If you run infrastructure for an Indian organisation, some compliance rules land directly on your desk. A security vendor's global package may not cover them by default, so it helps to translate them into concrete engineering work.
What the CERT-In Directions (April 2022) ask for
- Report cyber incidents to CERT-In within 6 hours of noticing them
- Keep ICT system logs for 180 days, stored within India
- Synchronise system clocks
- Name a point of contact for CERT-In
Turning that into tasks
- Logs: list every system that produces security-relevant logs, confirm where they are stored, and check retention is at least 180 days in an Indian location. If you use a SIEM or a managed SOC, ask the provider exactly where data lives.
- Clocks: make sure servers, network devices and cloud services sync to a common time source, so timelines line up during an investigation.
- Reporting: write down who decides an incident is reportable and who files the report. Then rehearse it in a yearly tabletop exercise.
- Audits: CERT-In's July 2025 audit guidelines call for annual audits by empanelled auditors, plus extra audits after major changes. Plan these into release schedules.
Other rules that may stack on top
- DPDP Act 2023 and DPDP Rules 2025 (reasonable safeguards, breach intimation; main duties from May 2027)
- RBI IT Governance Master Direction, SEBI CSCRF or IRDAI guidelines for regulated entities
A practical order of work: list the rules that apply, map each obligation to a control, audit what exists, and fix the gaps with legal deadlines first. This is not legal advice, so confirm the scope with your adviser.
More detail: mapping Indian cyber security obligations to services
Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.
Top comments (0)