On 28 April, the Indian Computer Emergency Response Team issued guidance on information security practices, procedure, prevention, response and reporting of cyber incidents under the Information Technology Act. Effective 60 days after issue, the guidance includes mandatory cyber-incident reporting to CERT-In and follows the agency’s identification of gaps and issues in facilitating incident-response measures. “These directions shall enhance overall cyber security posture and ensure safe & trusted Internet in the country,” the news release stated. According to CNET, virtual private network companies will be required to collect and store customer data for up to five years.