Consider the following statements with reference to the latest guidelines issued by the Indian Computer Emergency Response Team (CERT-In):
- Data centres and service providers shall compulsorily report cyber security breaches within 24 hours.
- Virtual Private Network providers shall retain user data for at least five years and share records with authorities when required.
Which of the statements given above is/are correct?
1 only
2 only
Both 1 and 2
Neither 1 nor 2
Answer is Wrong!
Answer is Right!
This question was previously asked in
UPSC CAPF – 2022
Statement 1 says data centres and service providers shall report cyber security breaches within 24 hours. The CERT-In direction requires reporting of cyber security incidents within 6 hours of noticing the incident or being informed about it. Thus, statement 1 is incorrect.
Statement 2 says Virtual Private Network providers shall retain user data for at least five years and share records with authorities when required. The guidelines require VPN providers and other entities to retain certain user data for a period of five years and provide it to CERT-In when mandated. Thus, statement 2 is correct.