What Should You Do in the First 6 Hours of a Cyber Incident?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What should happen in the first hour of a suspected breach?

Four things, in this order. Activate the response plan and the named call tree, because the first hour is when people improvise and improvise is what destroys evidence. Isolate the affected host, account or device, but do not power it off, because volatile memory holds the running processes, the open network connections and sometimes the encryption keys. Preserve the endpoint and the identity logs, and record the exact time of detection, because a six-hour CERT-In clock and a five-day banking compensation window both run from timestamps. And open the reporting log, not just the technical log, so that every decision, phone call and action is recorded with a time and a name. A Kochi pharmaceutical firm lost Rs 99 lakh in October 2026 because an accounts-department phone was compromised, which is a reminder that the first hour is often a phone call, not a server room.

Who do you report to, and in what order?

Four reporting tracks, and they run in parallel rather than in sequence. CERT-In, for listed incidents, within 6 hours, to incident@cert-in.org.in, with the 1800-11-4949 helpline available for assistance. The National Cyber Crime Reporting Portal at cybercrime.gov.in, and the 1930 helpline, for anything involving financial fraud or loss, because a freeze depends on speed. The Money Restoration Portal, when money has moved, and a complaint to the bank and NCRP within 5 calendar days, since RBI's June 2026 instructions effective 1 January 2027 allow compensation of 85% of net loss or Rs 25,000, whichever is less, for a genuine individual victim with gross loss up to Rs 50,000 who reports in time. And the relevant sector regulator, such as SEBI, which issued a formal caution to listed companies on 17 July 2026 over the Boss Scam.

What should not be done in a live incident?

Six expensive mistakes. Do not wipe or reimage a device, because you destroy the attacker's artefacts and your own evidence. Do not reset the compromised account from the same device that was compromised, because you hand the attacker a fresh session. Do not pay the ransom as a first move, because it destroys negotiation leverage and is illegal in some jurisdictions. Do not delete or edit logs, because a log gap is treated as spoliation and CERT-In's 180-day retention rule is a hard expectation. Do not communicate externally beyond what the response plan says, including on social media, because the Kochi Metro Rail breach data circulated on WhatsApp in 2026 before the organisation had a position. And do not let a vendor connect to production before a written authorisation and an evidence protocol exist.

How do you build an incident response plan that survives contact with an incident?

Start from the Indian regulatory obligations, because they are the hard constraints. CERT-In's 6-hour reporting and 180-day retention go into the plan as timings, not as aspirations. DPDP Rule 7 notification obligations commence from May 2027, so the data breach notification path should be drafted now rather than then, and 83% of Indian organisations have not begun comprehensive DPDP implementation. Then the practical layer: named people with deputies, a call tree that works on a Sunday, an out-of-band channel for the decision to engage counsel or a regulator, a forensics retainer, pre-agreed logs of 24 hours of behaviour per quarter, and a tabletop exercise. AAVETech runs a fixed-price tabletop and plan review at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround.

What are the common questions about I?