What Is CERT-In? Understand India's National Cybersecurity Incident Response Agency

What Is CERT-In and Which Ministry Does It Come Under?

CERT-In stands for Indian Computer Emergency Response Team. It is the Government of India's national agency responsible for coordinating responses to cybersecurity incidents across the country.

The agency operates under the Ministry of Electronics and Information Technology (MeitY). Its constituency covers the Indian cyber community, including government departments, public-sector organisations, private companies, academic institutions, service providers and individual internet users.

According to its official Citizen's Charter, CERT-In provides incident prevention, incident response and security quality management services. Its work aims to reduce the impact of cyberattacks, improve recovery time and strengthen cybersecurity awareness.

For example, if attackers exploit a software vulnerability to compromise an organisation's computer systems, CERT-In may analyse the reported incident, issue relevant security information and coordinate with affected organisations and other stakeholders. It can also recommend technical measures to contain the threat and prevent similar incidents.

In simple terms, CERT-In acts as a national coordination point for cybersecurity incident response. It helps organisations understand cyber threats, take appropriate protective measures and improve their ability to handle security emergencies.

When Was CERT-In Established?

CERT-In has been operational since January 2004. However, its operational beginning and the development of its statutory authority under the Information Technology Act are separate milestones.

The following timeline explains the major developments in its establishment and legal framework:

The agency's operational history is available on its official website. Readers can also verify its legal development through the CERT-In Act, Rules and Regulations page.

What Is CERT-In's Legal Mandate Under Section 70B?

Section 70B of the Information Technology Act, 2000 designates CERT-In as the national agency for performing specified cybersecurity incident response functions. It provides the legal basis for the agency to collect information, issue alerts, coordinate responses and take other prescribed measures relating to cybersecurity incidents.

Under Section 70B(4), CERT-In performs several important functions, including:

• Collecting, analysing and disseminating information about cybersecurity incidents.
• Issuing forecasts and alerts about cybersecurity incidents.
• Taking emergency measures to handle cybersecurity incidents.
• Coordinating activities relating to cybersecurity incident response.
• Publishing guidelines, advisories, vulnerability notes and whitepapers on information security practices, prevention, response and incident reporting.
• Performing other cybersecurity functions prescribed under the applicable rules.

Section 70B(6) also gives CERT-In the authority to call for information and issue directions to service providers, intermediaries, data centres, body corporates and other persons for carrying out its statutory functions.

You can read the legal provisions in the Information Technology Act, 2000 available on India Code.

Difference Between CERT-In Advisories and Statutory Directions

Not every publication issued by CERT-In has the same legal effect. Understanding the difference between its technical guidance and statutory directions is important for organisations.

• Security alerts and advisories: These communicate information about cyber threats, vulnerabilities and recommended protective measures. Organisations use them to understand risks and improve their security arrangements.
• Vulnerability notes: These provide technical information about identified weaknesses in software, hardware or other products, along with relevant mitigation guidance.
• Statutory directions: These are issued under the authority of Section 70B and may impose specific requirements on the entities covered by the directions.

For example, CERT-In's directions issued under Section 70B include requirements relating to incident reporting, log retention and designated points of contact. Organisations covered by these requirements must follow the applicable directions.

What Do the CERT-In Directions of 28 April 2022 Require?

One of the important regulatory developments was the issuance of cybersecurity directions on 28 April 2022. These directions were issued under Section 70B(6) to strengthen information security practices and improve the reporting and handling of cyber incidents.

Some key requirements under these directions include:

• Incident reporting: Covered entities must report specified cyber incidents to CERT-In within six hours of noticing them or being brought to their notice.
• Point of contact: Service providers, intermediaries, data centres, body corporates and government organisations covered by the directions must designate a point of contact to communicate with CERT-In.
• Log retention: Covered entities must enable logs of their ICT systems and maintain them securely for a rolling period of 180 days within Indian jurisdiction, as specified in the directions.
• Customer information records: Data centres, VPS providers, cloud service providers and VPN service providers must maintain specified subscriber and customer information in accordance with the directions.

