CERT-In Reporting Deadline Calculator

CERT-In incident reporting — what the six-hour window means in practice.

CERT-In (Indian Computer Emergency Response Team) Directions 2022, issued under Section 70B of the Information Technology Act, require any organisation operating in India to report 20 specified types of cybersecurity incidents to CERT-In within six hours of becoming aware of the incident. This calculator helps SOC teams instantly determine their reporting deadline from a given detection timestamp.

The six-hour window is strict and begins at the moment of awareness — not at the moment of confirmation, and not after investigation is complete. An L1 analyst who sees a ransomware alert at 02:30 AM has started the clock, regardless of whether L2 has confirmed the incident or the full scope is known. CERT-In expects an initial report with whatever information is available, followed by updates as the investigation progresses. Filing an incomplete initial report on time is far better — both legally and practically — than filing a complete report after the deadline.

The 20 notifiable incident types under CERT-In Directions 2022 include: targeted scanning of critical networks and systems, compromise of critical systems or information, unauthorised access to IT systems and data, defacement of websites, malicious code attacks (including ransomware), attacks on servers and network infrastructure, identity theft and phishing attacks, large-scale network anomalies and denial of service attacks, data breaches and data leaks, and attacks on connected devices.

Reports are submitted via the CERT-In incident reporting portal at incident.cert-in.org.in. The report requires: organisation name and contact details, nature of the incident, affected systems and approximate count, nature of information compromised (if applicable), and actions taken so far. Penalties for non-reporting under Section 70B can include imprisonment of up to one year and a fine of up to ₹1 lakh.