The first 6 hours of a cyber incident in India: contain, preserve, report to CERT-In within 6 hours, and the 1930 helpline for financial fraud.
The first six hours of a cyber incident are about containment, evidence and notification, in that order. CERT-In requires listed incidents to be reported within 6 hours of detection to incident@cert-in.org.in, with a 1800-11-4949 helpline, and logs retained for 180 days. Financial fraud must also be reported on the National Cyber Crime Reporting Portal at cybercrime.gov.in or the 1930 helpline, because reporting speed is what freezes the money. A forensic examiner should capture volatile evidence before anything is powered off, and the 2-hour and 3-hour takedown windows in India's amended IT Rules 2026 apply to NCII and AI-generated content.
Four things, in this order. Activate the response plan and the named call tree, because the first hour is when people improvise and improvise is what destroys evidence. Isolate the affected host, account or device, but do not power it off, because volatile memory holds the running processes, the open network connections and sometimes the encryption keys. Preserve the endpoint and the identity logs, and record the exact time of detection, because a six-hour CERT-In clock and a five-day banking compensation window both run from timestamps. And open the reporting log, not just the technical log, so that every decision, phone call and action is recorded with a time and a name. A Kochi pharmaceutical firm lost Rs 99 lakh in October 2026 because an accounts-department phone was compromised, which is a reminder that the first hour is often a phone call, not a server room.
Four reporting tracks, and they run in parallel rather than in sequence. CERT-In, for listed incidents, within 6 hours, to incident@cert-in.org.in, with the 1800-11-4949 helpline available for assistance. The National Cyber Crime Reporting Portal at cybercrime.gov.in, and the 1930 helpline, for anything involving financial fraud or loss, because a freeze depends on speed. The Money Restoration Portal, when money has moved, and a complaint to the bank and NCRP within 5 calendar days, since RBI's June 2026 instructions effective 1 January 2027 allow compensation of 85% of net loss or Rs 25,000, whichever is less, for a genuine individual victim with gross loss up to Rs 50,000 who reports in time. And the relevant sector regulator, such as SEBI, which issued a formal caution to listed companies on 17 July 2026 over the Boss Scam.
Six expensive mistakes. Do not wipe or reimage a device, because you destroy the attacker's artefacts and your own evidence. Do not reset the compromised account from the same device that was compromised, because you hand the attacker a fresh session. Do not pay the ransom as a first move, because it destroys negotiation leverage and is illegal in some jurisdictions. Do not delete or edit logs, because a log gap is treated as spoliation and CERT-In's 180-day retention rule is a hard expectation. Do not communicate externally beyond what the response plan says, including on social media, because the Kochi Metro Rail breach data circulated on WhatsApp in 2026 before the organisation had a position. And do not let a vendor connect to production before a written authorisation and an evidence protocol exist.
Start from the Indian regulatory obligations, because they are the hard constraints. CERT-In's 6-hour reporting and 180-day retention go into the plan as timings, not as aspirations. DPDP Rule 7 notification obligations commence from May 2027, so the data breach notification path should be drafted now rather than then, and 83% of Indian organisations have not begun comprehensive DPDP implementation. Then the practical layer: named people with deputies, a call tree that works on a Sunday, an out-of-band channel for the decision to engage counsel or a regulator, a forensics retainer, pre-agreed logs of 24 hours of behaviour per quarter, and a tabletop exercise. AAVETech runs a fixed-price tabletop and plan review at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround.
| Clock | Action | Owner |
|---|---|---|
| 0-15 min | Activate plan, isolate without powering off, log the time | Incident commander |
| 15-60 min | Preserve endpoint, identity and gateway logs | IT and forensic support |
| 1-3 h | Notify CERT-In for listed incidents, escalate to forensics | Compliance lead |
| 1-3 h | Report financial fraud on cybercrime.gov.in or 1930 | Finance and compliance |
| 2-3 h | Request removal of NCII and AI-generated content | Legal and communications |
| 3-6 h | Issue holding statement, brief board and insurer | Founder and counsel |
The first six hours of a cyber incident are about containment, evidence and notification, in that order. CERT-In requires listed incidents to be reported within 6 hours of detection to incident@cert-in.org.in, with a 1800-11-4949 helpline, and logs retained for 180 days. Financial fraud must also be reported on the National Cyber Crime Reporting Portal at cybercrime.gov.in or the 1930 helpline, because reporting speed is what freezes the money. A forensic examiner should capture volatile evidence before anything is powered off, and the 2-hour and 3-hour takedown windows in India's amended IT Rules 2026 apply to NCII and AI-generated content.
Start the internal response plan and isolate the affected system, then call CERT-In on 1800-11-4949 and report listed incidents to incident@cert-in.org.in within 6 hours. If money is involved, report on cybercrime.gov.in or the 1930 helpline immediately, because a freeze depends on speed, and file on the Money Restoration Portal.
At AAVETech retainer clients are engaged within 4 hours for emergencies and 12 hours otherwise, with a named incident response lead and a documented triage path before arrival. Non-retainer clients are engaged within 12 hours, and a retainer is the only way to compress that number materially.
It is not a technical decision and it should not be taken in the first hours. Payment does not guarantee a working decryptor, destroys negotiation leverage, may be unlawful in some jurisdictions, and in most Indian ransomware cases the exfiltrated data means the extortion continues. Involve counsel and an incident commander, and keep working the recovery path in parallel.
CERT-In requires listed incidents to be reported within 6 hours, with 180 days of logs retained. DPDP Rule 7 notification obligations to data principals commence from May 2027, and the amended IT Rules 2026 add 2-hour removal for non-consensual intimate imagery and 3-hour removal for AI-generated content once reported.
At AAVETech a fixed-price plan review and tabletop exercise runs at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a retest included. The output is a plan with timings, named roles, a call tree and a regulatory notification matrix.
Read the full guide on AAVETech: What Should You Do in the First 6 Hours of a Cyber Incident?.
Call +91 98473 40580 and ask for the incident response lead; retainer clients are engaged within 4 hours and others within 12.
Talk to an analyst about this.