The six-hour reporting requirement applies to the cyber incidents covered by the directions. It should not be interpreted as a general six-hour reporting obligation for every individual who experiences an online scam or fraud.

If an organisation cannot provide every detail immediately, CERT-In's official FAQs explain that it may submit the information available at the time and provide additional details later within a reasonable time.

Organisations can read the original CERT-In Cyber Security Directions dated 28 April 2022 and the related official FAQs on the cybersecurity directions.

What Are the Main Roles and Responsibilities of CERT-In?

CERT-In performs both proactive and reactive cybersecurity functions. Proactive activities help organisations identify and reduce security risks before an attack occurs. Reactive activities focus on analysing incidents, coordinating responses and limiting damage after a security breach.

Its major responsibilities include the following:

Collecting and Analysing Cybersecurity Incident Information

One of CERT-In's primary responsibilities is to collect and analyse information about cybersecurity incidents reported by organisations and other stakeholders.

The agency examines incident details to understand the nature of an attack, its possible impact, the systems involved and the level of risk. It also studies patterns and trends that may indicate wider threats to India's digital environment.

For example, if several organisations report similar phishing campaigns, malware infections or unauthorised access attempts, analysing those reports can help identify common attack methods and support preventive action.

CERT-In's official Roles and Functions page explains its responsibilities relating to incident reporting, analysis, trend identification and the development of preventive strategies.

Issuing Threat Alerts, Advisories and Security Guidelines

Cyber threats change continuously as attackers discover new vulnerabilities and develop different techniques. CERT-In publishes security alerts, advisories and vulnerability notes to inform organisations about identified risks.

These publications may cover:

• Security vulnerabilities in operating systems, applications and digital products.
• Malware, ransomware and malicious software campaigns.
• Phishing attacks and other techniques used to compromise accounts.
• Unauthorised access and exploitation of exposed systems.
• Recommended security updates, patches and mitigation measures.

Organisations can use this information to identify affected products, assess their exposure and apply the recommended security measures. CERT-In also publishes broader guidance on information security practices, helping organisations improve their systems and networks.

For instance, its website provides security alerts, vulnerability notes and advisories that organisations can consult to stay informed about current technical risks. The Government has also documented CERT-In's work on security guidelines for government entities and emerging technologies in its official cybersecurity update.

Coordinating Incident Response, Containment and Recovery

When a cybersecurity incident occurs, CERT-In helps affected organisations understand the situation and take appropriate remedial measures. Its responsibilities include coordinating incident response and sharing technical recommendations that can reduce the impact of an attack.

For example, if an organisation experiences a ransomware attack, it may need to identify the compromised systems, isolate affected devices, investigate the attack, secure its network and restore services safely.

CERT-In can provide technical guidance and coordinate with the affected organisation and relevant stakeholders during this process. Its response work also includes helping system administrators take follow-up measures to reduce the possibility of similar incidents.

The agency provides a 24×7 cybersecurity incident response service. Its official incident response functions include recommendations for damage containment, recovery and preventive action.

Supporting Technical Investigations and Cyber Forensics

Understanding how a cyberattack happened is important for preventing further damage. CERT-In's technical capabilities include incident analysis, investigation support, artifact analysis and cyber forensics.

Cyber forensic examination may help identify traces of malicious activity, understand how attackers accessed a system and determine which digital resources were affected. This information can support technical response and help organisations strengthen their security arrangements.

CERT-In also assists law enforcement agencies through its technical and forensic capabilities. However, this does not mean that it replaces the police or independently handles every criminal investigation. Its technical role and the criminal investigation conducted by competent law enforcement agencies are separate but may support each other.

The Government's official overview of CERT-In's operational work discusses incident investigation support and assistance to law enforcement agencies.

