A cybersecurity incident response plan (IRP) is a documented, structured approach to detecting, containing, eradicating, and recovering from security breaches—minimising damage, cost, and downtime. For Indian businesses subject to CERT-In’s mandatory 6-hour breach reporting requirement and the DPDP Act’s data protection obligations, having a tested incident response plan is not optional but a legal and operational necessity that can reduce breach costs by 50-60% compared to ad-hoc responses. Last updated October 2026.
What Are the Six Phases of Incident Response?
The NIST Cybersecurity Framework and SANS Institute define incident response in six phases. Here is how each applies to Indian businesses:
Phase 1: Preparation
Preparation is the most important phase—it determines how effectively you respond when an incident occurs:
- Form an Incident Response Team (IRT): Designate roles—Incident Commander (typically CISO or IT head), technical analysts, communications lead, legal counsel, and HR representative. For SMEs without dedicated security staff, identify who fills each role and establish relationships with external IR consultants (retainers cost ₹1-5 lakh/year).
- Document the plan: Create a written IRP covering escalation procedures, communication templates, contact lists (internal, CERT-In, legal, insurance, PR), evidence preservation procedures, and decision trees.
- Deploy tools: Ensure logging is enabled on all critical systems (SIEM, endpoint detection, network monitoring). Key tools for Indian businesses include open-source options like Wazuh (SIEM) and commercial options like CrowdStrike Falcon or SentinelOne (endpoint) at ₹500-₹2,000 per endpoint/year.
- Establish baselines: Document what “normal” looks like for your network traffic, login patterns, and system behaviour. You cannot detect anomalies without knowing the baseline.
- Conduct drills: Run tabletop exercises quarterly and full simulation exercises annually. Test the plan before you need it.
Phase 2: Detection and Analysis
Detecting a breach quickly is critical—the average dwell time (time between breach and detection) globally is 204 days. Faster detection means less damage:
- Monitoring sources: SIEM alerts, endpoint detection alerts, firewall/IDS logs, user reports, threat intelligence feeds, and dark web monitoring.
- Triage: Not every alert is an incident. Classify alerts using a severity matrix: Critical (active data exfiltration, ransomware), High (confirmed unauthorised access), Medium (suspicious activity requiring investigation), Low (policy violations, failed login spikes).
- Initial analysis: Determine scope (which systems, how many users), attack vector (phishing, vulnerability exploitation, insider), and timeline (when did the breach start).
Phase 3: Containment
Containment stops the spread while preserving evidence:
- Short-term containment: Isolate affected systems from the network (disable network ports, move to quarantine VLAN). Do NOT power off systems—this destroys volatile memory evidence.
- Evidence preservation: Take forensic images of affected systems before any remediation. Memory dumps, disk images, and log exports. This evidence is required for CERT-In reporting and potential legal proceedings.
- Long-term containment: Apply temporary fixes (firewall rules, credential resets, disabling compromised accounts) that allow business operations to continue while you prepare for eradication.
Phase 4: Eradication
Remove the threat completely:
- Identify and patch the exploited vulnerability
- Remove malware, backdoors, and persistence mechanisms
- Reset all potentially compromised credentials
- Scan all systems for indicators of compromise (IOCs)
- Verify that the attacker’s access is fully revoked
Phase 5: Recovery
Restore normal operations carefully:
- Restore systems from clean backups (verify backup integrity before restoring)
- Monitor restored systems intensively for signs of re-compromise
- Gradually restore network access in stages
- Validate data integrity and business process functionality
Phase 6: Lessons Learned
Within 1-2 weeks of incident resolution:
- Conduct a post-incident review with all involved parties
- Document timeline, decisions, what worked, and what failed
- Update the IRP based on findings
- Implement preventive measures to address the root cause
- Brief leadership on incident impact and remediation investments needed
CERT-In Reporting Requirements for Indian Businesses
India’s Computer Emergency Response Team (CERT-In) mandates that organisations report cybersecurity incidents within 6 hours of detection. Key requirements:
| Requirement | Detail |
|---|---|
| Reporting timeline | Within 6 hours of noticing the incident |
| Reporting method | Email to incident@cert-in.org.in with prescribed format |
| Log retention | 180 days minimum, within Indian jurisdiction |
| Reportable incidents | Targeted scanning, compromise of systems, data breaches, ransomware, DoS/DDoS, website defacement, malware, identity theft, phishing attacks |
| Penalty for non-compliance | Fines and potential criminal liability under IT Act |
Incident Response Plan Template for Indian SMEs
A practical IRP for small and medium enterprises should include:
- Contact sheet: IRT members, CERT-In, cyber insurance provider, external IR firm, legal counsel, PR contact
- Severity classification matrix: Clear criteria for Critical/High/Medium/Low
- Escalation flowchart: Who notifies whom, and at what severity level
- Communication templates: Internal notification, customer notification, regulatory notification (CERT-In format), media statement
- Evidence preservation checklist: Step-by-step for non-technical staff who may discover the breach first
- Recovery priorities: Ranked list of business-critical systems and their recovery order
- Vendor contacts: Hosting provider emergency contact, cloud provider incident support, payment processor fraud team
Frequently Asked Questions
How much does an incident response plan cost for an Indian SME?
Creating an IRP internally costs primarily in staff time—40-80 hours for the initial plan. Hiring a consultant to develop one costs ₹1-5 lakh. An IR retainer with a cybersecurity firm (pre-negotiated hourly rates and guaranteed response times) costs ₹2-10 lakh/year depending on scope and response time SLAs.
What are the most common cybersecurity incidents in India?
CERT-In’s annual reports consistently show phishing, ransomware, and website defacement as the top incident categories. Business Email Compromise (BEC) targeting Indian companies has surged, with attackers impersonating CEOs or CFOs to authorise fraudulent wire transfers. UPI-related fraud is also increasingly reported.
Do I need cyber insurance in India?
Strongly recommended. Cyber insurance policies in India (offered by ICICI Lombard, HDFC ERGO, Bajaj Allianz, Tata AIG) typically cost ₹50,000-₹5,00,000/year for coverage of ₹50 lakh-₹10 crore. Policies cover incident response costs, legal fees, regulatory fines, business interruption, and customer notification expenses. Premiums are lower if you have a documented IRP.
What should I do in the first 60 minutes of discovering a breach?
First 60 minutes: (1) Confirm the incident is real—not a false positive, (2) Activate the IRT and notify the Incident Commander, (3) Begin containment—isolate affected systems from the network, (4) Preserve evidence—do not reboot or wipe anything, (5) Start your CERT-In reporting clock—you have 6 hours total. Do not attempt to investigate deeply before containing the spread.
How often should we test our incident response plan?
Conduct tabletop exercises (discussion-based walkthroughs of scenarios) quarterly—they take 2-4 hours and cost nothing beyond staff time. Conduct full simulation exercises (hands-on technical testing) annually. Update the plan after every real incident, organisational change (new systems, staff changes), or significant infrastructure change.
