CERT-In directions for hosting and VPS users
CERT-In’s directions of 28 April 2022 require covered organisations to report listed cyber incidents within six hours, keep ICT logs for 180 days in India, and sync clocks to NIC or NPL time. VPS, cloud and data-centre providers must also keep validated customer KYC records for five years after the service ends.
For Indian businesses running websites on VPS, cloud or shared hosting who need to know which CERT-In duties are theirs and which are the host’s.
knowledge
- Read time
- 4 min
- Sections
- 6
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What are the CERT-In directions of April 2022?
They are binding directions issued by CERT-In on 28 April 2022 under section 70B(6) of the Information Technology Act, 2000, covering incident reporting, log retention, clock synchronisation and customer records. CERT-In, the Indian Computer Emergency Response Team, is the national incident-response agency under the Ministry of Electronics and Information Technology (MeitY).
| Obligation | Requirement | Applies to |
|---|---|---|
| Incident reporting | Report listed incidents to CERT-In within 6 hours of noticing them or being told | All covered entities |
| Log retention | Keep logs of all ICT systems for a rolling 180 days, within Indian jurisdiction | All covered entities |
| Clock sync | Synchronise system clocks with NTP servers of NIC or NPL, or traceable to them | All covered entities |
| Point of contact | Designate a contact for CERT-In and share the details | All covered entities |
| Customer records | Keep validated subscriber details for 5 years after the service ends | Data centres, VPS, cloud and VPN providers |
The directions name service providers, intermediaries, data centres, body corporates and government organisations. Read the full text on the CERT-In website; where this summary differs, the official text applies.
Do the CERT-In rules apply to you as a hosting customer?
Partly: your hosting provider carries the KYC and infrastructure-log duties, but if your business runs its own VPS or cloud server it is usually a body corporate with its own reporting and log duties for that system. The provider cannot report incidents inside an application only you control.
| Duty | Hosting provider | Your business |
|---|---|---|
| Subscriber KYC records | Yes | Provide accurate details |
| Network and platform logs | Yes, for its infrastructure | No |
| Server, web and application logs | No access on an unmanaged VPS | Yes, keep 180 days in India |
| Clock sync on your server | Default image may set it | Confirm it points to NIC/NPL |
| Reporting an incident on your site | Only what it detects on its network | Yes, within 6 hours |
Shared hosting customers depend on the provider for most logs, but still hold their own application records, such as admin logins and order data.
What KYC details must VPS and cloud providers keep?
Data centre, VPS, cloud and VPN providers must record validated customer details and keep them for five years after the account is closed, or longer if another law requires. That is why an Indian host asks for identity and contact verification before activating a server.
- Validated name of the subscriber or customer hiring the service.
- Period of hire, including dates.
- IP addresses allotted to, and being used by, the customer.
- Email address, IP address and time stamp used at registration.
- Purpose for hiring the services.
- Validated address and contact numbers.
- Ownership pattern of the subscriber or customer.
Keep your account details current: a stale phone number or address can delay verification when you add servers or IPs later.
How should you keep 180 days of server logs in India?
Enable logging on every system you run, keep at least 180 days on storage located in India, and protect the copies from tampering. The directions require logs to be provided to CERT-In when asked, along with an incident report.
- What to keep: web server access and error logs, SSH and panel logins, firewall and mail logs, and application audit logs such as admin actions.
- Rotation: logrotate defaults often keep only a few weeks. Set
rotateand the frequency so 180 days survive, or ship logs to separate storage. - Location: a copy on a laptop or a foreign SaaS log service does not meet the “within Indian jurisdiction” requirement on its own.
- Backups: store archived logs off the server too; server backup solutions cover that.
To read the files themselves, see Apache log files explained.
How do you sync a server clock with NIC or NPL time?
Point your server’s NTP client at the National Informatics Centre (NIC) or National Physical Laboratory (NPL) time servers, so log timestamps can be correlated across systems. On most current Linux servers the client is chrony.
# /etc/chrony/chrony.conf (Debian/Ubuntu) or /etc/chrony.conf (RHEL family)
server samay1.nic.in iburst
server samay2.nic.in iburst
server time.nplindia.org iburst
sudo systemctl restart chrony # service is "chronyd" on RHEL/AlmaLinux
chronyc sources -v # confirm the servers are reachable
timedatectl # "System clock synchronized: yes"Comment out any default pool lines if you want only Indian sources. Windows servers can be pointed at the same hosts with w32tm /config /manualpeerlist:"samay1.nic.in" /syncfromflags:manual /update.
Which incidents must be reported to CERT-In within six hours?
Annexure I of the directions lists the reportable incident types, from targeted scanning and unauthorised access to website defacement, ransomware, data breaches and attacks on cloud systems. The six hours start when you notice the incident or are told about it.
| Group | Examples |
|---|---|
| Access and compromise | Targeted scanning or probing of critical systems; compromise of critical systems; unauthorised access to IT systems or data |
| Website and server | Defacement or intrusion into a website; attacks on database, mail or DNS servers and network devices |
| Malware | Viruses, worms, trojans, bots, spyware, ransomware and cryptominers |
| Fraud | Identity theft, spoofing and phishing; fake or malicious mobile apps; unauthorised access to social media accounts |
| Availability | Denial of service and distributed denial of service attacks |
| Data | Data breach and data leak |
| Platforms | Attacks on cloud computing systems, digital payment systems, IoT devices, e-commerce and e-governance applications |
Reports go to CERT-In by email or through its incident reporting page using the format on the CERT-In site. A short initial report within six hours can be followed by details later. Prevention still matters more; how to check a website for vulnerabilities and common website security threats are good starting points.
What should you ask an Indian hosting provider about CERT-In?
Ask where its logs are stored, how long they are kept, how incidents on its network are reported, and what it needs from you during KYC. A provider’s compliance covers its infrastructure, not your application.
- Are platform and network logs kept for 180 days within India?
- Which logs can you give me if CERT-In asks about my server?
- Do your server images sync time to NIC or NPL?
- Who contacts me if you detect an attack on my server, and how fast?
Use these questions when comparing VPS hosting or cloud hosting plans, including WebJi®’s. This article is a summary, not a CERT-In certificate or legal advice. Personal-data duties are separate, under the DPDP Act; see DPDP compliance and data localisation in India.
Frequently asked questions
What is the penalty for not following CERT-In directions?
Section 70B(7) of the IT Act provides that a service provider, intermediary, data centre, body corporate or person who fails to provide information or comply with a direction may be punished with imprisonment of up to one year, a fine of up to ₹1 lakh, or both.
When did the CERT-In directions take effect?
They were issued on 28 April 2022 and took effect 60 days later, on 27 June 2022. CERT-In later extended the deadline for micro, small and medium enterprises and for the data centre, VPS, cloud and VPN customer-validation requirement to 25 September 2022.
Does a small website on shared hosting need to report incidents?
If the site belongs to a company or other body corporate and suffers a listed incident, such as defacement or a data breach, the directions expect a report. Tell your host at once too, since the same attack may affect its systems and it holds the server logs.
Do the directions require data to be stored in India?
Only the ICT system logs must be kept within Indian jurisdiction. The directions do not require your website files or customer database to be hosted in India; sector rules such as RBI’s payment data storage rule and the DPDP Act deal with where other data may sit.
Summarised from the CERT-In directions of 28 April 2022; checked 14 November 2026 · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.