The CERT-In FAQ says reporting a vulnerability on its own, unconnected with a cyber security incident, is not mandatory at present. Reporting the incident types in Annexure I within 6 hours is. Most confusion comes from mixing those two things up.
Myth: every new CVE in our stack must go to CERT-In
Fact: the FAQ question 15 asks for confirmation that vulnerability reporting under the CERT-In Rules is voluntary. The answer says that at present, reporting a vulnerability as a standalone item, unconnected with a cyber security incident, is not mandatory.
Finding a CVE in a dependency does not start a 6 hour clock. Exploitation of it might.
Myth: an exploited vulnerability is only a patching problem
Fact: Annexure I lists "compromise of critical systems or information" and "unauthorised access of IT systems or data". The annex explanation says compromise typically happens through exploitation of vulnerabilities, among other methods. If someone used the flaw against you, you may have a reportable incident, whatever the severity label on the CVE says.
Myth: our customer contract forbids disclosure, so we cannot report
Fact: the FAQ says the statutory duty to report overrides a confidentiality clause in a contract.
Myth: we need the full forensic picture first
Fact: the FAQ says to provide the information available when you report and add more later within reasonable time.
Myth: scanning of our network is not an incident
Fact: the first item on the list is targeted scanning or probing of critical networks and systems. Not every port scan qualifies, but you need a rule for deciding.
Myth: reporting is only for big companies
Fact: the directions name service providers, intermediaries, data centres, body corporate and government organisations. The FAQ says individual citizens are not covered, but a small company is a body corporate. Size does not exempt you from the incident reporting duty.
A decision rule for the on-call engineer
- Is there evidence of exploitation, access, malware, data exposure or an attack on a listed system type? Treat it as a possible Annexure I incident and start the clock.
- Is it only a vulnerability, with no sign of use? Handle it through your normal vulnerability process and track it.
- Unsure? Escalate to the person who decides reportability rather than letting it sit.
Where scanning helps
Knowing which services are exposed and which components carry known flaws makes the second question answerable quickly. Safeguard's reachability analysis and dependency scanning can show whether a flawed component is actually used in your code, which helps triage but is not a substitute for judging whether an incident occurred.
Quick check
Is voluntary vulnerability disclosure to CERT-In still welcome?
The FAQ says standalone vulnerability reporting is not mandatory. It does not say it is unwelcome. Check CERT-In current guidance for how to submit.
Sources
Last reviewed: 19 October 2026.
