CERT-In log retention: what your network must do for 180 days

The Directions contain six directions. Four matter to every network team.

1. Time sync (direction i). Connect to the NTP server of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or to NTP servers traceable to them, "for synchronisation of all their ICT systems clocks". Multi-geography entities can use another accurate source, provided it does not deviate from NIC and NPL.
2. 6-hour reporting (direction ii). Report the incidents listed in Annexure I to CERT-In "within 6 hours of noticing such incidents or being brought to notice about such incidents", by email to incident@cert-in.org.in, phone or fax.
3. Point of contact (direction iii). Name a point of contact for CERT-In, and act on CERT-In orders within the timeframe they set.
4. Logs (direction iv). "Mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days and the same shall be maintained within the Indian jurisdiction." Logs must be given to CERT-In with an incident report or when CERT-In orders.

Two more directions apply to specific sectors. Data centres, VPS, cloud and VPN service providers must keep subscriber records for 5 years (direction v). Virtual asset providers must keep KYC and transaction records for 5 years (direction vi).

CERT-In gave MSMEs, and the subscriber-validation part of direction (v), extra time until 25 September 2022 (PIB).

CERT-In published FAQs on the Directions in May 2022 (CERT-In FAQ). The answers that matter for networks:

• Which logs (Q37). Logs depend on the sector, "such as Firewall logs, Intrusion Prevention Systems logs, SIEM logs, web / database / mail / FTP / Proxy server logs, Event logs of critical systems, Application logs, ATM switch logs, SSH logs, VPN logs etc." The list is not exhaustive. Record "both successful as well as unsuccessful events".
• Storage outside India (Q35 and Q36). Logs "may be stored outside India also as long as the obligation to produce logs to CERT-In is adhered to by the entities in a reasonable time". But Q36 says service providers offering services to users in India must maintain logs "in Indian jurisdiction". The safe design is a primary 180-day copy in India, with any foreign copy as a backup.
• Time zone (Q40). Clocks do not have to be set to IST. NTP gives UTC, and hosts convert locally. Record the time zone with the time.
• NTP servers (Q43). NIC: samay1.nic.in and samay2.nic.in. NPL: time.nplindia.org.
• Incomplete information (Q30). Report what you have within 6 hours and send the rest later.
• Reporting cannot be contracted away (Q13, Q22). "Any entity which notices the cyber security incident, shall report to CERT-In." A confidentiality clause does not override this.
• Enterprise VPNs (Q34). The 5-year subscriber-record duty for VPN providers applies to providers of "Internet proxy like services" to the public, not to corporate VPNs.
• Foreign firms (Q26). The Directions apply "to any entity whatsoever, in the matter of cyber incidents".

The Directions say "all ICT systems". For a branch, ATM or plant network, that usually means:

Annexure I lists 20 incident types. Several point straight at the network: "Attack on servers such as Database, Mail and DNS and network devices such as Routers", "Targeted scanning/probing of critical networks/systems", DoS and DDoS, attacks on IoT devices, and attacks on "Critical infrastructure, SCADA and operational technology systems and Wireless networks".

1. Send everything off the box. Routers and firewalls keep little on-device storage. Forward syslog, flow and security events to a central collector or SIEM hosted in India.
2. Size for 180 days, plus headroom. Estimate events per second per site and multiply out. Keep the most recent weeks searchable and archive the rest, still in India.
3. Protect integrity. Restrict who can delete or edit logs, and log access to the logs themselves. The Directions ask for logs to be kept "securely".
4. Sync every clock. Point the controller, collectors and every edge at NIC or NPL NTP servers, or an internal server traceable to them. Alarm on drift.
5. Watch management-platform defaults. Many platforms keep short telemetry by default. Check each retention setting, and export anything shorter than 180 days to your SIEM or archive.
6. Know where a vendor keeps your logs. For a cloud-managed network or SSE service, ask the vendor where logs sit, for how long, and how fast they can hand them over.
7. Rehearse the 6-hour clock. Time a test incident from first alert to a draft CERT-In report. Keep the email template, the point-of-contact details and the reporting form ready.

• Audits. CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (v1.0, 25 July 2025) include a "Log Management and Maintenance Audit". It assesses log "generation, retention, integrity, and monitoring practices" against organisational policy and regulatory requirements (CERT-In). The same guidelines say remote access traffic "should be tunneled, encrypted and logged", and that MFA is mandatory for remote access.
• Bills of materials. CERT-In's Technical Guidelines on SBOM, QBOM, CBOM, AIBOM and HBOM (v2.0, 9 July 2025) are guidance, not a mandate (AZB & Partners).
• Sector regulators. Banks also report to RBI within 6 hours under the Directions of 31 July 2026. See our RBI Directions guide. The DPDP Rules 2025 add a one-year minimum for certain logs from May 2027.

Nexapp's platform helps you meet these obligations. The obligation itself stays with your organisation.

• Logs stay in India. The Nexapp Controller and Instaroute SDWAN Lite 2.0 run Nexapp-hosted in India or self-hosted in your own data centre and DR.
• Configurable retention. You set retention to your policy. SDWAN Lite 2.0 keeps 180 days of alarm history by default and 30 days of telemetry, so export telemetry to your SIEM if you need 180 days of it.
• SIEM export. Every log stream exports as RFC 5424 syslog on SDWAN Lite 2.0. NGFW edges send syslog to a remote collector, and security events go out by syslog, webhook or email.
• Audit trail. SD-WAN Enterprise keeps access, activity, device, firmware and audit logs, with configurable retention.
• Time sync. NTP servers are set centrally, so devices and the controller can use NIC or NPL sources.
• Remote access. Nexapp SSE/ZTNA logs access app by app, with identity and device posture.

See our Trust page for how these map to CERT-In, RBI and DPDP.