Grey Noise | New reporting requirements from Cert-In 70B
Summary: On 28-April-2022, CERT-In issued new directions under sub-section (6) of section 70B of the Information Technology Act, 2000, requiring organizations to report any cyber security incident, including targeted scanning of systems and data breaches, within 6 hours of noticing it, replacing the prior "reasonable time" standard. After a large volume of feedback, CERT-In extended the enforcement deadline from 60 days after issuance to 25-September-2022, though its FAQ responses indicate it is not inclined to adjust the main provisions.
What's compelling: The 6-hour clock applies to service providers, intermediaries, data centers, government entities, corporations, and small and medium businesses alike, and it covers targeted scanning, not just confirmed breaches - so the volume of internet-wide scan noise hitting your perimeter now sits inside a reporting window measured in hours.
Read the original at GreyNoise Blog ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026