Coordinating Vulnerability Analysis and Responsible Disclosure

A vulnerability is a weakness in software, hardware, an application or a digital system that attackers may exploit to compromise security.

Security researchers and technology professionals sometimes discover such weaknesses before the affected vendor or product developer becomes aware of them. Responsible disclosure allows these findings to be reported and examined so that the affected organisation can work on a solution.

CERT-In coordinates this process through its Responsible Vulnerability Disclosure and Coordination Policy. It works with researchers, product vendors and affected organisations to analyse reported vulnerabilities and support mitigation.

CERT-In also functions as a CVE Numbering Authority (CNA). Under the Common Vulnerabilities and Exposures programme, an authorised CNA can assign CVE identifiers to qualifying vulnerabilities within its approved scope.

A CVE identifier provides a standard reference for a publicly disclosed security vulnerability. It helps software developers, security professionals and organisations discuss the same vulnerability without confusion.

According to its official CVE Numbering Authority page, CERT-In can assign and publish CVE identifiers for qualifying vulnerabilities found in products developed or manufactured by Indian vendors and original equipment manufacturers.

Strengthening Security Audits and Information Security Practices

Preventing cyberattacks requires organisations to regularly examine their digital infrastructure and identify weaknesses. CERT-In supports this process by promoting information security practices and maintaining an empanelment framework for information security auditing organisations.

These auditing organisations can provide services such as vulnerability assessment and penetration testing. Such assessments help identify weaknesses in websites, applications, networks and other information technology systems.

Organisations can use audit findings to improve access controls, secure configurations, network protection, application security and incident management procedures. However, an audit alone does not guarantee complete security. Organisations must also address identified weaknesses and regularly review their security arrangements.

Details of the framework and empanelled organisations are available on CERT-In's official auditor-empanelment page.

Improving Cyber Crisis Preparedness Through Exercises and Drills

Organisations need to prepare for cybersecurity emergencies before an actual attack occurs. CERT-In supports this preparation through cybersecurity exercises, mock drills and the Cyber Crisis Management Plan (CCMP).

The Cyber Crisis Management Plan provides a framework for dealing with cyber-related incidents, including serious cyberattacks and cyber terrorism. CERT-In leads its implementation across Central Government ministries and departments, state governments and key organisations operating in Indian cyberspace.

Cybersecurity exercises and mock drills allow participating organisations to test their incident response arrangements. They can identify weaknesses in communication, coordination, decision-making and recovery procedures before a real emergency exposes those gaps.

Government departments and other participating organisations can use these exercises to improve their readiness and strengthen coordination during major incidents.

The framework is explained on CERT-In's official Cyber Crisis Management Plan page. The Government has also reported on national cybersecurity preparedness and exercises in its August 2026 update.

Building Cybersecurity Skills and Public Awareness

Technology and security systems are only as effective as the people responsible for using and managing them. CERT-In therefore conducts technical training programmes and awareness activities for government officials, public-sector organisations, private companies and other stakeholders.

Its training activities help technical professionals and system administrators improve their understanding of cybersecurity threats, incident management and protective practices.

CERT-In also publishes security tips and awareness material for ordinary internet users. These resources explain common online threats and encourage safer digital behaviour, such as using updated software, protecting passwords and avoiding suspicious links and attachments.

Users can explore its official cybersecurity awareness resources and related publications. The Government's January 2026 CERT-In backgrounder also provides information about its training, awareness and capacity-building activities during 2025.

How Can Organisations and Individuals Report Cybersecurity Incidents to CERT-In?

Reporting cybersecurity incidents helps CERT-In analyse threats, identify wider attack patterns and coordinate appropriate technical responses. Its official website provides an incident reporting facility for organisations and other members of its constituency.

Organisations covered by the applicable cybersecurity directions should follow the reporting requirements and timelines prescribed under those directions. They should not wait until every technical detail is available if an incident is subject to the six-hour reporting requirement.

