How do you get a CERT-In aligned incident report in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What is the 6-hour CERT-In notification, and what goes in it?

It is a form, not a report, and it is the first thing you do after you know something happened. CERT-In's directions require that incidents be reported within 6 hours of noticing them, and the form asks for the nature of the incident, the affected systems and infrastructure, the impact and the likely cause, the time the incident occurred and the time it was noticed, and a contact point for follow-up. You report what you know, and you note what you do not yet know. You do not wait for root cause before you notify, because the 6-hour clock starts at noticing, not at understanding. If the incident is not in your organisation's defined list, you still report it to CERT-In and can be told it is not applicable, which is a much better position than a missed deadline and a later admission that you should have reported.

What goes into the forensic incident report?

Five sections, and this is the document that goes to the board, the customer and sometimes the regulator. A timeline, with the time of first compromise, the time of detection, the time of containment and the time of eradication, and the gaps between them, because the dwell time is the number that determines how bad the incident was. A technical narrative covering the initial access, the persistence, the lateral movement, the actions and the data touched, with the evidence referenced rather than pasted. A data impact section naming the categories of personal data affected, the approximate number of Data Principals, and whether the data was encrypted at rest, because under the DPDP Act, 2023 this determines whether a notification to the Data Protection Board and to affected individuals is required. Then the root cause and the remediation, and finally the containment actions with evidence of their effect.

Who else do you have to tell, and in what order?

Four audiences, and they need different things. CERT-In, within 6 hours, on the prescribed form. The Data Protection Board and the affected Data Principals, without delay, where the DPDP Act, 2023 requires it, and this is the obligation most often missed because teams focus on CERT-In and forget the data principal notification. Your bank, if money moved, on the fraud helpline, and, under RBI's June 2026 instructions effective 1 January 2027, a genuine individual victim with a gross loss of up to Rs 50,000 may be compensated at 85% of net loss or Rs 25,000, whichever is less, provided the fraud is reported to the bank and to the National Cyber Crime Reporting Portal or helpline 1930 within 5 calendar days. And the police, through the National Cyber Crime Reporting Portal or helpline 1930, which is a separate track and gives you a report number.

How do you get a report that holds up?

Six disciplines, and they are what separate a defensible report from an assertion. Preserve first, and preserve everything: memory where possible, disk images, logs, and the identity of the affected systems, and keep the chain of custody written down as you go. Get the timeline right, because most disputed incidents are timeline disputes, and build it from log sources rather than from memory. Log the 6-hour notification separately from the forensic report, since one is a notification and the other is a document, and mixing them confuses both. Be honest about what you do not know, because a report that admits an unknown is credible and a report that claims certainty is not. Do not overstate the legal characterisation, because overstating it in a report you later have to defend is a liability. And keep the retention discipline going: CERT-In's directions require logs to be retained for 180 days within India, so the evidence for the next incident is being written today.

What are the frequently asked questions?