Mission 26
Cybersecurity Incident Response Playbook for Indian Businesses
When something goes wrong, a simple, practised playbook helps a small business act quickly and calmly. This mission walks owners and managers through prepare, identify, contain, preserve evidence, recover, report and learn, with an incident contact card ready before you need it.
In this mission you will
- Describe the seven stages of a simple incident response playbook for a small business.
- Prepare an incident contact card with primary and backup contacts, providers, bank route and reporting channels.
- Choose safe first actions for a suspected email compromise or payment fraud, including contacting the bank and using 1930 or cybercrime.gov.in.
- Explain why evidence must be preserved and why reporting duties should be confirmed with official sources and advisers.
Do not wait for certainty
Most incidents in small businesses start small: an odd email, a payment that does not arrive, a laptop acting strangely, a customer saying they received a strange message from you. The biggest mistake is waiting to be sure. By the time everyone is certain, money may have moved and data may have left. A playbook is a short, agreed set of steps so people can act early, without panic and without blame.
The seven-stage playbook
- 1Prepare: before anything happens, agree who leads, keep an incident contact card, know your critical systems and keep tested backups.
- 2Identify: anyone who notices something unusual reports it at once through the agreed channel. The incident lead decides how serious it may be.
- 3Contain: limit the damage using authorised steps, such as disconnecting an affected laptop from the network, securing an account through the approved process or asking the bank to stop a payment.
- 4Preserve evidence: keep the suspicious email, screenshots, payment references and a written timeline. Do not wipe or reset devices before deciding what evidence is needed.
- 5Recover: restore systems and data from trusted sources and clean backups, change access through the approved process, and confirm everything works before returning to normal.
- 6Report: notify the bank or payment provider, customers or partners where needed, and the relevant authorities through official channels as appropriate.
- 7Learn: hold a short, blame-free review. What happened, what worked, what was slow, and one or two fixes to make.
Reporting to CERT-In and other authorities
CERT-In, the national cyber incident response agency, has issued directions that require certain types of cyber incidents to be reported within set timelines. Whether and how these apply to your business depends on your organisation and the type of incident. Personal data rules may also create duties to inform authorities or affected people. Do not guess. Before an incident, check current directions on the official CERT-In website, review data protection requirements on official sources and confirm your duties with a qualified adviser. Write the outcome into your playbook so nobody has to look it up under pressure.
Your incident contact card
- Internal incident contact, and a backup contact if they are unavailable.
- IT or security service provider and how to reach them out of hours.
- Bank and payment provider official contact routes for fraud.
- Domain, email and cloud provider support routes.
- Legal or privacy adviser.
- Owners of critical services such as billing, production or the website.
- Approved incident reporting channels, including 1930 and cybercrime.gov.in for financial fraud.
- Last review date.
Communicate safely during an incident
If an email account may be compromised, assume the attacker can read it. Use a phone call or a separate trusted channel to coordinate. Do not send sensitive details through the affected system. Tell staff only what they need to know, and agree who speaks to customers so messages are calm, accurate and consistent. Avoid guessing in public about what happened or who was responsible.
Practical business example
Malabar Spice Traders follows the card
Malabar Spice Traders, a fictional 20-person wholesaler in Kozhikode, had made an incident contact card six months earlier. One Friday afternoon, the accounts executive, Joseph, noticed that a customer had paid an invoice to an unfamiliar bank account after receiving an email that seemed to come from the company. He told the owner, Mrs Nair, at once. She followed the card. She called the bank’s official fraud line and gave the transaction reference, then called 1930 and filed a report on cybercrime.gov.in. The IT provider, also on the card, secured the email account through the approved process and found a forwarding rule. Joseph saved the email and screenshots and wrote a timeline. Mrs Nair called the customer by phone, not email. The following week, the team held a blame-free review and added MFA and a monthly check for forwarding rules.
The lesson: Preparation turned a stressful Friday into a sequence of clear steps. Early reporting, safe communication and preserved evidence gave the business the best chance to limit the damage and learn.
Key takeaways
- Follow seven stages: prepare, identify, contain, preserve evidence, recover, report and learn.
- Do not wait for certainty; report early through the agreed channel and act without blame.
- For financial fraud, contact the bank’s official line at once and use 1930 or cybercrime.gov.in.
- Preserve evidence before wiping or resetting anything, and coordinate through a trusted channel if email may be compromised.
- Confirm CERT-In and data protection reporting duties in advance using official sources and a qualified adviser.
Scenario lab · +25 XP
The mailbox that might be compromised
You are the operations manager at Narmada Electricals, a fictional 50-person electrical goods distributor in Indore. A sales executive, Rohit, tells you that several customers have phoned to ask about an email from his account requesting urgent payment to a new bank account. Rohit did not send it. You have an incident contact card, but you have never used it.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
What do you do first?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Build your incident contact card
Prepare your contact card now, before you need it. Record names, roles and official contact routes only. Do not include passwords, recovery codes, account numbers or real incident details.
- 1.Name a primary incident contact and a backup contact, with their phone numbers.
- 2.Add your IT or security provider, and domain, email and cloud provider support routes.
- 3.Add your bank and payment provider official fraud contact routes, plus 1930 and cybercrime.gov.in.
- 4.Add your legal or privacy adviser and the owners of your critical services.
- 5.Note your approved reporting channel and a reminder to verify current CERT-In directions with your adviser.
- 6.Store the card in an approved place reachable during an outage, add a review date and walk the team through it.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress