Managed Security Costs, Price Drivers and 2026 Rules
CERT-In Directions 2022 for MSMEs: 6-hour reporting, 180-day logs, NTP and point of contact
What the CERT-In Directions of 28 April 2022 under IT Act section 70B(6) require from Indian businesses, what they cost to meet, and what to demand from a managed security provider.
The CERT-In Directions of 28 April 2022 (No. 20(3)/2022-CERT-In), issued under section 70B(6) of the Information Technology Act, 2000, require service providers, intermediaries, data centres, body corporates and government organisations to: report specified cyber incidents to CERT-In within 6 hours of noticing them or being told of them; keep logs of their ICT systems for a rolling 180 days within Indian jurisdiction; synchronise system clocks with the NTP servers of the National Informatics Centre (NIC) or National Physical Laboratory (NPL), or servers traceable to them; and designate a point of contact to deal with CERT-In. They came into effect on 27 June 2022; the date for MSMEs was extended to 25 September 2022. Almost every incorporated business in India is a "body corporate", so these rules apply to most MSMEs. This guide explains each duty, what it costs, and how a managed security contract should support it. It is part of the managed security pricing overview.
The four duties that matter to most MSMEs
| Duty | What the Directions require | Practical meaning |
|---|---|---|
| Incident reporting | Report specified incidents within 6 hours of noticing or being notified; give what you know and add details later | You need a way to recognise a reportable incident at night and on holidays |
| Logs | Maintain ICT system logs securely for a rolling 180 days within Indian jurisdiction; provide them to CERT-In when reporting or when asked | Firewalls, servers, identity, cloud and key application logs must be kept long enough, with a copy in India |
| Clock sync | Connect to NTP servers of NIC or NPL, or traceable to them | Logs from different systems line up in time; entities spanning geographies may use other accurate sources that do not deviate |
| Point of contact | Designate a point of contact and share details with CERT-In | A named person (and back-up) who can receive and respond to CERT-In communications |
Further obligations apply to specific types of businesses: data centres, VPS and cloud service providers and VPN service providers must keep certain subscriber information for 5 years after the subscription ends, and virtual asset service providers must keep KYC and transaction records. If you are one of these, read the Directions in full.
Which incidents are reportable?
The Directions annex lists types of incidents, including targeted scanning of critical networks, compromise of critical systems, unauthorised access to IT systems and data, website defacement, malicious code attacks such as ransomware, attacks on servers (database, mail, DNS), identity theft and phishing attacks, denial-of-service attacks, data breaches and data leaks, and attacks on cloud and IoT systems, among others. Read the full annex on CERT-In; do not rely on this short list.
The six-hour clock runs from noticing the incident or being told about it, not from finishing your investigation. CERT-In's FAQs indicate that you may submit available information within six hours and follow up with more.
What it costs to comply (illustrative)
| Requirement | Do-it-yourself option | Managed option | Illustrative extra cost |
|---|---|---|---|
| 180-day logs in India | Syslog server with storage in your office or an Indian cloud region | SIEM with 180-day retention in an Indian data centre | ₹30,000–₹3,00,000 a year depending on volume |
| 6-hour reporting | Written procedure, on-call phone, reporting form ready | Provider detects and prepares the report; you submit or authorise | Often in MDR/SOC price; check |
| NTP | Configure devices to an approved source | Provider configures as part of onboarding | Usually small |
| Point of contact | Name an employee and deputy | Provider listed as technical support | Staff time |
Worked example (illustrative)
A 120-endpoint company sends about 6 GB of logs a day from firewalls, servers and Microsoft 365. Its SOC plan includes 30 days of searchable storage. To cover 180 days it adds archive storage for the other 150 days: 6 GB × 150 = 900 GB held at any time. If the provider charges an illustrative ₹10 per GB a month for archive, that is ₹9,000 a month, ₹1,08,000 a year before GST. Without it, the company would not have the logs CERT-In may ask for after an incident.
What your managed security contract should say
- Detection-to-notification time to you, short enough to let you meet the six-hour deadline (for example within one hour for a critical incident).
- Who prepares and who submits the CERT-In report, with the format ready in advance.
- Log retention of at least 180 days, the location of the copy in India, and how logs are produced to CERT-In on request.
- Clock synchronisation of all managed devices and the SIEM to an approved source.
- Contact details kept current, including when the provider changes staff.
- Support during CERT-In follow-up, including log extraction and timelines.
Use the due-diligence checklist to test each item.
Penalties
Failure to provide information or comply with directions under section 70B is punishable under section 70B(7). The Jan Vishwas (Amendment of Provisions) Act, 2023 replaced "one lakh" with "one crore" in that sub-section, so the provision now reads as imprisonment up to one year or a fine up to ₹1 crore, or both. The Jan Vishwas changes to the IT Act came into force on 30 November 2023 (MeitY notification S.O. 4745(E) of 31 October 2023 on the e-Gazette); conduct before that date falls under the old wording.
How this fits with DPDP and sector rules
CERT-In reporting is separate from breach intimation under the DPDP Act, 2023. Under the DPDP Rules, 2025 the personal data breach rules apply from 13 May 2027; when they do, a personal data breach may need to be reported to CERT-In and to the Data Protection Board, on different timelines. See DPDP and the IT Act. Regulated entities also have RBI or SEBI reporting duties; see RBI and SEBI cyber rules.
FAQ
Do the Directions apply to a sole proprietor?
They apply to service providers, intermediaries, data centres, body corporates and government organisations. A sole proprietorship is not a body corporate, but it may still be a service provider or intermediary. Check the definitions and FAQs, or ask a lawyer.
Can logs be stored outside India?
CERT-In's FAQs indicate that logs may be stored outside India as long as the obligation to produce them is met and a copy is maintained within India. Check the current FAQs.
Does reporting to our MSSP count as reporting to CERT-In?
No. The report must reach CERT-In through its own channels. Your provider can prepare it.
Sources
- CERT-In — Directions No. 20(3)/2022-CERT-In of 28 April 2022, FAQs and incident reporting
- MeitY — Information Technology Act, 2000
- e-Gazette of India — Jan Vishwas (Amendment of Provisions) Act, 2023
- National Physical Laboratory — Indian Standard Time
