The Eight Questions
You Will Be Asked at Hour One

Direction (ii) requires any service provider, intermediary, data centre, body corporate and Government organisation to report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours. It runs from “noticing such incidents or being brought to notice about such incidents”, which is why question 1.1 asks for a record of the moment of noticing kept separately from the record of detection: where a third party told you, those are two different moments.

The service providers, intermediaries, data centres, body corporate and Government organisations “shall designate a Point of Contact to interface with CERT-In”, in the format at Annexure II, “updated from time to time”. The same Direction provides that where CERT-In issues an order or direction for cyber incident response, it “may include the format of the information that is required (up to and including near real-time), and a specified timeframe in which it is required, which should be adhered to and compliance provided to CERT-In, else it would be treated as non-compliance of this direction”. A requisition can therefore arrive with a timeframe attached, and it arrives at the Point of Contact — which is why section 6 rehearses the approval path rather than only the first filing.

“All service providers, intermediaries, data centres, body corporate and Government organisations shall mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days and the same shall be maintained within the Indian jurisdiction.” Section 2 turns that into a table you fill in against what you hold, and on shared hosting or a managed platform the answer belongs to somebody else — which is a ticket you can raise this afternoon.

CERT-In’s own answer begins “The logs that should be maintained depend on the sector that the organisation is in, such as Firewall logs, Intrusion Prevention Systems logs, SIEM logs, web / database/ mail / FTP / Proxy server logs, Event logs of critical systems, Application logs, ATM switch logs, SSH logs, VPN logs etc.”, and records that “this list of logs is not exhaustive but has been mentioned to provide flavour of logs to be maintained by the relevant teams”. Those thirteen classes are the rows of section 2, with blank lines for the ones you add. The answer also carries the sentence the table’s last column is built on: “From the incident response and analysis perspective both successful as well as unsuccessful events shall be recorded.”

Direction (i) requires all service providers, intermediaries, data centres, body corporate and Government organisations to “connect to the Network Time Protocol (NTP) Server of National Informatics Centre (NIC) or National Physical Laboratory (NPL) or with NTP servers traceable to these NTP servers, for synchronisation of all their ICT systems clocks”. Entities whose ICT infrastructure spans multiple geographies “may also use accurate and standard time source other than NPL and NIC, however it is to be ensured that their time source shall not deviate from NPL and NIC”. CERT-In gives the reason at FAQ Q 39: “A typical cyber incident involves multiple computer systems within as well as across entities. Without an accurate time stamp it is extremely challenging to re-create accurate sequence of events thus causing serious hindrance while handling cyber incidents.” Q 43 names samay1.nic.in, samay2.nic.in and time.nplindia.org; Q 40 adds that “The time zone information shall also be recorded along-with time to facilitate accurate conversion at the time of need.”

Rule 14(1) provides that any officer of CERT-In not below the rank of Deputy Secretary to the Government of India may seek information from service providers, intermediaries, data centres, body corporate and any other person for carrying out the functions provided in sub-section (4) of section 70B of the Act, and Rule 14(3) adds that the information sought is to be submitted “within the duration and in the format provided alongwith the communication sent for seeking the information”. Rule 12(1) puts the CERT-In Incident Response Help Desk “on 24 hours basis on all days including Government and other public holidays”. Section 6 asks the matching question about your own approval path.

A Commercial Bank as /410 ¶3 defines that term, a Small Finance Bank, Payments Bank, Urban Co-operative Bank, Credit Information Company, an NBFC in the Base Layer with asset size ₹500 crore and above, or an NBFC in the Middle, Upper or Top Layer other than a Core Investment Company or a Housing Finance Company reports cyber incidents within six hours of detection on the DAKSH platform. A Housing Finance Company reports cyber incidents to the National Housing Bank, per the note at /461 ¶141. Establishing which of those describes you is a reading exercise, and section 5 is where you write the paragraph number down.

A SEBI regulated entity whose incident falls under the CERT-In Cybersecurity directions notifies SEBI and CERT-In within 6 hours of noticing or detecting it, or being brought to notice — SEBI at mkt_incidents@sebi.gov.in — and files on the SEBI Incident Reporting Portal within 24 hours; any other cybersecurity incident goes to SEBI, CERT-In and NCIIPC, as applicable, within 24 hours. A stock broker or depository participant also reports to its stock exchange or depository inside the same 6 hours. Table 36 then dates what follows: an interim report at 3 days, mitigation at 7, root cause analysis at 30 and a VAPT at 45, each running from the date the incident was reported or you were brought to notice of it.