In India, it is legally mandatory for which of the following to report on cyber security incidents?1.Service providers2.Data centres3.Body corporateSelect the correct answer using the code given below:

1. A

   1 only

   Option (a) is 1 only. Service providers are covered, but the Information Technology (Amendment) Act / CERT-In rules also bind data centres and body corporates. This option is incomplete. This option is not the key.

2. B

   1 and 2 only

   Option (b) is 1 and 2 only. It omits body corporates, which are also required to report prescribed cyber-security incidents. This option is not the key.

3. C

   3 only

   Option (c) is 3 only. Body corporates are in, but so are intermediaries/service providers and data centres. This option is therefore wrong.

4. D

   1, 2 and 3

   Section 70B of the IT Act and the CERT-In directions / Intermediary Rules require service providers, data centres, body corporates and others to report cyber-security incidents to CERT-In. All three stem entities are covered, so 1, 2 and 3 is the official key.

Summary. Official key is (d) 1, 2 and 3. Indian law treats cyber-incident reporting as a duty of a wide class of intermediaries and companies, not of one subset. CERT-In is the national nodal agency. Service providers, data centres and body corporates all appear in the reporting net. None of the three can be dropped.