What Is an Incident Response Plan?
Key takeaways
- A plan is a set of decisions, not a document, so the test is whether a substitute can run it at 2 am on a Sunday.
- Severity levels with fixed response times remove the argument about whether an incident is serious enough to escalate.
- Every role needs a named backup, because the primary is on leave exactly when a serious incident happens.
- The external obligations belong in the plan body: CERT-In within six hours, the 1930 helpline, the bank, and the DPDP Act 2023 notifications.
- A tabletop exercise a year is what turns the plan into a working process, and it is far cheaper than discovering the gaps during a real incident.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should an incident response plan contain?
Six sections. Scope: which systems, data and sites are in scope, including cloud and third-party services. Roles: a named incident lead, technical lead, communications lead, legal contact and sponsor, each with a backup. Severity: three or four levels, each with a definition and a response time, for example a critical level with containment started within one hour. Procedures: what to do for a suspected compromise, ransomware, a data breach, a fraud and a lost device. Communications: who tells employees, customers, regulators, the police and the press. And obligations: the CERT-In six-hour report, the 1930 helpline and bank contacts for fraud, and the DPDP Act 2023 notification path.
Who needs to be in an incident response plan for a small business?
For a ten-person Indian company, four named people and a written fallback. The incident lead, who can declare an incident and authorise taking systems offline. The technical lead, who does the isolation, log collection and restoration. The owner or a director, who authorises money, talks to the bank and signs the CERT-In and DPDP notifications. And the communications lead, who handles customers, staff and the press so the technical lead is not interrupted. For each, name the backup. Also name the external parties: the hosting provider, the cyber law firm, the bank and the incident response vendor, with the number to call at 2 am, because a retainer only works if somebody knows to use it.
How often should an incident response plan be tested?
At least once a year, and after every significant change to the estate, because an untested plan is a document, not a control. A full tabletop is enough for most Indian SMEs: pick a realistic scenario such as a ransomware note on a file server, walk the clock from detection to containment to recovery to notification, and let each role speak their section aloud. Run a second, shorter exercise on one hard question, such as a customer data exposure needing a DPDP notification. The exercises cost a day and they surface the two things that always fail: the missing authority to act, and the contact details that are out of date.
How does an incident response plan satisfy DPDP and CERT-In obligations?
It satisfies them by turning duties into named tasks with deadlines. The DPDP Act 2023 requires notification to the Data Protection Board and to affected data principals in the event of a personal data breach, and the plan states who assesses the breach, who drafts the notice and who files it. CERT-In's directions require incident reporting within six hours of noticing and log retention for 180 days, and the plan names the person who files and where the template lives. The point is that an auditor can be shown the plan and asked which line covers each obligation, and the answer is a line number rather than an opinion.
| Section | Contains | Failure it prevents |
|---|---|---|
| Scope | Systems, data, cloud and third parties in scope | An incident nobody owns because it is outside the plan |
| Roles | Incident lead, technical lead, comms, legal, sponsor, plus backups | Nobody can authorise containment in time |
| Severity levels | Three or four levels with fixed response times | Endless debate about whether it is serious |
| Procedures | Ransomware, breach, fraud, lost device runbooks | Improvisation from scratch during the incident |
| Communications | Employee, customer, regulator, press channels | The technical lead being interrupted for hours |
| Obligations | CERT-In 6 hours, 1930, bank, DPDP notifications | A missed regulatory deadline and a personal data breach penalty |
What are the frequently asked questions?
Get a straight answer on this
Send us the names of your team and your current escalation contacts, and we will draft the incident response plan skeleton for your review.
Send us the details See pricing