In India, it is legally mandatory for which of the following to report on cyber security incidents? 1. Service providers 2. Data centres 3. Body corporate Select the correct answer using the codes given below:

The correct answer is D. All three categories must report cyber security incidents to CERT-In under Section 70B of the Information Technology Act, 2000, and the CERT-In Rules, 2013 framed under it.

• Statement 1 (service providers): Covered. Rule 12 of the 2013 Rules requires service providers, intermediaries, data centres and body corporate to report incidents as early as possible.
• Statement 2 (data centres): Covered under the same rule. Data centres carry the same reporting duty.
• Statement 3 (body corporate): Covered. The mandate reaches corporates as well, so all three statements are correct and option D is complete.

Core concept: statutory cyber incident reporting and CERT-In's role as the national nodal agency. Mains angle: GS-III cyber security, protection of critical information infrastructure, and the gap between legal duty and enforcement capacity.

Changed since exam: CERT-In's Directions of 28 April 2022 under Section 70B(6) now require reporting within 6 hours of noticing an incident, and add log retention and time synchronisation obligations.

Trap: candidates pick C because body corporate is the term they remember from the IT Act's data protection provisions, and forget that the reporting mandate is broader and includes service providers and data centres.