CERT-In Directions 2022
CERT-In 6-Hour Reporting Clock
How much of the mandatory 6-hour CERT-In incident reporting window do you have left?
How this is calculated
- Time left = 6 hours minus the hours since you noticed the incident or it was brought to your notice (CERT-In Directions of 28 April 2022, clause (ii)).
- If that is zero or less, the tool shows how far past the deadline you are. If you have already reported, it switches to the follow-up duties instead.
- Colour: 1 hour or less left is red, up to 3 hours amber, more than 3 hours green; past the deadline is red.
- The incident type only labels the result: every type in Annexure I of the Directions (20 in total, condensed to 10 here) has the same 6-hour window.
Worked example
The calculator run on its default inputs:
- Hours since you noticed the incident
- 1 hours
- Incident type
- Unauthorized access to systems / data
- Already reported to CERT-In
- No
Report to CERT-In before the clock runs out
5h 00m left
- Incident type
- unauthorized access
- Elapsed since detection
- 1h 00m
- Time left in 6-hour window
- 5h 00m
With the defaults (an unauthorised-access incident noticed 1 hour ago, not yet reported) the tool returns 5h 00m left, in green because more than 3 hours remain.
Sources
- CERT-In Directions under s.70B(6) of the IT Act, 28 April 2022 - 6-hour reporting (clause (ii)), 180-day logs (clause (iv)), the 20 incident types in Annexure I, reporting channels
- CERT-In FAQs on the Cyber Security Directions (May 2022) - report what is known within 6 hours and add details later; where logs may be stored
Sources last checked September 2026.
Limitations
The clock covers the incident types in Annexure I and the entities the Directions name (service providers, intermediaries, data centres, body corporates and government organisations). Sector regulators such as RBI and SEBI run their own reporting clocks, and the DPDP Rules add a separate report to the Data Protection Board for personal data breaches from 13 May 2027. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.