CyberDudeBivash Major Incident Response Playbook (India)

0) Pre-incident readiness (do this today)

RACI & war-room: name an Incident Commander (IC), Comms Lead, Forensics Lead, Legal/Compliance POC, IT Ops Lead, HR. Keep a 24×7 on-call rota and a single “/warroom” channel.
CERT-In pack: prefill incident-report template; list channels — incident@cert-in.org.in, helpline 1800-11-4949, fax 1800-11-6969 — and your org’s CERT-In POC details. en.vikaspedia.in lexcomply.com
Time & logs: ensure clocks are NTP-synced to NIC/NPL (or traceable) and retain security logs for 180 days in India so you can produce them during reporting/investigations. azb CERT-In
Process baseline: adopt a standard IR lifecycle (Prepare → Detect → Contain → Eradicate → Recover → Lessons). Use NIST SP 800-61 r3 as your current reference (r2 was withdrawn on Apr 3, 2025). NIST Publications

1) First 15 minutes — detect, declare, stabilize

Validate the alert; open an “INC-####” ticket; appoint the IC.
Snapshot & preserve: collect volatile artifacts (process list, netstat, memory image), start a timeline, and don’t reboot affected hosts.
Isolate safely: block egress to known C2/IOCs, disable compromised accounts, and move impacted assets to quarantine VLANs.

2) Minutes 15–60 — contain & scope fast

Triage severity (High if data exfil, ransomware, widespread lateral movement, or crown-jewel impact).
Scoping: hunt for persistence (scheduled tasks, services, startup items, cloud tokens), enumerate blast radius (users, endpoints, SaaS, cloud).
Comms: brief Execs/Legal; pre-draft external holding line (“We’re investigating a security incident; services remain available; more updates to follow”).

3) Within 6 hours — comply with CERT-In

Report to CERT-In within 6 hours of noticing/being notified, even if initial info is partial. Include incident type, time, indicators, affected systems, actions taken, and a 24×7 contact. Send to incident@cert-in.org.in; you may also call 1800-11-4949. Trilegal lexcomply.com
Be ready to provide logs and other details on demand; the 2022 Directions require timely reporting and evidence production. Trilegal

Tip: keep a one-click export from SIEM/EDR for the last 7–14 days focused on the MITRE ATT&CK techniques observed. Your 180-day log retention policy ensures deeper lookback if CERT-In requests it. azb

4) 6–24 hours — eradicate & harden

Kill persistence: remove scheduled tasks, rogue services, startup artifacts; rotate creds, API keys, and SSO secrets; invalidate OAuth refresh tokens.
Patch & block: fix exploited CVEs; add network/DNS blocks; enable stricter email auth (SPF, DKIM, DMARC) if BEC played a role.
Forensics chain-of-custody: hash every artifact, record who collected/handled it, and preserve originals.

5) Up to 72 hours — data-breach obligations

If personal data is involved, evaluate notification under India’s Digital Personal Data Protection (DPDP) regime. Draft 2025 Rules propose a 72-hour window to inform the Data Protection Board and (where required) affected users — confirm applicability with counsel and follow the latest notified rules. MEDIANAMA IAPP saikrishnaassociates.com

6) Recovery — clean, verify, monitor

Rebuild worst-hit systems from known-good images; re-baseline EDR and integrity monitoring.
Gradual restoration behind feature flags/rate limits; enable heightened detection rules and 7–14 days of surge monitoring.

7) After-Action (within 7–10 days)

Root-cause with a clear kill-chain; quantify dwell time, MTTD/MTTR, and control gaps.
Lessons & fixes: codify new detection rules, tabletop the scenario, and update the IR plan, playbooks, and runbooks.
Regulatory wrap-up: file follow-ups to CERT-In with refined details; document evidence of compliance steps (timestamps, logs, contacts). Trilegal

Quick checklists you can paste into your ticket

A) One-page IR checklist

IC named & war-room open
Incident ticket created & severity set
Volatile data captured (mem, net, proc)
Affected assets isolated
Leadership & Legal briefed
CERT-In notified (≤6h); evidence/logs ready
DPDP assessment started (breach/not breach)
Persistence removed; creds/keys rotated
Recovery validated & monitoring heightened
After-action scheduled; docs updated

B) Ransomware first moves (add to A)

Stop spread: isolate; disable SMB where feasible
Identify initial access (phish, exposed RDP, vuln)
Search for exfil (cloud storage links, C2, TOR)
Contact law enforcement where appropriate; preserve notes for insurance/regulatory needs

C) BEC / Payment fraud (India-specific)

Freeze the transaction immediately with bank nodal officer; open case on National Cyber Crime Reporting Portal/Helpline 1930 to try fund-freeze within the “golden hour.” i4c.mha.gov.in Cybercrime.gov.in
Enable DMARC “p=reject”, tighten vendor verification (call-back checks), and rotate mailbox rules/tokens.

Copy-paste templates

CERT-In initial email (subject & body)
Subject: [URGENT] Cyber Incident Notification — <Org>, <INC-####>, <Initial Severity>
Body:

When noticed: <IST date & time>
Incident type: <e.g., ransomware/BEC/cloud key abuse>
Affected systems/users/tenants: <high-level>
Indicators: <hashes, IPs, domains, URLs>
Actions taken so far: <containment/eradication>
Point of Contact (24×7): <name, title, phone, email>
Logs available: <SIEM/EDR/network>
(Send to incident@cert-in.org.in; follow with helpline if needed.) en.vikaspedia.in

Customer holding statement (if services affected):
“We detected and contained a security incident on <date>. There’s no evidence of ongoing risk to transactions. As a precaution, we rotated credentials and increased monitoring. If we confirm personal-data impact, we will inform affected users and the authorities per law. Updates will be posted at <status page/URL>.”

Minimum technical evidence kit (per endpoint)

Memory dump, process tree, network connections, autoruns/persistence list, EDR timeline, recent Windows Event Logs or Linux journal, browser storage/tokens, cloud access logs.

What “good” looks like in India (controls to prove)

CERT-In 6-hour reporting is wired into runbooks, with logs & contacts ready. Trilegal
180-day log retention and NTP sync demonstrably in place. azb CERT-In
NIST-aligned lifecycle followed (current SP 800-61 r3). NIST Publications
DPDP breach assessment completed and, if applicable, 72-hour notifications prepared per latest rules.
🚀 Stay Ahead of Cyber Threats!
Daily Cybersecurity News, Threat Intel & AI Security Insights. Visit 👉 https://cyberdudebivash.com 🔐 #CyberDudeBivash

Cyberdudebivash