Mandatory cybersecurity directions under Section 70B
The directions issued by the Indian Computer Emergency Response Team (CERT-In) impose binding, non-negotiable legal obligations on all Indian corporate entities, intermediaries, data centers, and system integrators. Failure to comply can result in fines and statutory penal action under Section 70B(7) of the IT Act.
Three critical technical mandates we review
- Mandatory 6-Hour Incident Reporting: Organizations must report any of the 20 specified cybersecurity incidents (including ransomware, data breaches, unauthorized API access, and DDoS attacks) to CERT-In within 6 hours of notice. We establish internal triage playbooks so incidents are identified and escalated immediately.
- 180-Day Log Retention: All system, firewall, network, and application access logs must be maintained securely for rolling period of 180 days within Indian jurisdiction. We configure automated cloud retention policies (e.g. AWS S3 Glacier lifecycle rules) that maintain forensic integrity and prevent unauthorized tampering.
- NTP Clock Synchronization: All servers, databases, and network devices must synchronize their system clocks to designated NTP servers (such as NPL or NIC) to ensure consistent chronological timestamps during forensic investigations.