Reporting cyber incidents in 6 hrs mandatory

The Indian Computer Emergency Response Team (CERT-In) has mandated that all cybersecurity incidents such as targeted scanning or probing of critical networks and systems, compromise of critical systems and information, unauthorised access of data and systems among others must be informed to it by the respective companies within six hours of either being made aware of the incident or becoming aware itself.

The new guidelines issued by CERT-In to companies operating in India say that service providers, intermediaries, data centres, companies and government organisations must mandatorily report such incidents within six hours.

It has also mandated that virtual asset service providers, virtual asset exchange providers and custodian wallet service providers shall maintain all the information they have gathered as a part of the know your customer (KYC) process and records of financial transactions for a period of five years.