Cyber Incident Register

Logs cyber security incidents against the reporting window and retention duties set by the CERT-In directions (No. 20(3)/2022-CERT-In, dated 28 April 2022).

What it does

• Records incidents against the twenty categories listed in Annexure I of the directions.
• Runs the reporting clock. Direction (ii) requires reporting "within 6 hours of noticing such incidents or being brought to notice about such incidents". Both routes start the same clock, so the register records which one applied and computes the deadline from that moment.
• Keeps lateness visible. A report sent after the deadline is recorded as late rather than quietly accepted.
• Reports what the site's logging actually does against the 180-day retention duty, including what it cannot determine.

What it does not do

It does not make a site compliant. It records and times what the operator already knows, and an organisation that never notices an incident is not helped by it. No amount of record-keeping substitutes for detection.

It does not detect incidents, and it does not submit reports. The directions name email, phone and fax, and point to cert-in.org.in for current methods and formats. The module records that a report was sent, by which route, and when.

It cannot confirm log retention. Core's Database Logging trims by row count rather than by age, so a busy site can discard a fortnight of entries while a quiet one keeps years, and where log data physically sits is a hosting question. The module reports both facts rather than displaying a tick it cannot justify.

Permissions

Logging an incident and declaring it reported are separate permissions. Whoever notices something can record it immediately without also holding the authority to say a report went to CERT-In.

Related

The DPDP Compliance Toolkit covers a different duty. A single breach can trigger both: intimation under section 8(6) of the Digital Personal Data Protection Act, 2023, and a report under these directions. They run on separate clocks and are not interchangeable.

Requirements

Drupal 11. No third-party libraries.

A note on the directions

Requirements referenced here were checked against the official directions published at cert-in.org.in. The directions state no penalty amounts or terms; they say only that non-compliance "may invite punitive action under sub-section (7) of the section 70B of the IT Act, 2000 and other laws as applicable". Figures circulating in secondary commentary come from elsewhere and are not reproduced here.