Report an Incident

Mandatory Cybersecurity Incident Reporting

Under Botswana’s Cybersecurity Act, 2025, an owner of critical information infrastructure or Critical National Information Infrastructure is required to report a cybersecurity incident to the relevant sectoral CSIRT or Botswana-CSIRT immediately after detection, and in any event within eight (8) hours.

Organizations should therefore not wait until an incident has been fully investigated or resolved before reporting it. Early notification enables Botswana-CSIRT to assess the incident, coordinate the appropriate response, provide technical assistance, support containment and mitigation, and determine whether other organizations or infrastructure may be at risk.

Incident Reporting Contacts

Cybersecurity incidents, suspected compromises, vulnerabilities, and other security concerns should be reported to Botswana-CSIRT through:

Toll-Free Incident Reporting:

0800 155 201

0800 155 202

Office: +267 368 5548 /3186927

Emergency: +267 73111260

Email : security@cirt.org.bw  or incidents@cirt.org.bw 

When reporting an incident, organizations should provide, where available, the incident date and time, affected systems or services, nature of the incident, indicators of compromise, source and destination information, and relevant supporting evidence.

The eight-hour cybersecurity incident reporting requirement is separate from the 72-hour personal data breach notification requirement under Botswana's Data Protection Act, 2024, where applicable.

Reporting Procedures

Section 53 of the Cybersecurity Act, 2025, requires immediate notification and a preliminary report within eight hours, followed by a detailed report once the incident is resolved.  Owners of critical information infrastructure and Critical National Information Infrastructure are required to immediately notify Botswana-CSIRT of any perceived or actual cybersecurity incident that falls within the scope of section 53 of the Cybersecurity Act, 2025. Following notification, a preliminary cybersecurity incident report must be submitted immediately after detection and within a period not exceeding eight (8) hours. A detailed cybersecurity incident report must subsequently be submitted once the incident has been resolved.

Incident Reporting Procedure

Organisations should follow the procedure below when reporting a cybersecurity incident to Botswana-CSIRT:

  1. Detect and assess the incident:  Identify the suspected or actual cybersecurity incident and take reasonable immediate steps to preserve systems, evidence, logs, and other relevant information.

  2. Notify Botswana-CSIRT immediately: Contact Botswana-CSIRT as soon as the incident is detected. Organizations should not wait for the investigation to be completed before making the initial notification

  3.  Submit the preliminary report within 8 hours: Provide the required preliminary incident information within eight (8) hours, including, where available:

  • Name and contact details of the reporting organization;

  • Date and time the incident was detected.

  • Nature and classification of the incident.

  • Affected systems, networks, services, or infrastructure.

  • Known or suspected impact.

  • Indicators of compromise and relevant technical information.

  • Actions already taken to contain or mitigate the incident; and

  • Contact details of the person responsible for coordinating the response.d

  1.  Coordinate with Botswana-CSIRT
    Botswana-CSIRT will assess the reported incident and, where appropriate, coordinate technical assistance, threat intelligence, containment, mitigation, escalation, and communication with relevant stakeholders.

  2.  Preserve evidence and maintain records
    The affected organization should preserve relevant logs, system information, forensic evidence, communications, and other records necessary to support investigation and response.

  3. Submit the detailed incident report after resolution
    Once the incident has been resolved, the organization should submit a detailed report documenting the incident, root cause where established, impact, response actions, lessons learned, and measures implemented or planned to prevent recurrence. This is consistent with section 53 of the Cybersecurity Act, 2025.

    Incident Reporting Contacts

Toll-Free Incident Reporting:
0800 155 201
0800 155 202
Office: +267 368 5548 /3186927
Emergency: +267 72111260

For urgent incidents, organizations should use the toll-free reporting numbers or emergency Number above  for immediate notification and provide the available incident information to Botswana-CSIRT. Additional technical information and supporting evidence can be provided as the investigation progresses.

Remember: Detect → Notify Immediately → Submit Preliminary Report Within 8 Hours → Coordinate Response → Preserve Evidence → Submit Detailed Report After Resolution.

The reporting procedure is now clearly structured around immediate notification, the 8-hour preliminary reporting requirement, coordinated response, evidence preservation, and submission of the detailed report after resolution.

Failure to Report Incident 

Failure to Report: Failure to report a qualifying cybersecurity incident within the prescribed period is an offense under the Cybersecurity Act, 2025, section 56 (6). A company may be liable to an administrative penalty of up to 10% of its annual turnover, while a natural person may face a fine of up to P250,000, imprisonment for up to three years, or both. 

All suspected or actual cybercrime incidents involving individuals should be reported to the nearest Botswana Police Service (BPS) station for investigation and appropriate action as specified in the Botswana Cybercrime and Computer Related Act https://cirt.org.bw/policies-acts