Incident Reporting Windows & Penalty Risks

Under MeitY directives, companies must report cyber incidents to CERT-In within 6 hours. We outline the reporting criteria, timeline triggers, and penalty structures.

A security breach is a chaotic event, but regulatory clocks start ticking the moment an anomaly is detected. Section 70B of the IT Act mandates a strict 6-hour reporting window for listed incident classes.

Failing to notify the agency, or attempting to suppress breach details, can result in severe financial penalties, audit blocks, and corporate liability for company directors.

Key Pillars of Assessment

• 6-Hour Notification

  Immediate notification required for listed incidents after discovery.

• Mandatory log records

  Requirement to preserve secure logs within India for regulatory audit.

• IT Act Section 70B

  The legal foundation governing incident compliance and penalties in India.

• Corporate Liability

  Director accountability and legal penalties for compliance failures.

Establishing Incident Incident Response

Staying compliant under high-pressure breach events requires a pre-validated Incident Response (IR) plan. Your team must know how to quickly isolate compromised networks, gather forensic evidence, and draft the report for CERT-In.

We help organizations audit their IR readiness, establish automated alert filters for listed incident classes, and design logging architectures that satisfy MeitY requirements.

• Drafting clear reporting pathways for internal security teams.
• Conducting mock incident table-top simulations with managers.
• Auditing security logs for compliance with the 180-day retention rules.

Defend Your Digital Assets

Proactive compliance reduces breach damages and protects against legal liabilities. Secure your infrastructure, define reporting roles, and maintain compliance readiness with our certified advisory teams.