At a glance
CERT-In is the national agency that collects, analyses and responds to cyber security incidents in India. When a bank, company or government body is hacked or leaks data, CERT-In must be told, issues alerts and advisories, and coordinates the response. It works under the Ministry of Electronics and Information Technology (MeitY).
Key facts
- Set up: 19 January 2004 (operational)
- Ministry: Ministry of Electronics and Information Technology (MeitY)
- Legal basis: Section 70B of the Information Technology Act, 2000 (inserted by the IT (Amendment) Act, 2008)
- Role: national nodal agency for incident response
- Director General: Dr. Sanjay Bahl
- Incident reporting rule: specified cyber incidents must be reported to CERT-In within 6 hours of noticing them (directions of 28 April 2022)
- Log retention: ICT system logs to be kept for a rolling 180 days, within India
- Clock sync: systems to be synchronised with NTP servers of the National Informatics Centre or the National Physical Laboratory
- Botnet cleaning: Cyber Swachhta Kendra, launched 21 February 2017
- Penalty for not complying with CERT-In directions (Section 70B(7)): imprisonment up to 1 year, or fine up to ₹1 lakh, or both
How it works
Under Section 70B(4), CERT-In's functions are to:
- collect, analyse and spread information on cyber incidents;
- issue forecasts and alerts of cyber security incidents;
- take emergency measures to handle incidents;
- coordinate incident response activities;
- issue guidelines, advisories and vulnerability notes on information security practices;
- perform other functions relating to cyber security as prescribed.
It can call for information from service providers, intermediaries, data centres and companies, and it empanels private security auditors. Sectoral CERTs (for example in finance and power) report up to CERT-In.
| Body | Law | Under | Job |
|---|---|---|---|
| CERT-In | Section 70B, IT Act | MeitY | Incident response for all of India's cyberspace |
| NCIIPC | Section 70A, IT Act | NTRO (National Technical Research Organisation) | Protects critical information infrastructure (power, banking, telecom, etc.) |
| I4C | Central scheme (approved 2018) | Ministry of Home Affairs | Cyber crime coordination; runs the 1930 helpline and cybercrime.gov.in |
| Data Protection Board | DPDP Act, 2023 | MeitY | Adjudicates personal data breaches and imposes penalties |
Timeline
- 2004: CERT-In begins operations (19 January)
- 2008: IT (Amendment) Act gives CERT-In statutory status under Section 70B
- 2017: Cyber Swachhta Kendra launched
- 2022: Directions on six-hour incident reporting and log retention (28 April), in effect from June 2022
Exam traps
- CERT-In is under Section 70B; NCIIPC is under Section 70A.
- CERT-In works under MeitY, not the Ministry of Home Affairs (I4C is under MHA).
- The six-hour reporting window is CERT-In's rule; it is separate from breach-notice duties under the DPDP Act, 2023.
- CERT-In responds to incidents; it does not prosecute cyber crime, which is police work.
- The cyber crime helpline 1930 is run by I4C, not CERT-In.
Quick check
- Q: Under which section of the IT Act does CERT-In function? A: Section 70B.
- Q: Within how many hours must specified cyber incidents be reported to CERT-In? A: Six hours.
- Q: Which agency protects critical information infrastructure? A: NCIIPC, under the NTRO.
In the news
Every time this topic has appeared in our current affairs, newest first:
- 26 October 2026SBI confirms 3,897 customer records leaked on the dark web