Instrument 25 | D. CERT-In / Cybersecurity / AI Security

DIRECTIONIN FORCE

CERT-In Directions under Section 70B of the IT Act, 2000 - 28 April 2022

CERT-In under Section 70B(6) IT Act2022Technology

Drafting guides: Information Technology and Cyber Security Policy · Incident Response Policy · Personal Data Breach Notification SOP

AI / PRIVACY / CYBER RELEVANCE

Directly relevant to AI infrastructure when incidents involve AI systems, APIs, cloud infrastructure or other reportable ICT systems.

AI: HighPrivacy: HighCybersecurity: Very High

READ FIRST

  • 6-hour incident reporting
  • 180-day ICT-log retention within India
  • CERT-In directions under Section 70B(6)

PURVIEW

Sets mandatory directions issued by CERT-In under Section 70B of the IT Act for cyber incident response and information-security visibility. For AI, it is highly relevant because AI infrastructure, LLM services, model APIs, cloud systems and AI-enabled applications can generate or amplify security incidents that trigger reporting and investigation requirements. The Directions therefore form a practical cybersecurity baseline for AI operators: organisations must be able to detect incidents, preserve relevant records, report qualifying events and maintain the operational capability needed for rapid response.

Classification and legal status. Binding statutory directions on entities in scope.

RELATED LINKS

Information Technology Act, 2000 - UpdatedProvides the principal statutory foundation for India’s regulation of information technology...CERT-In Advisory - Security Implications of AI Language-Based Applications, 9 May 2023Addresses the specific security implications of AI language-based applications, including risks...CERT-In - Guidelines for Secure Application Design, Development, Implementation & Operations - Version 1.1Provides lifecycle-oriented secure-application practices covering design, development...Digital Personal Data Protection Rules, 2025 - Final RulesProvides the practical rules needed to implement the DPDP Act.IRDAI - Circular on Cyber Incident or Crisis Preparedness, 2025Reiterates the cyber-incident provisions of the IRDAI Information and Cyber Security...IFSCA - Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs (10 March 2025)Sets a proportionate cyber-security and resilience framework for IFSCA-regulated entities from...IFSCA - Guidelines on Cyber Security and Cyber Resilience for Market Infrastructure Institutions (MIIs) in IFSC (20 April 2026)Builds a more granular, prescriptive cyber framework on top of the March 2025 baseline for...PFRDA - Information and Cybersecurity Policy Guidelines, 2024 for Intermediaries / Regulated EntitiesLays down the information and cybersecurity policy framework for pension-sector intermediaries...IRDAI - Information and Cyber Security Guidelines, 2026 (covering circular)Issues revised Information and Cyber Security Guidelines, 2026, replacing the 2023 Guidelines...
Open document Download PDF Copyright remains with the publishing authority. For informational purposes only.

Read the official document

This browser cannot display the PDF in the page. Open the document or download the PDF.

Keywords

incident reporting6 hourslog retentionSection 70BCERT-In directions

Source note

CERT-In official Directions page and uploaded Gazette-style PDF verified.

Legal status indicates whether this resource is legislation, delegated regulation, regulatory direction, guidance, policy, research or technical material. Inclusion in this library does not by itself make a document legally binding.

This tool provides research navigation only and does not constitute legal advice or a determination of legal applicability.

Back to the framework library