Begin with the directions and their scope
CERT-In’s April 28, 2022 directions under section 70B address covered service providers, intermediaries, data centres, body corporates and government organizations. Identify the relevant category and duties for the actual service; do not assume that every SaaS vendor has the same provider-specific record obligations. Read the official directions and official FAQ.
Prepare for a six-hour reporting trigger
For reportable incidents, the directions set a six-hour period from noticing or being brought to notice. Use Annex I and the FAQ to assess the event. Do not wait for a complete forensic investigation before evaluating the reporting duty. The FAQ explains how available information can be reported first and supplemented later.
Assign an incident decision-maker, an alternate and a point of contact. Keep the reporting channel, authority contacts, customer escalation route and first-report fields in an accessible runbook. Exercise the process with a tabletop scenario.
Retain usable security logs
The directions call for secure ICT logs over a rolling 180-day period and address availability within Indian jurisdiction. The FAQ clarifies logging and storage questions; review it against your architecture rather than treating a single cloud-region label as sufficient.
Inventory log sources and confirm actual retention, timestamps, access controls, integrity and retrieval. Include hosting, identity, cloud administration, application access and relevant security tooling. A short-lived abuse counter is not a security-log archive. Avoid placing passwords, inquiry bodies or unnecessary customer data in logs.
Keep provider-specific records separate
Certain data-centre, VPS, cloud, VPN and virtual-asset services have additional customer-record duties. Evaluate whether the specific service falls into those categories. Do not impose every one of those duties on an ordinary inquiry form just because the site uses cloud hosting.
Coordinate overlapping obligations
CERT-In reporting, DPDP breach obligations as they commence, foreign privacy laws and customer notification clauses have different scopes and triggers. A generic “72 hours” response in a security questionnaire can obscure a shorter obligation. Record which clock applies, who can make the report and what information must be preserved. See the DPDP phased-readiness guide.
Provide evidence rather than a badge
Useful evidence includes the named incident owner, a tested escalation path, sample redacted logs, retention settings and a recent retrieval exercise. A pentest alone does not prove that reporting and retention operate correctly.
The Security Gate Sprint · $2,250 can review an agreed buyer request and identify evidence gaps. A SaaS Pentest validates the scoped application attack surface. Confirm legal duties and operational implementation separately.