{"id":365,"date":"2026-10-26T19:32:16","date_gmt":"2026-10-26T14:02:16","guid":{"rendered":"https:\/\/tierones.io\/blog\/?p=365"},"modified":"2026-10-26T19:32:17","modified_gmt":"2026-10-26T14:02:17","slug":"cert-in-rules-remote-intern-security-startup","status":"publish","type":"post","link":"https:\/\/tierones.io\/blog\/cert-in-rules-remote-intern-security-startup\/","title":{"rendered":"India Gives Security Teams 6 Hours to Report an Incident. What That Means Before a Remote Intern Touches Your Logs."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">India\u2019s cyber regulator, CERT-In, requires entities to report specified cyber incidents <strong>within 6 hours<\/strong> of noticing them and to keep ICT logs for a rolling 180 days, under <a href=\"https:\/\/www.cert-in.org.in\/PDF\/CERT-In_Directions_70B_28.04.2022.pdf\" rel=\"nofollow noopener\" target=\"_blank\">Directions issued on 28 April 2022<\/a>. Its own <a href=\"https:\/\/www.cert-in.org.in\/PDF\/FAQs_on_CyberSecurityDirections_May2022.pdf\" rel=\"nofollow noopener\" target=\"_blank\">FAQ<\/a> says the directions apply to \u201cany entity whatsoever\u201d in the matter of cyber incidents. If your security or compliance startup gives a remote intern in India access to logs, tickets or customer systems, that sentence is worth reading before day one. This is not legal advice, and the regulator\u2019s FAQ is not a court ruling.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The Directions require reporting listed incidents to CERT-In within 6 hours of noticing them or being told about them.<\/li>\n\n\n\n<li>Logs of all ICT systems must be kept securely for a rolling 180 days within Indian jurisdiction; CERT-In\u2019s FAQ allows storage abroad if logs can be produced in a reasonable time.<\/li>\n\n\n\n<li>The FAQ says the Directions apply to any entity in the matter of cyber incidents; whether that reaches a given US company is a question for counsel.<\/li>\n\n\n\n<li>The practical lever for a founder is who can see what: an intern with narrow access creates a narrow incident.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What the Directions say, in the regulator\u2019s words<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Directions bind \u201cservice providers, intermediaries, data centres, body corporate and Government organisations\u201d. They require clocks to sync to NIC or NPL time servers, a designated Point of Contact for CERT-In, and mandatory reporting of the incident types in Annexure I. That annexure includes unauthorised access of IT systems or data, data breaches, data leaks, ransomware and phishing. The FAQ (question 30) narrows the 6-hour expectation to listed incidents meeting set criteria, data breaches and data leaks among them, and lets an entity report what it knows at the time and add the rest later.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cBody corporate\u201d is explained in the FAQ through section 43A of the IT Act as \u201cany company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities\u201d. In plain terms, a small startup is not carved out by size.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/10\/cert-in-intern-access-scope-opt-1024x576.jpg\" alt=\"cert-in-intern-access-scope\" class=\"wp-image-370\" srcset=\"https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/10\/cert-in-intern-access-scope-opt-1024x576.jpg 1024w, https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/10\/cert-in-intern-access-scope-opt-300x169.jpg 300w, https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/10\/cert-in-intern-access-scope-opt-768x432.jpg 768w, https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/10\/cert-in-intern-access-scope-opt-1536x864.jpg 1536w, https:\/\/tierones.io\/blog\/wp-content\/uploads\/2026\/10\/cert-in-intern-access-scope-opt.jpg 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">The part founders miss: the FAQ on foreign firms<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CERT-In asked itself whether the Directions apply only to Indian companies or also to foreign firms serving Indian customers. The answer, in FAQ question 26, points to sections 1 and 75 of the IT Act and states that the Directions are \u201capplicable to any entity whatsoever, in the matter of cyber incidents and cyber security incidents\u201d. On the Point of Contact duty, the FAQ speaks of entities \u201coffering services to the users in the country\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Read that carefully. It does not say a US startup with one remote intern is a regulated Indian service provider, and it does not say it is not. An incident involving a person or system in India is the case where the reporting clock is most likely to matter. If you handle security, compliance or audit data, that is where a lawyer earns the fee.