New CERT-In Rules On Crypto, VPN, Cloud Service Providers Comes Into Effect From June 2022

The Indian Computer Emergency Response Team (CERT-In) recently issued a circular dated April 28 citing several new cybersecurity directions, which could impact the operations of crypto exchanges, data centres, VPN providers, crypto exchanges and others.

Click here to know more about the Cert-In alert notification about Google Chrome Browser

These directions will become effective in 60 days i.e, in June 2022, and they are applicable to service providers, as well as intermediaries, such as social media platforms, corporate bodies, data centres, and other organisations.

“To effectively fight cybercrime, all companies and enterprises must mandatorily report cyber incidents to @IndianCERT,” said Rajeev Chandrasekhar, Union Minister of State for Electronics and IT in a Twitter post. 

What Does The Notification Say About Cryptos?

According to the notification, all virtual asset service providers, virtual asset exchange providers, and custodian wallet providers as defined by the Ministry of Finance from time to time, shall mandatorily maintain all Know Your Customer (KYC) details and records of financial transactions for a period of five years.

All virtual asset service providers and other entities must mandatorily enable logs of all their Information and Communication Technology (ICT) systems and maintain them securely for a rolling period of 180 days, read the CERT-In direction.

Click here to know more about how this impacts the crypto industry

What Did The Notification Say About VPN, VPS and Cloud Service Providers?

Data Centres, Virtual Private Server (VPS) providers, Cloud Service providers and Virtual Network Service (VPN) providers shall be required to register and maintain certain records for a period of five years or longer as may be prescribed by law after any cancellation or withdrawal of the registration as the case may be. 

Those Records Include: 

• Validated names of subscribers or customers hiring the services.
• Period of hire, including dates.
• IPs allotted to/being used by the members.
• Email address, IP address and time stamp used at the time of registration/on-boarding.
• Purpose for hiring services.
• Validated address and contact numbers.
• Ownership pattern of the subscribers/customers hiring services.

How Should Cyber Attack Incidents Be Reported?

CERT-In said that all the entities operating in India must report any kind of cyber security incidents within six hours of the said entities noticing them. They can be reported to CERT-In using the email address- incident@cert-in.org.in, or on the phone number 1800-11-4949 and Fax number 1800-11-6969.