Previous Year Question
In India, it is legally mandatory for which of the following to report on cyber-security incidents?
Service providers
Data centres
Body corporate
Select the correct answer using the codes given below.
Only 1
1 and 2
Only 3
1, 2 and 3
Correct Answer: D
Detailed Solution
Service providers, data centres and bodies corporate—all three are legally required to report specified cyber-security incidents to CERT-In.
Under Section 70B of the Information Technology Act, 2000, the Indian Computer Emergency Response Team (CERT-In) has been designated as the national nodal agency for cyber-security incidents in India. CERT-In collects information relating to cyber incidents, issues alerts and advisories and coordinates response activities.
Under the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013, service providers, intermediaries, data centres and bodies corporate are required to report specified cyber-security incidents to CERT-In.
Reportable incidents may include unauthorised access, malicious software attacks, website intrusions, phishing, identity theft, data breaches, denial-of-service attacks, attacks on critical systems and other cyber incidents affecting networks or applications.
Current position: Under the directions issued by CERT-In in 2022, service providers, intermediaries, data centres, bodies corporate and government organisations are required to report listed cyber-security incidents to CERT-In within six hours of noticing such incidents or being informed about them.
These entities are also required to securely maintain logs of Information and Communication Technology systems for 180 days and keep them within Indian jurisdiction. The logs must be provided when required by CERT-In.