NC4
National Cyber Incident Reporting Hub
A clean, guided reporting experience for citizens, organizations, and critical entities in Kenya.
Choose a reporting option and review its handling notice before submitting.
Start here
How can we help?
Already submitted a report or vulnerability disclosure? Check its status with your reference →
Reporting steps
- Contain the incident immediately and preserve evidence.
- Classify impact and identify reporter profile.
- Submit the official report using the dedicated form URL.
- Maintain follow-up updates until recovery is stable.
Who can report
- Citizen / Foreigner: Account compromise, phishing, fraud, impersonation, suspicious digital activity.
- Private Organization: Incidents affecting enterprise systems, staff, customers, operations, or data.
- Government Organization: Public-sector incidents requiring coordinated institutional handling.
- CII / Essential Entity: Critical or essential service incidents requiring priority reporting and escalation.
What to do now
Use this first when an incident is active. It gives a time-based response sequence for containment and escalation.
Communication guidance
Use this when preparing updates for users, leadership, or the public to avoid panic, misinformation, and over-disclosure.
CII notification guide
Use this for CII/essential service incidents that require structured notification details and severity-based escalation.