Why Businesses Need an Incident Response Plan
When a security incident happens, the first 60 minutes determine everything — how much data is lost, how quickly you recover, and whether you meet the 6-hour CERT-In reporting deadline. Without a pre-built plan, most teams panic and make things worse.
6 hrsCERT-In mandatory incident reporting window (CERT-In Direction 2022)
WidespreadMost Indian businesses have no documented incident response plan — turning a contained incident into a business-ending one
₹2.7 CrAverage cost reduction with an IR team in place (IBM Cost of a Data Breach 2025)
287 daysAverage breach lifecycle without IR plan vs 150 days with plan (IBM 2025)
DANGER
Without a plan, the average breach takes 287 days to identify and contain. With a plan, it takes 150 days. That 137-day difference translates to millions in reduced damage.
The 6-Phase Incident Response Framework
graph LR
A[1. Prepare
Before incident] --> B[2. Identify
Detect & assess] B --> C[3. Contain
Stop the spread] C --> D[4. Eradicate
Remove the threat] D --> E[5. Recover
Restore operations] E --> F[6. Learn
Post-mortem] style A fill:#1e5f3a,stroke:#10B981,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
Before incident] --> B[2. Identify
Detect & assess] B --> C[3. Contain
Stop the spread] C --> D[4. Eradicate
Remove the threat] D --> E[5. Recover
Restore operations] E --> F[6. Learn
Post-mortem] style A fill:#1e5f3a,stroke:#10B981,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
Phase 1: Prepare (Do This NOW)
Before any incident happens, you need:
| Item | Description | Owner |
|---|---|---|
| IR team roster | Who does what during an incident | CTO/CEO |
| Contact list | Phone numbers for team, legal, CERT-In, insurance | Operations |
| Communication templates | Pre-written emails for customers, press, regulators | Marketing/Legal |
| CERT-In reporting template | Pre-filled form ready to submit | IT Lead |
| System access credentials | Emergency admin access (stored in password vault) | IT Lead |
| Backup verification | Confirmed working backups with tested recovery | DevOps |
| Legal counsel | Pre-engaged cybersecurity lawyer | CEO |
Phase 2: Identify (First 30 Minutes)
When you suspect an incident:
- Confirm it's real — Is this a false alarm or an actual security event?
- Classify severity — Critical, High, Medium, or Low
- Assess scope — What systems are affected? What data is at risk?
- Start the clock — CERT-In's 6-hour window starts when you become aware
| Severity | Definition | Response Time |
|---|---|---|
| Critical | Active data exfiltration, ransomware spreading | Immediate |
| High | Confirmed breach, system compromise | Within 1 hour |
| Medium | Suspicious activity, potential exploitation | Within 4 hours |
| Low | Anomalous but non-threatening activity | Within 24 hours |
Phase 3: Contain (Hours 1-4)
graph TD
A[Incident
Confirmed] --> B{Can we isolate
affected systems?} B -->|Yes| C[Network Isolation
Disconnect affected systems] B -->|No| D[Credential Reset
Change all passwords/keys] C --> E[Preserve Evidence
Take forensic snapshots] D --> E E --> F[Block Attack Vector
Firewall rules, WAF blocks] style A fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Confirmed] --> B{Can we isolate
affected systems?} B -->|Yes| C[Network Isolation
Disconnect affected systems] B -->|No| D[Credential Reset
Change all passwords/keys] C --> E[Preserve Evidence
Take forensic snapshots] D --> E E --> F[Block Attack Vector
Firewall rules, WAF blocks] style A fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Key containment actions:
- Isolate affected servers from the network
- Revoke compromised credentials
- Block attacker's IP addresses
- Take forensic snapshots BEFORE cleaning
WARNING
Do NOT wipe or restart affected systems before taking forensic snapshots. You need evidence for CERT-In reporting and potential legal proceedings.
Phase 4: Eradicate (Hours 4-24)
- Remove malware/backdoors from all affected systems
- Patch the vulnerability that was exploited
- Reset all credentials (not just compromised ones)
- Verify no persistence mechanisms remain
Phase 5: Recover (Days 1-7)
- Restore from clean backups
- Monitor restored systems for reinfection
- Gradually bring services back online
- Verify data integrity
Phase 6: Learn (Week 2)
- Conduct a blameless post-mortem
- Document timeline, actions taken, and outcomes
- Update IR plan based on lessons learned
- Schedule a VAPT scan to verify fixes
CERT-In Reporting: What You Must Do
Hour 0Incident detected — start the clock
Hour 1Classify severity, begin containment
Hour 4Prepare CERT-In incident report
Hour 6SUBMIT to CERT-In (deadline — mandatory)
Hour 24Submit detailed incident report to CERT-In
Day 7Submit root cause analysis
Day 30Submit remediation completion report
What CERT-In Requires in Your Report
| Field | Details |
|---|---|
| Organisation details | Name, sector, contact person |
| Incident type | Data breach, ransomware, DDoS, etc. |
| Date and time of detection | Must be precise |
| Systems affected | IP addresses, hostnames, services |
| Impact assessment | Number of records, data types, business impact |
| Containment actions | What you've done so far |
| Evidence preserved | Logs, snapshots, samples |
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanIR Plan Template for Indian Businesses
Download and customise this framework:
Team Structure (Minimum viable):
| Role | Person | Backup |
|---|---|---|
| Incident Commander | CEO/CTO | Senior Developer |
| Technical Lead | CTO/Lead Developer | DevOps Engineer |
| Communications | CEO/Marketing | HR Lead |
| Legal | External Lawyer | — |
| CERT-In Liaison | CTO | CEO |
Key Takeaway
The best incident response plan is one you never need. The second best is one you've practised. Run a tabletop exercise every quarter — walk through a hypothetical breach scenario with your team. It takes 1 hour and reveals gaps you wouldn't find otherwise.
Prevent Incidents Before They Happen
INFO
Most incidents start with a vulnerability that could have been found in a VAPT scan. Book a free scan at Bachao.AI to identify and fix your vulnerabilities before attackers exploit them.
Written by Shouvik Mukherjee, Founder of Bachao.AI. Contact: ceo@bachao.ai. Follow me on LinkedIn for incident response and cybersecurity insights.
