CERT-In Directions: A Practical Checklist for Indian IT Teams

Who the Directions cover

The Directions are addressed to service providers, intermediaries, data centres, body corporate and Government organisations. They set no minimum company size. They took effect 60 days after issue, and non-compliance may invite punitive action under section 70B(7) of the IT Act. Extra duties apply to data centres, cloud and VPS providers, VPN providers and virtual asset businesses; this checklist covers the duties every company shares.

The checklist

1. Name a point of contact

Pick one person, usually the IT head, and a backup. Send their details to CERT-In in the Annexure II format and put a reminder in your calendar to update them when people change roles. All CERT-In communication asking for information or giving directions goes to this contact.

2. Sync every clock to an Indian time source

Accurate timestamps are what make logs from different systems line up during an investigation. In a Windows domain, set the PDC emulator to an NIC or NPL NTP server and let other machines follow the domain hierarchy. To see where a machine gets its time:

w32tm /query /status
w32tm /query /source

Entities whose infrastructure spans several countries may use another time source, provided it does not deviate from NPL and NIC. Check network devices, firewalls and cloud workloads too: the Directions say all ICT systems.

3. Keep 180 days of logs, in India

Start from an inventory: you cannot show logs for a system you did not know you had. Then, for each system class, record:

• Which logs are enabled (Windows Security, System and Application event logs; firewall; VPN; email; cloud audit logs).
• Where they are stored, and that the location is within India.
• The retention setting, and that it covers a rolling 180 days.
• Who can read or delete them.

Windows keeps event logs in a size-limited file by default, which on a busy machine can mean days, not months. To meet 180 days, forward logs to central storage with its own retention rather than relying on each endpoint.

4. Report incidents within 6 hours

The 6-hour clock starts when you notice an incident or someone tells you about it. Reports go to incident@cert-in.org.in, by phone on 1800-11-4949, or by fax on 1800-11-6969; formats are published on the CERT-In website. Annexure I lists 20 incident types. The ones an SMB IT team meets most often include:

• Unauthorised access of IT systems or data.
• Malicious code attacks such as viruses, worms, trojans, bots, spyware, ransomware and cryptominers.
• Identity theft, spoofing and phishing attacks.
• Data breach and data leak.
• Unauthorised access to social media accounts.
• Attacks or suspicious activity affecting cloud systems, servers, software or applications.

Write the 6-hour step into your incident response plan, with who decides that an event is reportable and who sends the report. Six hours is short; the decision cannot wait for a meeting.

Where Sentrivox helps

Sentrivox gives you the inventory these duties start from: the Windows agent records hardware, software, services, users and open ports on each endpoint, so you know which systems must keep logs and sync their clocks. On ShieldPro and above, Sentrivox includes SIEM and log management. Sentrivox does not file reports with CERT-In for you, and the checklist above stays your team’s responsibility.