Indian Government regulations for reporting cyber security incidents on businesses
Society today is largely dependent on technology these days. That is precisely what necessitates more robust cyber security measures. India is undoubtedly one of the huge players and consumers in technological advancements. In tune with this, it is important to understand the different ways India focuses on reporting cyber security incidents. Let us check out the Indian Government regulations for reporting cyber security incidents on businesses.
In today's digital sphere, there is a strong need for cyber security for controlling cyber security incidents. Data breaches, hacking attempts, and other malicious activities can disrupt operations and damage reputations. To combat this, the Indian government has introduced regulations for tackling cyber security. 
Let us now check out the regulations for reporting cybersecurity violations. Constitution of the watchdog - CERT-In
The first step involved in the protection of cyber security lies in the constitution of CERT-In. The Indian Computer Emergency Response Team (CERT-In) is the national agency responsible for cyber security threats and incidents. As per the rules formulated under the Information Technology (IT) Rules, 2013, with some crucial updates implemented in April 2022, businesses should mandatorily report cyber incidents to CERT-In.
This first step was further strengthened by several other developments. These would include Information Technology (IT) Act, 2000, National Cyber Security Policy, 2013, Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) in 2017, Data Protection and Privacy Regulations in 2017, National Critical Information Infrastructure Protection Centre (NCIIPC), Cybersecurity Cooperation and International Engagements, Skill Development Initiatives, and Sector-Specific Regulations. The tight end timeline in reporting cyber security
The new reporting system for cyber security incidents in India on April 28, 2022, has shrunk the deadline for cyber security reporting. Businesses now have to report the cyber security incidents within SIX hours of occurrence to the CERT-In. This action - more swifter than what it was previously - helps the CERT-In to plan a coordinated response, minimizing potential damage and offering valuable assistance during critical moments.
The organizations can send reports of cyber security incidents via email, fax, or phone. Before these regulations were placed, the reporting time was suggested to be "within a reasonable time". The duration has gone considerably lower now. This duration has become shorter than what it is in the EU or the USA. Is there anything beyond the Six hours duration?
After the initial deadline of six hours, there is still a great responsibility on the part of the businesses. Once the initial reports are filed with the CERT-In, businesses need to continue maintaining the logs and detailed investigation. CERT-In will require your information to understand the potential threats to other organizations.
Apart, businesses are also expected to take progressive steps in mitigating the repetition of similar cyber security incidents. They should also ensure that there are measures to prevent similar attacks in the future. Are there sector specific guidelines?
It may be noticed that these guidelines are designed as a baseline. These basic rules apart, there are sector-specific guidelines to be followed by particular organizations. Depending on which business or sector has reported the incident, each of the businesses should follow additional reporting obligations mandated by their respective regulators.
For instance, sectors like banking and insurance have their guidelines of their own mandated by the government. For example, the Reserve Bank of India (RBI) mandates banks to report cyber incidents within two to six hours of detection. You may also adhere to any supplementary regulations applicable to your industry to ensure complete compliance. Are there any issues with the new guidelines?
The short timeline for reporting can be a little daunting. A shorter duration of six hours may not be that easy to identify the incidents and report them. That is exactly why businesses are expected to place robust monitoring systems to identify and log possible cybersecurity incidents.
There are guidelines available for the proper plans and tips for monitoring the effective development of systems. You can find the details on the official website of CERT-In. In addition, businesses also need to seek assistance and tips from cybersecurity professionals. This will help in the development of robust strategies for reporting security incidents. The Closing Thoughts
The revised guidelines for reporting of cyber security incidents have been regarded as the right step in the right direction. Even when it faced a little resistance from some sectors and businesses, it indicates the strong resolve on the part of the government towards a practice eradication or at least control over cyber security.
Businesses that can adhere to these guidelines can be well placed to help themselves navigate the sphere of cyber threats. The new guidelines can also help minimize damage, maintain regulatory compliance, and protect their valuable data and reputation.
