In India, it is legally mandatory for which of the following to report on cyber security incidents?

1. Service providers
2. Data centres
3. Body corporate

Select the correct answer using the code given below:

Correct Answer: 1, 2 and 3

In India, mandatory reporting of cybersecurity incidents is governed under Section 70B of the Information Technology Act, 2000, along with the directions issued by the Indian Computer Emergency Response Team (CERT-In).

Under these regulations and directions, mandatory reporting of cybersecurity incidents applies to:

1. Service providers
2. Data centres
3. Body corporate (entities/companies operating IT infrastructure)

These entities are obligated to report cybersecurity breaches and incidents to CERT-In within the stipulated timeframe to ensure national cybersecurity resilience, prompt mitigation, and threat intelligence sharing.

Therefore, all three given options (1, 2, and 3) are correct, making 1, 2 and 3 the correct choice.