CERT-In's official reporting channels include:

• Incident reporting email: [email protected]
• Official website: www.cert-in.org.in
• Incident reporting facility: Available through the Reporting section of the CERT-In website.

When reporting an incident, the organisation should provide relevant information about the affected systems, the nature of the incident, its discovery and the technical details available at that time. It should also preserve relevant logs and evidence for further examination, subject to applicable legal and regulatory requirements.

Users and organisations can visit the CERT-In official portal to access the current incident reporting instructions and other reporting facilities.

Does CERT-In Handle Online Financial Fraud Complaints?

CERT-In's primary responsibility is cybersecurity incident response. It is not the main public complaint portal for reporting cybercrime or requesting the recovery of money lost through online fraud.

If a person loses money through an online financial fraud, they should immediately contact the national cybercrime helpline at 1930 and report the incident through the National Cyber Crime Reporting Portal.

For other cybercrime complaints, the same national portal provides an official reporting facility. CERT-In and law enforcement agencies may have complementary roles when a cyber incident also involves a criminal offence.

How Does CERT-In Work with Government, Industry and International Partners?

Cybersecurity incidents rarely remain limited to one organisation. An attack on a service provider, software product or digital platform can affect several organisations and users. Effective response therefore requires timely information sharing and coordination between different stakeholders.

CERT-In works with a wide range of organisations and institutions, including:

• Central and state government departments.
• Public-sector undertakings and government organisations.
• Private companies and technology service providers.
• Internet service providers and data centres.
• Sectoral and state Computer Security Incident Response Teams (CSIRTs).
• Information Sharing and Analysis Centres (ISACs).
• Cybersecurity product vendors and security researchers.
• Academic institutions and law enforcement agencies.
• International CERTs and regional and global cybersecurity forums.

These relationships help the agency exchange technical information, understand emerging threats and coordinate responses to incidents that affect multiple organisations or sectors.

CERT-In's official collaboration framework explains its engagement with government departments, industry, academia, law enforcement agencies and international cybersecurity organisations.

National Cyber Coordination Centre (NCCC)

CERT-In also implements the National Cyber Coordination Centre (NCCC), which examines cyberspace to identify cybersecurity threats and shares relevant threat intelligence with concerned organisations, state governments and stakeholder agencies.

The NCCC supports national cybersecurity coordination by helping relevant stakeholders obtain information about potential threats and take appropriate action. It is an important part of the country's wider cybersecurity monitoring and coordination framework.

The Government has confirmed CERT-In's role in implementing the NCCC in its official cybersecurity preparedness update.

Sector-Specific Cybersecurity Coordination

Some sectors require specialised cybersecurity arrangements because their digital systems support essential services and large-scale operations.

For example, CSIRT-Fin supports cybersecurity coordination in the financial sector, including banking, financial services and insurance. It facilitates information sharing, incident response and technical guidance for relevant financial organisations.

Similarly, CSIRT-Power supports cybersecurity coordination in the power sector. Its activities include analysing cyber incidents, using threat intelligence and helping strengthen the security posture of organisations in the sector.

The Government's January 2026 backgrounder on CERT-In explains the roles of these sector-specific arrangements.

International Cybersecurity Cooperation

Cyberattacks can originate outside India and affect systems located in several countries. International cooperation is therefore important for exchanging technical information and coordinating responses to cross-border cyber threats.

CERT-In engages with international Computer Security Incident Response Teams, regional cybersecurity groups and global forums. These relationships help it share relevant information, learn from international practices and contribute to coordinated cybersecurity efforts.

Its official collaboration page provides further information about its engagement with international cybersecurity partners.

What Has CERT-In Achieved? Latest Cybersecurity Activities and Statistics

CERT-In's activities provide an indication of the scale of cybersecurity threats faced by organisations in India and the importance of coordinated incident response.

According to a Ministry of Electronics and Information Technology release dated 14 August 2026, the number of cybersecurity incidents observed and tracked by CERT-In over the previous three years was as follows:

These figures represent cybersecurity incidents observed and tracked by CERT-In. They should not be confused with the number of individual cybercrime complaints registered by police or submitted through the National Cyber Crime Reporting Portal.

The Government's January 2026 backgrounder also reported several CERT-In activities during 2025, including:

• Handling more than 29.44 lakh cybersecurity incidents.
• Issuing 1,530 security alerts.
• Publishing 390 vulnerability notes and 65 advisories.
• Empanelling 231 cybersecurity audit organisations.
• Conducting specialised technical training and cybersecurity awareness programmes.
• Organising cybersecurity drills and preparedness exercises with participating organisations.

These figures are based on the Government's published account of CERT-In's 2025 activities. Readers can verify the details in the CERT-In backgrounder published by PIB on 23 January 2026.

For the latest available official incident figures, refer to the MeitY release dated 14 August 2026.

How Does CERT-In's Role Differ from I4C, Cyber Crime Police and NCIIPC?

India has several institutions responsible for cybersecurity, cybercrime prevention and the protection of important digital infrastructure. Although their work may overlap during a major cyber incident, each organisation has a different primary responsibility.

Understanding these differences helps individuals and organisations approach the correct authority for their requirements.

CERT-In vs I4C

The most important distinction is that CERT-In focuses on cybersecurity incident response, whereas I4C focuses on coordinated action against cybercrime.

For example, if a company suffers a ransomware attack, CERT-In may support technical incident response, threat analysis and mitigation. If the same attack involves criminal activity, the concerned law enforcement agency may investigate the offence. I4C supports national-level coordination and capabilities for handling cybercrime.

CERT-In vs Cyber Crime Police

CERT-In is not a replacement for the police. Its primary responsibility is to address cybersecurity incidents from a technical and coordination perspective. Cybercrime police investigate offences, examine evidence and take legal action against suspected offenders.

Therefore, a person who loses money through an online scam should report the matter through the appropriate cybercrime reporting channels rather than treating CERT-In as a police complaint portal.

CERT-In vs NCIIPC

CERT-In and NCIIPC both contribute to India's cybersecurity framework, but their statutory responsibilities are different.

CERT-In performs national cybersecurity incident response functions under Section 70B. NCIIPC operates under Section 70A and focuses on protecting Critical Information Infrastructure, which includes important systems and assets whose disruption or destruction may have a serious impact on national security, the economy, public health or safety.

The Government explains NCIIPC's separate role in its official cybersecurity framework update.

What Is Cyber Swachhta Kendra and How Is It Related to CERT-In?

Cyber Swachhta Kendra (CSK) is a CERT-In initiative that focuses on improving cyber hygiene and helping users protect their internet-connected devices from botnets and malware.

A botnet is a network of devices infected with malicious software and controlled by an attacker. Such infected devices may be used for activities such as sending spam, launching distributed denial-of-service attacks or carrying out other malicious operations.

Cyber Swachhta Kendra works as a Botnet Cleaning and Malware Analysis Centre. It provides information, guidance and free tools that help users identify and remove certain malware infections from their devices.

Its work includes:

• Providing free malware and botnet removal tools.
• Sharing information about malicious software and infected devices.
• Promoting safe internet practices and cyber hygiene.
• Working with relevant stakeholders to identify and address malware-related threats.
• Publishing cybersecurity tips and awareness material for users.

Cyber Swachhta Kendra is therefore one part of CERT-In's wider cybersecurity prevention and awareness activities. It does not replace the agency's broader responsibilities relating to incident response, vulnerability coordination and national cybersecurity preparedness.

Users can visit the official Cyber Swachhta Kendra About page to learn more about its purpose and services.

Frequently Asked Questions About CERT-In

What Does CERT-In Stand For?

