Evidence-first authority page
CERT-In Incident Reporting: What AI Security Tools Must Address
What CERT-In's cybersecurity incident reporting directions require, and why this site does not claim a specific AI product is CERT-In compliant.
Direct answer
This page explains what CERT-In's incident reporting requirements generally cover, so a security team can evaluate a vendor's log-retention and reporting support directly — no AI product is listed as verified CERT-In compliant here, since that claim requires primary-source verification this site does not currently hold for any catalog entity.
Last reviewed 2026-08-29
This page remains noindex while its page-level source receipts are completed and verified. It is available for review, not presented as publication-ready authority.
Why this isn't a populated vendor directory
CERT-In compliance is an obligation of the organization operating the system, tied to specific log-retention windows and mandatory incident-reporting timelines — a security tool can support these requirements (by retaining the right logs, for example) without the tool itself being independently 'CERT-In compliant.' Framing it as a product certification would misstate how the obligation actually works.
What CERT-In's directions generally require
- Reporting specified categories of cybersecurity incidents within a mandated timeframe of detection.
- Maintaining logs of ICT systems for a defined retention period within India.
- Designating a point of contact for CERT-In coordination.
How to evaluate a security tool against this
Check whether the tool retains logs for the required window, whether logs are stored within India if that's a requirement for your sector, and whether the tool can produce the specific log formats your incident-reporting process needs — these are checkable product features, distinct from a compliance certification claim.