Your MTTD Looks Great. Your Post-Alert Gap Doesn't: Navigating Indian Cyber Incident Liability

Beyond the Dashboard: The False Comfort of Fast Detection

In modern Security Operations Centres (SOCs), teams celebrate shrinking Mean Time to Detect (MTTD). Automated detection engineering, Security Information and Event Management (SIEM) tools, and Extended Detection and Response (XDR) telemetry mean an anomaly is flagged in minutes.

However, from a legal and regulatory standpoint in India, MTTD is only half the equation. The metric that exposes directors, data fiduciaries, and Chief Information Security Officers (CISOs) to statutory penalties is the Post-Alert Gap—the elapsed time between when an alert fires and when the organisation takes decisive, legally compliant containment, forensics, and notification steps.

In the Mumbai Metropolitan Region (MMR)—from fintech clusters in Bandra-Kurla Complex (BKC) to logistics and enterprise back-offices in Thane, Navi Mumbai, and Mira-Bhayandar—enterprises routinely stumble in this gap. While internal teams debate whether an alert constitutes a "confirmed incident" or merely a "suspicious event," statutory reporting clocks expire, volatile evidence is overwritten, and corporate civil and criminal liabilities mount.

---

The Indian Regulatory Squeeze: Why Time is No Longer on Your Side

When a critical alert triggers, technical containment is not the only urgent demand. Indian law imposes strict, inflexible operational timelines that intersect directly with your post-alert workflow.

1. The CERT-In 6-Hour Reporting Mandate

Under the Cyber Security Directions issued on April 28, 2022, by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, 2000, organisations must report specified cyber incidents to CERT-In within six hours of noticing or being brought to notice of them.

If your SIEM flags an unauthorized domain controller sync or abnormal lateral movement at 02:00 AM, and your incident triage team does not escalate the alert to legal or management until 09:00 AM, you have already violated statutory directions. Non-compliance with CERT-In directions carries penal consequences under Section 70B(7) of the IT Act, which provides for imprisonment of up to one year, a fine of up to ₹1,00,000, or both.

2. The Digital Personal Data Protection (DPDP) Act, 2023

Under Section 8(6) of the DPDP Act, 2023, a Data Fiduciary must notify the Data Protection Board of India and each affected Data Principal of any personal data breach. Unlike mature international frameworks that grant 72-hour grace periods, the DPDP Act provides no room for internal delays. Allowing a post-alert gap to stretch while threat actors exfiltrate client or employee records can trigger significant financial penalties under the Act—reaching up to ₹250 crore for failure to take reasonable security safeguards.

3. Civil Liability for Negligence under Section 43A of the IT Act

Where sensitive personal data or proprietary data is compromised due to a delay in post-alert containment, the enterprise can be exposed to civil suits for damages by affected stakeholders for failure to implement reasonable security practices and procedures.

---

Evidence Preservation Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

A common consequence of a mismanaged post-alert gap is the destruction of digital evidence. In the rush to isolate or reboot an infected server, IT teams often overwrite server logs, purge temporary memory, or fail to secure forensic disk images.

With the replacement of the Indian Evidence Act, 1872 by the Bharatiya Sakshya Adhiniyam, 2023 (BSA), the rules governing electronic records have been modernized and tightened:

• Section 61 of the BSA, 2023 explicitly recognizes electronic records as documents.
• Section 63 of the BSA, 2023 (which supersedes the erstwhile Section 65B of the Indian Evidence Act) governs the admissibility of electronic records in judicial proceedings.

If your post-alert incident containment disrupts the chain of custody, fails to log system administrator interventions, or lacks contemporaneous hashing, your electronic evidence will not satisfy the mandatory certificate conditions under Section 63(4) of the BSA. This cripples your ability to pursue civil recovery, file an enforceable police complaint, or seek indemnification under commercial cyber insurance policies.

