India’s cyber regulator, CERT-In, requires entities to report specified cyber incidents within 6 hours of noticing them and to keep ICT logs for a rolling 180 days, under Directions issued on 28 April 2022. Its own FAQ says the directions apply to “any entity whatsoever” in the matter of cyber incidents. If your security or compliance startup gives a remote intern in India access to logs, tickets or customer systems, that sentence is worth reading before day one. This is not legal advice, and the regulator’s FAQ is not a court ruling.
Key takeaways
- The Directions require reporting listed incidents to CERT-In within 6 hours of noticing them or being told about them.
- Logs of all ICT systems must be kept securely for a rolling 180 days within Indian jurisdiction; CERT-In’s FAQ allows storage abroad if logs can be produced in a reasonable time.
- The FAQ says the Directions apply to any entity in the matter of cyber incidents; whether that reaches a given US company is a question for counsel.
- The practical lever for a founder is who can see what: an intern with narrow access creates a narrow incident.
What the Directions say, in the regulator’s words
The Directions bind “service providers, intermediaries, data centres, body corporate and Government organisations”. They require clocks to sync to NIC or NPL time servers, a designated Point of Contact for CERT-In, and mandatory reporting of the incident types in Annexure I. That annexure includes unauthorised access of IT systems or data, data breaches, data leaks, ransomware and phishing. The FAQ (question 30) narrows the 6-hour expectation to listed incidents meeting set criteria, data breaches and data leaks among them, and lets an entity report what it knows at the time and add the rest later.
“Body corporate” is explained in the FAQ through section 43A of the IT Act as “any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities”. In plain terms, a small startup is not carved out by size.
The part founders miss: the FAQ on foreign firms
CERT-In asked itself whether the Directions apply only to Indian companies or also to foreign firms serving Indian customers. The answer, in FAQ question 26, points to sections 1 and 75 of the IT Act and states that the Directions are “applicable to any entity whatsoever, in the matter of cyber incidents and cyber security incidents”. On the Point of Contact duty, the FAQ speaks of entities “offering services to the users in the country”.
Read that carefully. It does not say a US startup with one remote intern is a regulated Indian service provider, and it does not say it is not. An incident involving a person or system in India is the case where the reporting clock is most likely to matter. If you handle security, compliance or audit data, that is where a lawyer earns the fee.
Why this lands on interns specifically
Interns do the work these Directions care about: triaging logs, writing scripts, mapping controls. The clock starts when someone “notices” an incident, and a junior who sees something odd on a Friday evening may be the first person to notice. A 6-hour clock makes escalation a matter of habit, not discretion.
A playbook for the first week
- Decide the incident path in writing. Name who the intern tells, by what channel, and that telling is never punished, even if it is a false alarm.
- Scope access to the task. Read-only to a log sample before any production console; no shared admin credentials. See our note on codebase access for remote interns.
- Know where your logs live. Check that 180-day retention and the ability to produce logs quickly hold for the systems the intern touches.
- Ask counsel whether you need a CERT-In Point of Contact, and name one if so.
- Write down the intern’s AI-tool rules so no log or customer data is pasted into a public tool; see the AI-tool policy post.
- Rehearse once. Run a 20-minute tabletop exercise with the intern in the first two weeks.
Where Tierones fits
Tierones connects startups with students from IITs, NITs and IIITs who show proof of work: real commits, shipped projects and a code walkthrough. We do not provide legal or compliance advice and do not claim any placement in this industry. What we can do is show you the work a student has actually done before you decide what access they should get. See the employers page.
FAQ
Do the CERT-In directions apply to a US startup with no Indian entity?
CERT-In’s own FAQ says the directions are applicable to any entity whatsoever in the matter of cyber incidents and cyber security incidents, and refers to sections 1 and 75 of the IT Act. That is the regulator’s reading, not a court ruling, so ask counsel how it applies to your company.
How quickly must a cyber incident be reported?
The directions require reporting the incident types listed in their Annexure I to CERT-In within 6 hours of noticing the incident or being told about it. Unauthorised access to IT systems or data, data breaches and data leaks are on that list.
Where do logs have to be kept?
The directions require logs of all ICT systems to be maintained securely for a rolling 180 days within Indian jurisdiction. CERT-In’s FAQ adds that logs may be stored outside India as long as they can be produced to CERT-In in a reasonable time.
Hiring a security-minded intern? Tell us what you need and we’ll show you proof, not CVs.