What are the 2022 CERT-In cybersecurity directions for data centers, VPS, and cloud providers?
The 2022 CERT-In cybersecurity directions come from the Indian Computer Emergency Response Team, which sits under the Ministry of Electronics and Information Technology. They set security practices for data centres, VPS providers, cloud providers, and other bodies named in the directions. For a hosting customer, the practical parts are identity records, log retention, time sync, and incident reporting.
Read those directions on the Indian Computer Emergency Response Team (CERT-In) site before you treat this page as the rule. WebJi® does not claim a CERT-In certificate here, and this page states no fine. The year 2022 is the year of the directions this article explains.
What customer KYC information must Indian VPS and cloud providers maintain?
Indian VPS and cloud providers are told to keep accurate customer information for the service they sell. In practice that record includes the validated name, address, and contact number, the hire period, the IP addresses allotted, the email and IP used at onboarding with a time stamp, the purpose of the service, and the ownership pattern.
The same directions tell the provider to keep that customer record for five years, or longer where another law requires it, after the service ends. VPN services are named in the same part of the directions. This page stays with VPS, cloud, and data-centre customers. If a field here ever differs from the CERT-In text, the CERT-In text wins.
- Validated name, address, and contact number.
- Period of hire, including the dates.
- IP addresses allotted to the customer.
- Email address, IP address, and time stamp used at onboarding.
- Purpose for hiring the service, and the ownership pattern.
How does the mandatory 180-day server log retention rule work in India?
The 2022 directions tell providers to keep ICT system logs securely for a rolling 180 days inside Indian jurisdiction. They also tell systems to sync clocks using Network Time Protocol with the National Informatics Centre or the National Physical Laboratory. Those provider logs are not a full copy of your application audit trail.
Keep the records your own audit needs as well. A log that exists only on a laptop abroad is not the provider's infrastructure copy. The 180-day rule is about the provider's ICT logs. It is not a promise that your application database is exported for you.
Which cybersecurity incidents trigger the 6-hour CERT-In reporting window?
The directions require a listed cybersecurity incident to be reported to CERT-In within six hours of noticing it or being told about it. The annexure is the list that counts. Examples include unauthorised access, website defacement, ransomware and other malicious code, denial of service, a data breach or leak, and incidents that affect cloud systems or digital payments.
Six hours is the reporting window in the directions. It is not a fine printed on this page, and it is not a hosting uptime figure. Use the CERT-In annexure as the closed list. The examples above are illustrations so a site owner can see the shape of the duty. They do not replace that annexure.
How does hosting with a compliant provider help Indian businesses meet audit requirements?
Hosting with a provider that keeps KYC and infrastructure logs in India helps an audit show who held the server and that those provider logs were in scope. It does not file your incident report and it is not a certification. You still report incidents the directions put on you. Personal-data duties are a separate question from this log rule.
The server product is VPS hosting in India. Personal-data duties sit on DPDP Act compliance, which is not this incident rule. Where the bytes are allowed to live is covered in data localisation rules for Indian websites. None of those pages is a CERT-In certificate for WebJi® or for the customer.