Official sources for cybersecurity buyers in India: CERT-In, MeitY, e-Gazette, regulators and reporting portals

The rules that shape managed security in India are published by a handful of official bodies: CERT-In for incident reporting, logging directions and empanelled auditors; MeitY and the e-Gazette for the IT Act, the DPDP Act and the DPDP Rules; RBI, SEBI and IRDAI for regulated sectors; CBIC and the Income Tax Department for GST and TDS; and the National Cyber Crime Reporting Portal for police complaints. This guide lists each source, what to check there and how to use it, and belongs to why managed security engagements fail. Homepage links only; navigate from there because deep links change.

Cyber security and incident reporting

Source	What to check	When
CERT-In	Directions of 28 April 2022 and FAQs, incident reporting formats and contacts, list of empanelled auditors, Comprehensive Cyber Security Audit Policy Guidelines (July 2025), advisories and vulnerability notes	Before signing a managed service contract; during an incident; when choosing a VAPT auditor
NCIIPC	Guidance for critical information infrastructure	If you operate or supply critical sectors
Cyber Swachhta Kendra	Botnet cleaning and malware analysis resources run under CERT-In	Cleaning infected devices
National Cyber Crime Reporting Portal	Reporting cyber crime, including financial fraud; helpline 1930 for financial cyber fraud	After fraud or extortion, alongside CERT-In reporting

Laws and rules

Source	What to check	Notes
MeitY	IT Act, 2000; DPDP Act, 2023; DPDP Rules, 2025; consultations	Some pages need JavaScript or block automated access; the e-Gazette carries the authoritative text
e-Gazette of India	Official notifications: DPDP Rules G.S.R. 846(E) and DPDP commencement notification G.S.R. 843(E) (both 13 November 2025), Jan Vishwas (Amendment of Provisions) Act, 2023 and the S.O. 4745(E) bringing its IT Act changes into force on 30 November 2023	Use the search by ministry and date
India Code	Consolidated text of central Acts	Check amendment notes; consolidated text may lag
Data Protection Board of India	Board functioning and procedures under the DPDP framework	Find its current web address and filing route through MeitY

What to look for in the CERT-In Directions

The list of reportable incidents in the annex.
The six-hour reporting duty and the reporting channels.
Log retention of 180 days within Indian jurisdiction.
NTP synchronisation requirements.
Point-of-contact requirements and format.
Additional duties for data centres, cloud, VPS and VPN providers.

Our summary is in the CERT-In Directions guide.

Sector regulators

Regulator	What to check
RBI	Entity-wise Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions (July 2026) and Managing Risks in Outsourcing Directions (November 2025), which replaced the 2023 IT governance and IT outsourcing master directions for the entities they cover; incident reporting to RBI
SEBI	Cybersecurity and Cyber Resilience Framework (CSCRF) and later clarifications
IRDAI	Information and cyber security guidelines; insurer registration for cyber policies

Summary in RBI, SEBI and IRDAI rules in brief.

Tax

Source	What to check
CBIC GST	GST rates, reverse charge on import of services, OIDAR, input tax credit
GST Council	Rate decisions and meeting recommendations
Income Tax Department	Income-tax Act, 2025; TDS under section 393

Summary in GST, TDS and dollar pricing.

Standards and MSME support

Source	What to check
Bureau of Indian Standards	Indian adoption of information security standards
Ministry of MSME	MSME classification and schemes that may support technology upgrades
Udyam Registration	MSME registration

How to use official sources well

Read the date on every circular or FAQ and look for later amendments.
Prefer the Gazette for legal text; a press release is not the rule.
Check applicability: definitions decide whether you are covered.
Keep a copy of the version you relied on with the date you checked.
Ask a professional where money or liability depends on interpretation.

A yearly source-check routine

Rules in this area change every year or two. A light routine keeps your contracts current:

Each April, open the CERT-In site and check for new directions, FAQs or audit guidelines, and note the date you checked.
Before each contract renewal, check the e-Gazette and MeitY for DPDP commencement or amendment notifications, especially before 13 May 2027.
When your regulator publishes a circular, ask your provider in writing how it affects the service.
After each GST Council meeting, check whether any change affects services or imports of services.
Each year, confirm that your VAPT auditor is still on CERT-In's empanelled list.

Keep a one-page log of what you checked and when. It is useful evidence for auditors, insurers and customers.

During an incident: who to contact

Situation	Contact
Specified cyber incident	CERT-In within 6 hours, via its reporting channels
Financial fraud or extortion	Police via the cyber crime portal or helpline 1930; your bank
Personal data breach (from 13 May 2027)	Affected data principals and the Data Protection Board under the DPDP Rules
Regulated entity	Your regulator under its own rules
Insured business	Your insurer, as the policy requires
Managed security provider	Your provider's hotline, per the escalation matrix

FAQ

Why do some official sites not load?

Government sites sometimes block automated access or need JavaScript. Try later or use the e-Gazette for legal texts.

Is a law firm's summary enough?

It is a good starting point for interpretation, but check the official text and its date.

Where do we find CERT-In empanelled auditors?

On the CERT-In website, which publishes the current list. Check the auditor's empanelment status on the date you sign.

Sources

CERT-In — Directions, FAQs, empanelled auditors, audit guidelines
MeitY — IT Act, DPDP Act and Rules
e-Gazette of India — official notifications
National Cyber Crime Reporting Portal — reporting cyber crime