India's absurd infosec reporting rules get just 15 followers

India's rules requiring local organizations to report infosec incidents within six hours of detection have been observed by a mere 15 entities. India's Computer Emergency Response team (CERT-In) revealed that low, low, level of compliance in response to a Right to Information (RTI) request filed by Indian tech news outlet …

[KittenHuffer]

Dare I say ....

.... It's very very good IT is! Very very good!

[Catkin]

Adverse incentive

If you discard all information on incidents older than 6 hours then you can't run afoul of the law. WFP (working from pub) should give you sufficient plausible deniability.

[Mike 137]

Compared with?

Considering that (according to research reports going back over several years) the average incident detection time has been stuck at something around 6 months for a long time now, I'm wondering how a few extra hours after detection would be a problem.