In May, 11 industry bodies wrote a joint letter to the Director General of CERT-In, expressing their concern over the detrimental impact of this directive on cybersecurity, and the difficulty it posed for companies trying to do business in India. The companies have specifically flagged the six-hour incident reporting timeline and an overbroad definition of reportable incidents, as problematic.