Incident response
Think you are under attack? Start here.
Tell us what is happening and a responder will call you back. If systems are actively being encrypted, disconnect them from the network first, but do not power them off.
First hour checklist
- Contain. Isolate affected devices from the network. Keep them powered on to preserve evidence in memory.
- Preserve. Do not wipe, reinstall or delete anything. Keep logs, emails and screenshots.
- Secure access. Reset credentials for affected and admin accounts from a clean device.
- Notify. Inform your leadership, legal and insurer. Check which regulators must be told.
- Call us. Share facts, not guesses. We will triage and agree next steps with you.
Reporting clocks to keep in mind
- CERT-In (India): certain cyber incidents must be reported within 6 hours of noticing them.
- DPDP Act (India): personal-data breaches must be intimated to the Data Protection Board and affected people, with a detailed report within 72 hours.
- Sector regulators: SEBI, RBI, GDPR, NIS2 and DORA each set their own deadlines.
This is general guidance, not legal advice. Confirm obligations with your counsel and regulator.
Want help on call before it happens? Ask about an incident response retainer.