CAPF AC 2022 Q95: Current Affairs – Indian Government Schemes & Initiatives
- (a) 1 only
- (b) 2 only
- (c) Both 1 and 2
- (d) Neither 1 nor 2
Answer: (b) 2 only
Explanation
CERT-In directions of April 2022
How to think: the catch is in the numbers.
The time limit for reporting a cyber incident is 6 hours, not 24.
The period for keeping records is 5 years.
| Statement | Verdict | What the directions say |
|---|---|---|
| 1. Breaches must be reported within 24 hours | Wrong | Within 6 hours of noticing the incident |
| 2. VPN providers must keep user data for at least five years and share it when required | Correct | Names, addresses, IP addresses and purpose of use are to be kept for 5 years or longer |
Other rules in the same directions: all bodies must keep their system logs for 180 days within India.
They must also synchronise their clocks with Indian time servers.
About CERT-In: it is the national agency for cyber security incidents.
It works under the Ministry of Electronics and Information Technology, by Section 70B of the Information Technology Act, 2000.
Answer: (b) 2 only.
Why each option is right or wrong
- (a) Incorrect. Statement 1 is false; the limit is 6 hours, not 24.
- (b) CORRECT. Only statement 2 is true: VPN providers must keep data for five years.
- (c) Incorrect. Statement 1 has the wrong time limit.
- (d) Incorrect. Statement 2 is true.
Key point
CERT-In directions, 28 April 2022 (under Section 70B of the IT Act): report incidents within 6 hours; keep ICT logs for 180 days in India; VPN, cloud and data centre providers keep customer records for 5 years; crypto exchanges keep KYC records for 5 years.
Remember
CERT-In 2022: report in 6 hours, logs 180 days, VPN data 5 years.
Common mistakes
- Accepting 24 hours, which sounds reasonable but is not the rule.
- Mixing up the 180-day rule for logs with the 5-year rule for customer records.
- Thinking CERT-In is under the Home Ministry; it is under MeitY.
Exam tip
Educated guess: the VPN rule made headlines because several VPN companies pulled their servers out of India over it, so statement 2 is true. The reporting rule was called strict precisely because it was only six hours.
Sources
- Indian Computer Emergency Response Team — Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 (28 April 2022)
- Press Information Bureau, Ministry of Electronics and IT — CERT-In issues directions relating to information security practices and reporting of cyber incidents