The CERT-In 6-Hour Reporting Mandate: Practical Playbook for General Counsel
Balancing statutory disclosure deadlines with incomplete technical forensics: an operational guide to cyber incident triage without forfeiting legal privilege.
The Reality of the Six-Hour Clock
Under the directives issued by the Indian Computer Emergency Response Team (CERT-In) pursuant to Section 70B of the Information Technology Act, mandatory cyber security incidents must be reported to CERT-In within 6 hours of noticing them.
For enterprise legal departments, six hours is an exceptionally tight window. In practice, root-cause forensic analysis often takes days, forcing legal counsel to submit initial notifications based on fragmented telemetry.
Maintaining Legal Professional Privilege
External forensic consultants should be engaged directly through external legal counsel to preserve legal professional privilege over investigative work product. Inadvertent statements in early incident notifications can subsequently be cited by counterparties in commercial damages litigation.
The Incident Triage Protocol
Firms must maintain pre-drafted incident reporting templates and clear internal criteria determining when an anomalous network event crosses the threshold of a 'noticeable cyber incident'.
Ananya Raghavan
Partner — Data Governance & Regulatory Policy