   ALERT FIRES (MTTD Ends)
            │
            ▼
┌──────────────────────────────────────────────┐
│            THE POST-ALERT GAP                │
│  - Triage delays                             │
│  - Internal debate: "Event" vs "Incident"    │
│  - Overwritten logs / Unhashed memory dumps  │
│  - Missed statutory clocks                   │
└──────────────────────────────────────────────┘
            │
            ▼
   REGULATORY & EVIDENTIARY LIABILITY
   - CERT-In 6-hour breach
   - DPDP Act Section 8(6) non-compliance
   - BSA Sec 63 certificate invalidation

---

Offenses Under the Bharatiya Nyaya Sanhita (BNS) and IT Act

When malicious intrusions or internal data exfiltrations are confirmed during triage, the conduct constitutes distinct criminal offenses across both special and general penal statutes:

• Information Technology Act, 2000:
  • Section 43 read with Section 66: Unauthorised access, downloading, or extraction of data.
  • Section 66C & 66D: Identity theft and cheating by personation through computer resources.
• Bharatiya Nyaya Sanhita, 2023 (BNS):
  • Section 316 (Criminal Breach of Trust): Often applicable where an employee or third-party IT vendor misuses privileged access credentials.
  • Section 318 (Cheating): Applicable to business email compromise (BEC) and phishing-induced wire transfers.
  • Section 308 (Extortion): Triggered in corporate ransomware and double-extortion attacks.

---

How MMR Enterprises Must Report Cyber Incidents

Bridging the post-alert gap requires clear, pre-mapped operational escalations. When a cyber attack or extortion incident occurs within the Mumbai, Thane, or Mira-Bhayandar jurisdictions, organisations must follow a parallel reporting protocol:

1. Centralised Reporting

• CERT-In Incident Portal: Formal submission via incident@cert-in.org.in or the CERT-In portal within the mandatory 6-hour threshold.
• National Cyber Crime Reporting Portal (NCRP): File an incident report on cybercrime.gov.in or call the 1930 national cyber financial fraud helpline immediately if corporate accounts or funds are compromised.

2. Local Police Reporting in MMR

Depending on where your registered office or server infrastructure sits, written complaints along with electronic logs certified under Section 63 BSA should be submitted to the jurisdictional Cyber Police Station:

• Mumbai: Cyber Crime Police Station, Bandra-Kurla Complex (BKC) or the dedicated Regional Cyber Police Stations (South, Central, Western, Eastern, and Northern regions).
• Thane: Cyber Crime Police Station, Thane City Police Commissionerate (located near Wagle Estate).
• Mira-Bhayandar / Vasai-Virar (MBVV): MBVV Cyber Cell, functioning under the MBVV Police Commissionerate.

---

Key Steps to Close the Post-Alert Gap

1. Define 'Noticed' in Your Incident Response Playbook: Eliminate internal ambiguity. Clarify that when automated alerts cross a defined severity threshold, the 6-hour regulatory clock has commenced.
2. Integrate Legal Counsel with SecOps: Ensure legal counsel is looped in at the triage stage, not after remediation finishes. Counsel protects post-incident communications, directs forensic retention, and structures mandatory reporting.
3. Automate BSA-Compliant Evidence Gathering: Deploy tools that generate automated hashes (SHA-256) and preserve metadata at the moment of alerting to satisfy Section 63 BSA requirements.

---

Frequently Asked Questions (FAQ)

1. Does the CERT-In 6-hour clock start when the alert triggers or when an investigation concludes?

The clock starts when your organisation first becomes aware of the event or is notified of it. You cannot delay reporting until root-cause analysis is complete. CERT-In expects an initial notification within six hours, followed by supplementary updates as forensic facts emerge.

2. How does the Bharatiya Sakshya Adhiniyam, 2023 impact internal forensic reports?

Under Section 63 of the BSA, electronic records—including system logs and SIEM extracts—must be accompanied by a certificate identifying the device, confirming the lawful control and normal operation of the computer system, and signed by the person in official management of the device or an authorized expert.

3. Can company executives face personal criminal liability for ignoring alerts?

If deliberate inaction results in data tampering, destruction of evidence, or non-compliance with a lawful order from CERT-In under Section 70B(7) of the IT Act, designated officers and directors can face statutory fines or prosecution for regulatory non-compliance.

4. What should a company do first if ransomware is detected on a server?

Isolate the affected network segments immediately without powering down volatile memory. Ensure legal counsel and forensic specialists are engaged to preserve system snapshots under valid chains of custody, report the incident to CERT-In within 6 hours, and notify the local cyber crime authority.

---

APS Law advises corporate clients, startups, and regulated entities across Mumbai, Thane, and Mira Road on incident response readiness, statutory compliance, and digital evidence protection. If your organisation requires assistance structuring an incident response framework or handling an active data breach, contact APS Law to schedule a consultation.