CERT-In's 6-hour rule: what counts as detection?

On 28 April 2022, CERT-In, India's national cyber incident response agency, issued Directions under section 70B(6) of the IT Act. The best-known line is short: covered cyber incidents must be reported to CERT-In within 6 hours. The detail that matters most is when those 6 hours start.

The clock starts when you notice

The Directions say incidents must be reported within 6 hours of noticing them, or of being brought to notice about them. The clock doesn't start when the attacker got in. It starts when you, or someone who tells you, becomes aware.

That can sound like good news: if you don't notice, the clock doesn't run. It isn't. An attacker who goes unnoticed has more time to move around, copy data and cause damage, and IBM's 2025 research puts the global average time to identify a breach at 181 days. When you finally notice, you face both a 6-hour deadline and months of damage to explain.

Which incidents count

The Directions list the types of incident that must be reported. The list is broad. It includes, among others:

• Targeted scanning or probing of critical networks and systems
• Compromise of critical systems or information
• Unauthorised access to IT systems or data
• Malicious code attacks, including ransomware
• Data breaches and data leaks
• Identity theft, spoofing and phishing attacks

Scanning and probing are on the list. So a company that watches its network closely will often find reportable activity, and needs a fast way to decide whether each event is one.

"Partial information is acceptable"

CERT-In's published FAQs on the Directions address what happens when you don't yet know the full picture. You report what you know within 6 hours, and send the remaining details later. The aim is early warning, not a complete forensic account.

That changes what "being ready" means. You don't need an investigation finished in 6 hours. You need three things: to notice quickly, to decide quickly whether the incident is reportable, and to send a clear first report with what you already know.

Why fast, confirmed detection is the whole game

Most alerting tools are noisy. If a team gets hundreds of alerts a day, each one has to be triaged before anyone knows whether the 6-hour clock is running. Confirmed signals, such as a decoy that no legitimate user ever touches, cut that step short: the alert itself is the evidence that something is wrong.