Filing your first CERT-In report: a founder's walkthrough
The fields, the email address, the helpline, and what to write when you don't yet know everything. Based on the actual filing format.
In short
- Before any incident: name a Point of Contact, keep 180 days of logs in India, and sync clocks to NIC or NPL time.
- Report to CERT-In by email at incident@cert-in.org.in within 6 hours, using its incident reporting form.
- Report what you know in time, mark unknowns as under investigation, and send updates later.
If you've never reported an incident to CERT-In, the first time will probably come at a bad hour. This walkthrough covers what to prepare, where to send it, and what to write when you don't yet know everything. Check CERT-In's website for the current form and contact details before you need them.
Before anything happens
- Name a Point of Contact. The Directions require organisations to designate one to interface with CERT-In, and to share their details with CERT-In.
- Keep logs. The Directions require ICT system logs to be kept for a rolling 180 days, maintained within India.
- Sync your clocks. Systems should synchronise time with the NTP servers of NIC or NPL, or with servers traceable to them, so that timestamps line up.
- Save the reporting form and contact details somewhere your team can find them at 2 AM.
Where to send the report
CERT-In accepts incident reports by email to incident@cert-in.org.in, and publishes a helpline and fax numbers on its website. Its incident reporting form is also on the website; attach the completed form or include the same information in your email.
What to include
The form asks for information you can mostly gather in advance. Expect to provide:
- Your organisation's name and a contact person's details
- The type of incident, using CERT-In's categories
- When the incident happened, and when you detected it
- The systems affected: hostnames, IP addresses, operating systems, locations
- What you've observed: the symptoms and the attacker's source, if known
- What you've done so far to contain it
When you don't know everything yet
You usually won't. CERT-In's FAQs make clear that you should report what you know within 6 hours and follow up with the rest. Write plainly, separate facts from guesses, and say what you're still investigating. "Unknown at this time; under investigation" is an acceptable answer to a field.
After you've filed
- Keep a copy of everything you sent, with the time you sent it.
- Send updates as you learn more, referencing your first report.
- Check whether your sector regulator, such as RBI, SEBI or IRDAI, has its own reporting duties.
- If personal data was involved, from 13 May 2027 the DPDP Act adds notices to the Data Protection Board and to affected people.
Want to know what an attacker would find in your environment?
Get a free exposure check