CERT-In 6-Hour Incident Reporting Gap
Organizations subject to Indian IT Act must report cyber incidents to CERT-In within 6 hours. Failure to comply results in penalties under IT Act Section 70B.
Overview
CERT-In mandates that all organizations must report cyber incidents within 6 hours of detection. This includes targeted scanning, unauthorized access, data breaches, ransomware, and DDoS attacks.
Types & Variants
Targeted Scanning/Probing
Reconnaissance activities targeting network or application infrastructure.
Data Breach
Unauthorized access or exfiltration of sensitive data.
Ransomware Attack
Malware encrypting data with ransom demands.
Impact
Legal penalties, regulatory action, inability to coordinate incident response with national CERT.
Remediation
Establish 24x7 incident response team, create reporting templates with required fields (IST timestamps, IOCs, affected systems), and conduct quarterly drills.
Maintain 24x7 incident response team with CERT-In reporting authority
Create categorized reporting templates per CERT-In incident types
Implement automated detection with escalation to reporting team
Conduct quarterly incident reporting drills
Related SuperClue scanner checks
These scanner checks look for signs of CERT-In 6-Hour Incident Reporting Gap. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works