CERT-In stands for Indian Computer Emergency Response Team. It is India's national agency for responding to cybersecurity incidents under Section 70B of the Information Technology Act, 2000.

Is CERT-In a Government Organisation?

Yes. CERT-In is a Government of India organisation that operates under the Ministry of Electronics and Information Technology (MeitY). It performs statutory functions relating to cybersecurity incident prevention, response and coordination.

When Was CERT-In Established?

CERT-In has been operational since January 2004. Its statutory framework is provided under Section 70B of the Information Technology Act, 2000, which was introduced through the Information Technology Amendment Act, 2008.

Does CERT-In Work Only with Government Departments?

No. Its constituency includes government departments, public-sector organisations, private companies, service providers, academic institutions, researchers and individual internet users.

What Is the Main Function of CERT-In?

Its main function is to coordinate responses to cybersecurity incidents in India. It also collects and analyses incident information, issues security alerts, supports vulnerability coordination and promotes better cybersecurity practices.

Does CERT-In Investigate Cybercrime Cases?

CERT-In conducts technical incident analysis and can support investigations through its cybersecurity and forensic capabilities. However, criminal investigations and related legal action are handled by competent law enforcement agencies.

What Is Section 70B of the Information Technology Act?

Section 70B provides the statutory basis for CERT-In as India's national agency for cybersecurity incident response. It specifies the agency's functions and gives it certain powers to call for information and issue directions for carrying out those functions.

What Is the Six-Hour Reporting Rule of CERT-In?

CERT-In's directions dated 28 April 2022 require entities covered by the directions to report specified cybersecurity incidents within six hours of noticing them or being informed about them. The requirement applies to the incidents and entities covered by the directions.

What Is the Difference Between CERT-In Alerts and Directions?

Alerts and advisories communicate information about threats and recommended protective measures. Directions issued under Section 70B(6) are statutory instructions that impose applicable requirements on the entities covered by them.

How Can an Organisation Report a Cybersecurity Incident to CERT-In?

Organisations can use the incident reporting facility on the official CERT-In website or report incidents through the designated email address, [email protected]. They should follow the applicable reporting instructions and statutory timelines.

Does CERT-In Provide 24×7 Incident Response Services?

Yes. CERT-In provides a 24×7 cybersecurity incident response service to support the reporting and handling of cybersecurity incidents.

What Is the Relationship Between CERT-In and Cyber Swachhta Kendra?

Cyber Swachhta Kendra is an initiative operated by CERT-In. It focuses on botnet cleaning, malware analysis, device hygiene and public awareness. It provides free tools and guidance to help users address certain malware-related threats.

Is CERT-In the Same as I4C?

No. CERT-In is responsible for cybersecurity incident response and coordination under MeitY. I4C operates under the Ministry of Home Affairs and strengthens coordination and capabilities for dealing with cybercrime.

Should I Report Online Payment Fraud to CERT-In?

No. People who lose money through online financial fraud should immediately call the national cybercrime helpline at 1930 and report the incident through the National Cyber Crime Reporting Portal. CERT-In's primary role is cybersecurity incident response, not handling individual financial fraud recovery complaints.

Where Can I Find CERT-In's Latest Security Advisories?

Users and organisations can visit the CERT-In official website to access its latest security alerts, vulnerability notes, advisories and cybersecurity guidance.

Conclusion

CERT-In plays an important role in protecting India's digital environment by coordinating cybersecurity incident response, analysing threats, issuing security advisories and helping organisations strengthen their security arrangements. Its responsibilities under Section 70B of the Information Technology Act, 2000 make it a central institution in India's national cybersecurity framework.

Its work also extends to vulnerability coordination, security audits, cyber crisis preparedness, technical training and public awareness. Through collaboration with government departments, businesses, sectoral response teams and international partners, CERT-In helps improve the country's ability to prevent, manage and recover from cybersecurity incidents.

For official information, security advisories, reporting instructions and cybersecurity guidance, users can visit the CERT-In official website.