What Should You Do in the First Hour of a Cyber Incident?
Key takeaways
- Isolate first, and isolate by unplugging the network path rather than shutting the machine down, because a powered-off device loses volatile evidence that later proves what happened.
- CERT-In directions require organisations to report cyber security incidents to CERT-In within six hours of noticing them, and to keep logs for 180 days.
- The 1930 helpline and cybercrime.gov.in are the fastest route when money has moved, and calling the bank early is what makes a freeze or chargeback possible.
- A written timeline started in the first hour, with times, systems and actions, becomes the backbone of the CERT-In report, the insurer's claim and any police complaint.
- Under the DPDP Act 2023, if personal data has been compromised, the breach must be reported to the Data Protection Board and to the affected individuals without delay.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should you do in the first 15 minutes of a cyber incident?
Stop the bleeding without destroying the evidence. Note the time you first noticed the problem and write it down. If a laptop, server or phone shows signs of compromise, disconnect it from the network but do not power it off, because memory holds the running processes that later identify the intrusion. If an email account is suspected, change the password from a different, clean device and revoke active sessions rather than deleting the account or messages. If money has moved, call the bank's fraud helpline and the 1930 cyber helpline immediately. Do not forward suspicious mail with the attachment intact, and do not use a compromised machine to change passwords, because that hands the attacker your new credentials.
Who do you need to call in the first hour of an incident?
Three calls, in this order. Your internal owner who can authorise containment, usually the IT head or a security lead, because they can take the affected systems offline. Your bank or payment provider, if there is any financial movement, because a freeze applied early is what makes recovery possible later. And the 1930 cyber crime helpline or cybercrime.gov.in, if there is a crime element, which creates an official record and a case number. CERT-In notification is not a substitute for any of these; the six-hour CERT-In clock runs from the moment you noticed the incident, and missing it is a compliance failure even if the incident itself was contained.
What evidence must you preserve in the first hour?
Preserve what would otherwise disappear, and do it without touching the originals. Take photographs and screenshots of what the user actually saw, including the error message, the file name, the email header and the timestamp. Export the relevant logs from the mail server, the identity provider, the firewall and the endpoint, and copy them to storage the attacker does not have access to. Keep the ransom note, the suspicious payment instructions, the phishing email with its full headers, and the device in its current state. If a forensic examination is likely, write down every action you took, in order, with times, because the chain of custody starts with the first person's actions and not with the forensic report.
What must not happen in the first hour?
Four habits cause most of the damage. Do not wipe, reimage or reinstall the affected systems; you will destroy the evidence and probably the encryption keys you need for recovery. Do not pay the ransom to make it stop, because payment buys a promise, funds the next attack and, in India, leaves you with a criminal liability problem rather than a clean outcome. Do not discuss the incident on open company channels, because attackers monitor their own access logs. And do not issue a reassuring all-clear internally before you know the scope, because a wrong all-clear message is what stops a real report from reaching the people who can act.
| Time | Action | Why it matters |
|---|---|---|
| 0-15 min | Note the time, isolate the device from the network, leave it powered on | Stops spread and preserves volatile evidence |
| 0-15 min | Call the bank's fraud helpline and 1930 if money is involved | A freeze applied early is what makes recovery possible |
| 15-30 min | Change passwords from a clean device and revoke active sessions | Cuts off the attacker's access to the account |
| 30-45 min | Export and copy mail, identity, firewall and endpoint logs | Logs are the evidence and the CERT-In report |
| 45-60 min | Start a written timeline with times, systems and actions taken | The backbone of the report, the claim and any FIR |
| Within 6 hours | Report to CERT-In, and to the police if a crime is involved | CERT-In's six-hour reporting window is a legal duty |
What are the frequently asked questions?
Get a straight answer on this
Send us the timeline of what you noticed and when, and we will return a written first-hour incident response runbook for your systems.
Send us the details See pricing