CERT-In's 6-Hour Reporting Rule: Are You Actually Ready?CERT-In's 6-Hour Reporting Rule: Are You Actually Ready?

Since April 2022, CERT-In requires Indian organisations — including manufacturing companies — to report cyber incidents within 6 hours of detection.

The penalty for non-compliance: INR 1 lakh per day.

Detection Comes Before the Clock Does

The 6-hour clock starts at detection. To meet the deadline, you need to detect the incident first.

Most OT environments in Indian manufacturing have no network monitoring at all.

No monitoring means no detection. No detection means no 6-hour window. No 6-hour window means an INR 1 lakh/day penalty by default.

Three Questions Your Team Should Be Able to Answer Today

• Does your OT network generate security event logs?
• Who is responsible for reviewing those logs?
• What qualifies as a reportable incident in your facility?

If any of those three don't have a clear answer, that's the actual gap — not the 6-hour rule itself.

Prazamana can help you build the readiness to answer all three. Get in touch to talk through where your OT environment stands today.