server may restore service but remove local evidence. Arrange an appropriate preservation step with qualified responders before destructive recovery actions where operational circumstances allow.

Make logging and contacts operational

The directions require covered organisations to enable ICT-system logs and retain them securely for a rolling 180 days. Review the directions and FAQ together for storage and production requirements, and confirm that logs can actually be retrieved when requested.

Maintain the designated CERT-In point of contact and an internal escalation arrangement. Check system time synchronisation and access to relevant provider logs before an incident exposes gaps in the evidence trail.

Coordinate other notifications

Assess sector-specific reporting, contractual notices and data-protection requirements separately, including whether the relevant provisions have commenced for the incident date. Use verified facts and identify uncertainty rather than issuing unsupported assurances.

Keep a controlled communication log. Technical teams, management and legal advisers should work from the same chronology so different reports do not describe incompatible discovery dates or impacts.

Close the response with evidence

Track follow-up submissions, remediation, recovery validation and outstanding regulator requests. Retain the incident chronology, submitted reports and supporting records under the applicable retention and access controls.

Kosha.Services can help organise the obligation matrix and documentation alongside your technical incident-response team. Use secure channels for incident material; a public enquiry form is not an appropriate place for credentials, exploit details or affected personal data.