Incident Response Plan for Indian SMBs: A Step-by-Step Playbook

An incident response plan (IRP) tells every person in your organisation exactly what to do in the first minutes of a cyberattack — before panic sets in. Without one, Indian SMBs lose days recovering instead of hours. Under CERT-In's 2022 directions, certain cyber incidents must be reported within six hours of detection. Miss that window and you compound the breach with a compliance violation. This playbook walks you through the six NIST SP 800-61 phases, India-specific legal obligations, the roles and responsibilities every team needs, and a first-hour checklist for ransomware and data breaches.

Why Most Indian SMBs Have No Written IR Plan

The gap is not ignorance — it is prioritisation. When a founding team is racing to hit revenue targets, a 20-page incident response procedure feels like a luxury. Then ransomware encrypts the NAS at 2 a.m. and the team discovers they have no offline backup, no contact tree, and no designated incident commander.

A few hours' delay in containment enables lateral movement, PII exfiltration, and propagation to cloud-synced drives. Forensic evidence gets overwritten. The CERT-In 6-hour clock is already ticking.

The 258-day IBM figure is the global average including large enterprises with dedicated SOC teams. For an Indian SMB with no playbook, the exposure window is typically far longer.

The Six Phases of Incident Response (NIST SP 800-61)

NIST Special Publication 800-61 ("Computer Security Incident Handling Guide") and the SANS PICERL framework both converge on six phases. The full NIST guide is available at nist.gov. Each phase has a hard deliverable — not just an activity.

Phase 1 — Preparation

Preparation is everything you do before an incident occurs. It is the only phase that runs continuously and feeds every other phase. Key deliverables: asset inventory, contact tree with personal mobile numbers, offline credentials, pre-approved authority for the incident commander to isolate systems without board approval, and at least one tabletop exercise per year.

Phase 2 — Identification

Detection is not the same as identification. An alert fires — a failed login spike, an EDR quarantine, a customer complaint about receiving unknown emails from your domain. Identification means determining whether this is a real incident, classifying its type and severity, and formally declaring an incident so the clock-driven response kicks in.

The CERT-In 6-hour window starts at "awareness," which in practice means the moment your team receives credible evidence of a qualifying incident. Document the exact timestamp.

Phase 3 — Containment

Containment has two sub-phases: short-term (stop the bleeding immediately — disconnect affected hosts from the network, revoke compromised credentials, block malicious IPs at the perimeter) and long-term (implement compensating controls that are stable enough to allow the business to operate while eradication is underway).

Critical rule: do not wipe or re-image systems before taking a forensic snapshot. Regulators and cyber insurers both require evidence preservation.

Phase 4 — Eradication

Remove every trace of the adversary: malware binaries, persistence mechanisms (scheduled tasks, registry run keys, rogue admin accounts, web shells), and the exploited vulnerability. Patching before the root cause is fully understood means eradication is incomplete.

Phase 5 — Recovery

Restore affected systems to production with enhanced monitoring in place. Do not rush — ransomware groups frequently leave a secondary backdoor that activates after the victim believes they have recovered. Verify restored data against known-good backups and expand logging verbosity for at least 30 days post-recovery.

Phase 6 — Lessons Learned

Within two weeks of closure, hold a post-incident review. Produce a written report: timeline, what worked, what failed, root cause, and specific changes to runbooks and controls. This document doubles as your evidence record for CERT-In and insurers.

India-Specific Legal Obligations

CERT-In 6-Hour Reporting

Under CERT-In's April 2022 directions, Internet Service Providers, intermediaries, data centres, body corporates, and government organisations must report qualifying cyber incidents within 6 hours of noticing them. Qualifying incidents include: targeted scanning, compromised critical systems, unauthorised access, data breaches, identity theft, denial of service, and attacks on critical information infrastructure. Report via cert-in.org.in or email incident@cert-in.org.in.

DPDP Act 2023 — Breach Notification to the Data Protection Board

India's Digital Personal Data Protection Act 2023 requires Data Fiduciaries (any entity processing personal data) to notify the Data Protection Board of India of a personal data breach, regardless of fault. Penalties for failure to safeguard personal data are significant. Your IR plan must include a legal lead whose first task on a breach declaration is to assess whether personal data was involved and trigger the DPDP notification process. See our DPDP compliance guide for the full obligations.

Roles, Responsibilities, and RACI

Every IR plan needs named humans, not job titles. Job titles change. Mobile numbers do not.

Building the Four Artefacts Your Plan Needs

1. Asset Inventory

You cannot protect what you do not know you have. Maintain a living spreadsheet (or CMDB) with: hostname, IP, owner, OS version, data classification, last patch date, and backup status. A runbook that says "isolate the database server" is useless if no one knows its IP at 3 a.m.

2. Runbooks

A runbook is a step-by-step procedure for a specific scenario: ransomware on an endpoint, credential stuffing on the login API, web shell on the application server. Each runbook should be printable and offline-accessible — attackers sometimes cut your internet access.

3. Contact Tree

One encrypted document with an offline copy: personal mobile numbers for every team member, ISP abuse contact, cloud provider security emergency line, cyber insurer breach hotline, CERT-In filing contact, and legal retainer emergency number.

4. Tested Backups

A backup that has never been restored is a hypothesis, not a control. Run a restore drill at least quarterly and confirm the restore target is air-gapped or immutable — ransomware strains routinely encrypt network-accessible backup shares within minutes of gaining a foothold.

What to Do in the First Hour of a Ransomware or Breach

The pie reflects a qualitative breakdown based on practitioner experience and NIST SP 800-61 guidance — actual distribution varies by incident type and organisation size.

Tabletop Exercises: Practice Before the Fire

A tabletop exercise is a structured, discussion-based simulation where the team walks through a scenario without touching production systems. Run one per quarter, rotating scenarios: ransomware, credential breach, insider threat, supply chain compromise. The goal is to discover where your plan breaks — every gap found in a tabletop is one that does not cost you six hours of CERT-In clock.

Putting It All Together: IR Plan Readiness Checklist

Dhisattva AI Pvt Ltd built this guide as part of the broader security awareness mission behind Bachao.AI. For a technical view of where your attack surface currently stands, start with a free VAPT scan — vulnerabilities found before an attacker does are vulnerabilities that never become incidents.