Home › Free tools › Incident response runbook
Answer a few questions and get a runbook with your own people and numbers in it: the first 15 minutes, the first hour, the six-hour CERT-In report, the DPDP breach notice, and what to do for ransomware, payment fraud, a lost laptop or a taken-over account.
Leave a box empty if you have not decided yet: the runbook marks it as a gap to fill.
Incident response runbook1 Summary
2 The runbook
3 What this could not check
A starting runbook from your answers, based on CERT-In’s Directions of 28 April 2022 and the DPDP Act, 2023 and Rules, 2025. Your regulator’s and your contracts’ own rules apply as well. Guidance, not legal advice; see the terms.
The questions people search for before they run the check.
Who leads and who to call, what to do in the first minutes and the first hour, how and when to report (to CERT-In within six hours, and under the DPDP Act if personal data is involved), what to do for the common incidents such as ransomware and payment fraud, how to recover, and a log of what was done. This builder puts all of that in one document.
The types listed in CERT-In's Directions of 28 April 2022, among them compromised systems or data, ransomware and other malware, unauthorised access to email or social media, website defacement and data breaches, within six hours of noticing. Report to incident@cert-in.org.in, phone 1800-11-4949 or fax 1800-11-6969, using the current form on cert-in.org.in.
Yes, once the DPDP Rules' duties apply from 13 May 2027: tell the Data Protection Board and each affected person without delay, and send the Board a detailed report within 72 hours (Rule 7). Many organisations prepare for it now.
Call your bank immediately and ask them to recall or freeze the payment, then report it on the national helpline 1930 and at cybercrime.gov.in the same day. Early reports have the best chance of freezing the money.
No. The runbook is built in your browser, and the names and numbers you type appear only on the page and in the PDF you download. If you ask for the PDF, we keep your own details and a one-line summary, never the names in the runbook.
Two hours walking your team through a simulated incident turns it into a plan: who calls whom, where the logs are, and how long a restore really takes.