Report covered cyber incidents within 6 hours and keep logs for 180 days.
Incident clocks · log evidenceSolutions · India compliance
06:00:00left to report this incident to CERT-In. This clock is live.
Built for India. Ready for everywhere.
CERT-In's 6-hour reporting rule, the DPDP Act's rights and consent duties, sector overlays for RBI, SEBI and IRDAI, and data residency by asset, all built into the product rather than added later.
Your sector
Pick your sector to see what applies
Every Indian company faces CERT-In and DPDP. Regulated sectors add their regulator's framework on top.
Banking & NBFCs
RBI Cyber Security Framework
- Board-approved cyber security policy
- Continuous surveillance and SOC
- Incident reporting to the RBI
- User awareness for staff and customers
Capital markets
SEBI CSCRF
- Governance and risk management
- Cyber resilience and recovery
- Audit and reporting cadence
- Third-party risk
Insurance
IRDAI guidelines
- Information security policy
- Data protection and privacy
- Incident handling
- Vendor oversight
Technology & SaaS
CERT-In and DPDP
- 6-hour incident reporting
- Log retention and time sync
- Consent and rights register
- Data residency by asset
CERT-In in practice
From the first alert to a report on time
The 2022 directions give six hours to report covered incidents. CompliLens turns that into a workflow, not a scramble.
1DetectAn alert, a report-button click or a connector finding.
2ClassifyCheck against the CERT-In reportable categories on the form.
3FlagTick CERT-In. The 6-hour deadline is stamped, once.
4EscalateAlerts fire before and after the deadline to every manager.
5ReportRecord when it was reported. The clock stops.
6FixRoot cause, CAPA and an effectiveness check.
Incident types that start the 6-hour clock
Targeted scanning of critical systems
Compromise of critical systems or data
Unauthorised access to IT systems or data
Website defacement
Malicious code, including ransomware
Attacks on servers and network devices
Identity theft, spoofing and phishing
Denial-of-service attacks
Attacks on critical infrastructure
Data breach
Data leak
Attacks on cloud and IoT systems
Reference list for planning, paraphrased from CERT-In's 2022 directions. Confirm obligations with your legal team.
Who you answer to
Five authorities, one place to track them
Most Indian companies answer to two of these. Regulated sectors answer to three or more, often for the same incident.
Personal data breaches are notified to the Board and affected people. Grievances can escalate here.
Breach flag · rights registerA board-approved cyber security policy, continuous monitoring and incident reporting to the RBI.
RBI overlay · vendor registerThe CSCRF framework: governance, resilience, audit cadence and third-party risk.
SEBI overlay · audit programmeInformation and cyber security guidelines, data protection and vendor oversight.
IRDAI overlay · access reviewsSummaries are paraphrased for planning. Confirm obligations with your legal team.
DPDP Act
Rights and consent, run as registers
Data principals can ask to access, correct or erase their data, or raise a grievance. Each request gets a due date the moment it is logged, and consent is tracked from first yes to withdrawal.
Access
Tell the person what you hold and why.
Correction
Fix inaccurate or incomplete data.
Erasure
Delete it, and record the disposition with evidence.
Grievance
Resolve a complaint about how data was handled.
Consent register
Purpose, channel, date given and date withdrawn, for every data principal.
Processor DPAs
Which vendors process personal data and whether a DPA is signed.
Training
A DPDP lesson for every employee, with completion as evidence.
Response windows are reference values for planning, not legal advice.
Data residency
Know where every asset's data lives
Mark each asset as India, offshore, mixed or not applicable, then filter the register to answer a regulator's or customer's residency question in seconds.
18India
6Offshore
3Mixed
1Not applicable
Questions
India compliance, answered
Does CompliLens report to CERT-In for us?
No. CompliLens tracks the deadline, escalates as it approaches and records when you reported. The report itself is made by your team through CERT-In's channels.
Can one incident run CERT-In and GDPR clocks together?
Yes. Flag it under each regime that applies, and each runs its own deadline and reminders.
Are RBI, SEBI and IRDAI frameworks included?
Yes, as opt-in overlays. Turn on the ones that apply and map your existing controls to them.
Is the regulatory content legal advice?
No. It is paraphrased reference material for readiness. Confirm obligations with your legal team.