What Happens First
- Immediate containment to stop the breach from spreading
- Forensic analysis to understand what happened and how
- CERT-In mandatory incident reporting, within the 6-hour window
- Clear communication throughout — no black box
After Containment
- Step-by-step recovery process back to normal operations
- Full post-incident report — what happened, what we did, what's next
- Defence updates so the same vulnerability can't be used again