Indian Computer Emergency Response Team Direction: Paradigm Shift in Cyber Incident Reporting

Ø  

When does the Direction come into effect?

The Direction is to come into effect after 60 (sixty) days following the date of its issuance.

Ø  

Reporting of cyber incidents

Certain specified types of cyber incidents (such as targeted scanning/probing of critical networks/systems, compromise of critical systems/information, unauthorised access of IT systems/data etc) as identified under Annexure I of the Direction are to be mandatorily reported to CERT-In by service providers, intermediaries, data centres, body corporates and government organisations (Covered Entities), within 6 (six) hours of noticing such incidents or being brought to notice about such incident. Notably, some of the cyber incidents (such as data breach, data leak, attacks on internet of things (IoT) devices and associated systems etc) that are to be mandatorily reported, are in addition to those set out under the Information Technology (the Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules 2013 (Rules) issued under the IT Act.

Ø  

Synchronisation of information and communication technology (ICT) system clocks

All Covered Entities are required to connect to the Network Time Protocol (NTP) Server of National Informatics Centre (NIC) or National Physical Laboratory (NPL) or with NTP servers traceable to these NTP servers, for synchronisation of all their ICT systems clocks.

Entities having ICT infrastructure spanning across multiple geographies may also use accurate and standard time source other than NPL and NIC, however it is to be ensured that their time source shall not deviate from NPL and NIC.

Ø  

Enabling and retention of logs

All Covered Entities are to mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 (one hundred and eighty) days within Indian jurisdiction. These should be provided to CERT-In along with reporting of any incident or when ordered or directed by CERT-In.

Ø  

Retention of Information by data centres, virtual private server providers, cloud service providers and virtual private network service providers

Data centres, virtual private server providers, cloud service providers and virtual private network service providers are required to register the following information accurately: (i) validated names of subscribers/customers hiring the services; (ii) period of hire including dates; (iii) IPs allotted to/used by the members; (iv) email address and IP address and time stamp used at the time of registration/on-boarding; (v) purpose for hiring services; (vi) validated address and contact numbers; (vii) ownership pattern of the subscribers/customers hiring services.

The above-mentioned information is required to be maintained for a period of 5 (five) years or longer duration, as mandated by the law, after any cancellation or withdrawal of the registration (as the case maybe).

Ø  

Compliances for the virtual assets industry

Virtual asset service providers, virtual asset exchange providers and custodian wallet providers are to mandatorily maintain records of the following, for 5 (five) years:

§      

All information obtained during the process of conducting Know Your Customer (KYC) for users; and

§      

Records of financial transactions, including information relating to the identification of the relevant parties involved in the transactions such as IP addresses, along with timestamps and time zones, transaction ID, the public keys (or equivalent identifiers), addresses or accounts involved (or equivalent identifiers), the nature and date of the transactions, and the amounts transferred.

Ø  

Information regarding appointment of Point of Contact

The format in which information about the appointment of a point of contact needs to be conveyed to the CERT-In by the Covered Entities has been provided through the Direction.

Ø  

Penalty for non-compliance

Any failure to furnish the information as required under the Direction or any non-compliance with the same may invite punitive action under Section 70-B(7) of the IT Act and other laws, as applicable. Section 70-B(7) of the IT Act provides for punishment with imprisonment for a term which may extend to 1 (one) year or with fine which may extend to INR 100,000 (Indian Rupees One Hundred Thousand) or with both.