Incident response planning is the structured process of preparing for, detecting, containing, and recovering from cybersecurity incidents before they cause irreversible damage. Organisations with a tested incident response plan reduce breach costs significantly and recover faster — yet most Indian businesses still lack a formal plan, leaving them to improvise during crises.
Why Do You Need a Formal Incident Response Plan?
Without a plan, incident response degrades into panic. The consequences are predictable:
- Delayed detection allows attackers to dwell longer, extracting more data or deploying ransomware across more systems.
- Uncoordinated response leads to evidence destruction, inconsistent communication, and regulatory violations.
- Recovery takes weeks instead of days because there is no predefined process for system restoration and business continuity.
- Under India’s DPDP Act and CERT-In directives, organisations must report certain incidents within six hours. Without a plan, meeting this deadline is nearly impossible.
What Are the Phases of Incident Response?
The industry-standard framework (based on NIST SP 800-61) has six phases:
- Preparation: Build the team, define roles, deploy tools, create playbooks, and conduct training. This is where most of your investment goes.
- Identification: Detect the incident through monitoring, alerts, user reports, or threat intelligence. Classify its severity and scope.
- Containment: Isolate affected systems to stop the attack from spreading — short-term containment (disconnect the compromised server) and long-term containment (apply patches, change credentials).
- Eradication: Remove the root cause — malware, unauthorised access, compromised accounts. Verify no persistence mechanisms remain.
- Recovery: Restore systems from clean backups, monitor for re-infection, and gradually return to normal operations.
- Lessons learned: Conduct a post-incident review. What worked? What failed? Update the plan, fix gaps, and retrain the team.
How Do You Build an Incident Response Team?
An effective Computer Security Incident Response Team (CSIRT) needs defined roles:
| Role | Responsibility |
|---|---|
| Incident Commander | Overall coordination, decision authority, communication with leadership |
| Security Analyst(s) | Detection, triage, investigation, and forensic analysis |
| IT Operations | System isolation, patching, restoration, infrastructure changes |
| Communications Lead | Internal updates, external statements, regulatory notifications |
| Legal/Compliance | Regulatory obligations (CERT-In, DPDP Act), evidence preservation, vendor contracts |
| Management Sponsor | Budget authority, strategic decisions, stakeholder management |
For smaller organisations that cannot staff a full CSIRT, designate an incident lead, keep a retainer with an external incident response firm, and ensure at least two people know the plan inside out.
What Should Your Incident Response Playbooks Cover?
Generic plans fail in practice. Create specific playbooks for your most likely scenarios:
- Ransomware: Isolation steps, backup verification, negotiation policy (pay or not), law enforcement notification.
- Data breach/exfiltration: Scope assessment, affected-user notification, regulatory reporting (CERT-In six-hour window).
- Business email compromise: Account lockdown, financial transaction recall, communication to affected parties.
- DDoS attack: Traffic analysis, CDN/WAF activation, ISP escalation, communication plan.
- Insider threat: HR coordination, access revocation, legal considerations, evidence preservation.
How Do You Test and Maintain the Plan?
- Tabletop exercises: Walk through a scenario verbally with the team quarterly. No technology required — just a room and a realistic scenario.
- Simulation drills: Run a controlled simulated attack (purple team exercise) annually to test detection, response, and recovery in real conditions.
- Plan updates: Review and update the plan after every real incident, every tabletop exercise, and whenever significant infrastructure or team changes occur.
- Contact list maintenance: Keep emergency contact information for team members, vendors, legal counsel, law enforcement, and your cyber insurance provider current and accessible offline.
Frequently Asked Questions
What are India’s mandatory incident reporting requirements?
CERT-In’s 2022 directive requires organisations to report specified cyber incidents within six hours of detection. Reportable incidents include data breaches, ransomware, unauthorised access, and attacks on critical infrastructure. Non-compliance can result in penalties under the IT Act.
How much does building an incident response capability cost?
Costs vary widely. A basic plan with tabletop exercises can be developed for a few lakhs. A fully staffed CSIRT with SIEM tools, forensic capabilities, and external retainers can cost significantly more. The cost of not having one — extended downtime, regulatory fines, customer loss — is almost always higher.
Can we outsource incident response entirely?
You can retain external IR firms (many operate in India), but you still need internal coordination. Someone in your organisation must detect the incident, make the call, authorise containment actions, and handle internal communication. External firms augment your capability; they do not replace internal ownership.
How often should we conduct tabletop exercises?
At minimum, quarterly for the core team and annually for a broader cross-functional exercise that includes legal, communications, and management. More frequent exercises are warranted after major infrastructure changes or following real incidents.