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why this lands on interns specifically<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Interns do the work these Directions care about: triaging logs, writing scripts, mapping controls. The clock starts when someone \u201cnotices\u201d an incident, and a junior who sees something odd on a Friday evening may be the first person to notice. A 6-hour clock makes escalation a matter of habit, not discretion.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A playbook for the first week<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Decide the incident path in writing.<\/strong> Name who the intern tells, by what channel, and that telling is never punished, even if it is a false alarm.<\/li>\n\n\n\n<li><strong>Scope access to the task.<\/strong> Read-only to a log sample before any production console; no shared admin credentials. See our note on <a href=\"https:\/\/tierones.io\/blog\/remote-intern-codebase-access-security\/\">codebase access for remote interns<\/a>.<\/li>\n\n\n\n<li><strong>Know where your logs live.<\/strong> Check that 180-day retention and the ability to produce logs quickly hold for the systems the intern touches.<\/li>\n\n\n\n<li><strong>Ask counsel whether you need a CERT-In Point of Contact<\/strong>, and name one if so.<\/li>\n\n\n\n<li><strong>Write down the intern\u2019s AI-tool rules<\/strong> so no log or customer data is pasted into a public tool; see <a href=\"https:\/\/tierones.io\/blog\/ai-coding-tool-policy-interns\/\">the AI-tool policy post<\/a>.<\/li>\n\n\n\n<li><strong>Rehearse once.<\/strong> Run a 20-minute tabletop exercise with the intern in the first two weeks.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Where Tierones fits<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Tierones connects startups with students from IITs, NITs and IIITs who show proof of work: real commits, shipped projects and a code walkthrough. We do not provide legal or compliance advice and do not claim any placement in this industry. What we can do is show you the work a student has actually done before you decide what access they should get. See the <a href=\"https:\/\/tierones.io\/employers\">employers page<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Do the CERT-In directions apply to a US startup with no Indian entity?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CERT-In&#8217;s own FAQ says the directions are applicable to any entity whatsoever in the matter of cyber incidents and cyber security incidents, and refers to sections 1 and 75 of the IT Act. That is the regulator&#8217;s reading, not a court ruling, so ask counsel how it applies to your company.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How quickly must a cyber incident be reported?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The directions require reporting the incident types listed in their Annexure I to CERT-In within 6 hours of noticing the incident or being told about it. Unauthorised access to IT systems or data, data breaches and data leaks are on that list.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Where do logs have to be kept?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The directions require logs of all ICT systems to be maintained securely for a rolling 180 days within Indian jurisdiction. CERT-In&#8217;s FAQ adds that logs may be stored outside India as long as they can be produced to CERT-In in a reasonable time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Hiring a security-minded intern? <a href=\"https:\/\/tierones.io\/employers\">Tell us what you need<\/a> and we\u2019ll show you proof, not CVs.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CERT-In requires incident reports within 6 hours and 180 days of logs. What security startups should settle before an Indian intern gets access.<\/p>\n","protected":false},"author":1,"featured_media":369,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[250,246,114,247,248,35,249,231],"class_list":["post-365","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-for-employers","tag-access-control","tag-cert-in","tag-compliance","tag-cybersecurity","tag-incident-reporting","tag-india","tag-log-retention","tag-remote-intern"],"_links":{"self":[{"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/posts\/365","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/comments?post=365"}],"version-history":[{"count":1,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/posts\/365\/revisions"}],"predecessor-version":[{"id":371,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/posts\/365\/revisions\/371"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/media\/369"}],"wp:attachment":[{"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/media?parent=365"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/categories?post=365"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tierones.io\/blog\/wp-json\/wp\/v2\/tags?post=365"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}