Since April 2022, CERT-In’s directions have required organisations to report specified cyber incidents within 6 hours of noticing them. Add RBI, SEBI, NPCI and soon DPDP Board reporting, and a fintech may owe several regulators a notice within hours of an incident. Here is a playbook that works.
1. Know what triggers reporting
CERT-In’s list of reportable incidents is broad. It includes targeted scanning, compromise of critical systems, unauthorised access, website defacement, malicious code, data breaches and leaks, attacks on servers, fake mobile apps and attacks on digital payment systems. Pre-classify which of your alert types map to each category so that no one debates it at 2 a.m.
2. Make the clock visible
- Define “noticed” in your policy: the time an analyst confirms the incident is credible
- Start a timer in your ticketing or SOAR tool automatically when that happens
- Keep a single regulator-reporting matrix covering CERT-In (6 hours), RBI or SEBI (per your licence), NPCI (if you are on UPI), and the DPDP Board (once in force)
3. Pre-fill the report
- Keep CERT-In’s incident reporting format pre-populated with organisation details and the point of contact
- Report what you know at six hours, then follow up with updates. An initial report does not need full root cause
4. Have the evidence ready
- Retain logs for 180 days within India, and sync clocks to NIC/NPL NTP sources so timelines hold up
- Cover cloud, SaaS and partner logs, not just on-premises systems
5. Rehearse
- Run a tabletop exercise each quarter: ransomware, a UPI fraud spike, a vendor data leak
- Include legal, communications, customer support and your partner bank, not just the SOC
A practised six-hour process also protects you under DPDP and in front of your regulator, because it shows control even in a bad week.
Practitioner’s guidance, not legal advice. Refer to the CERT-In directions dated 28 April 2022 and the related FAQs.
Leave a Reply