Startup Cyber-Incident Tabletop Exercise India: Founder Playbook for Breach, Ransomware and Payment Outage
A tabletop exercise exposes unclear owners and missing evidence before a real breach, ransomware event or payment outage turns into a company-wide crisis.
Search intent and key terms
Primary keyword: startup cyber incident tabletop exercise India
Intent: Practical and informational: Indian startup founders preparing a decision-ready cyber-incident response exercise.
Direct answer for founders
Run a 60–90 minute decision rehearsal using a realistic incident timeline, named decision owners, a reporting-clock tracker and an evidence checklist. The aim is not to test technical trivia. It is to learn whether the company can detect, classify, contain, report, communicate and recover while preserving reliable records.
CERT-In’s directions require covered entities to report specified cyber incidents within six hours of noticing them or being brought to notice. The Best CS Firm In India approach is to start the clock visibly, assign one accountable incident lead and document every decision, assumption and hand-off.
Choose a realistic scenario
| Scenario | First signal | Decisions to rehearse |
|---|---|---|
| Ransomware | Files encrypted and admin account active | Isolation, evidence, backups, ransom policy |
| Personal-data exposure | Public link or exfiltration alert | Scope, access shutdown, affected data, notices |
| Payment fraud | Unknown beneficiary or API payout spike | Payment hold, bank contact, credential rotation |
| Cloud outage | Production unavailable across regions | Failover, vendor escalation, customer updates |
| Insider misuse | Unusual download before employee exit | Access suspension, HR/legal coordination, preservation |
| Supply-chain compromise | Vendor token used from new location | Third-party isolation, dependency mapping, recovery |
Tabletop roles and decision rights
| Role | Owns | Must not do alone |
|---|---|---|
| Incident commander | Priorities, cadence and decision log | Make legal or public claims without review |
| Technical lead | Containment, forensics and recovery facts | Destroy evidence through premature cleanup |
| Legal/compliance | Reporting analysis, privilege and notices | Delay urgent containment |
| Operations/finance | Payments, vendors and continuity | Resume unsafe transactions |
| Communications | Employee, customer and public updates | Speculate on cause or scope |
| Founder/board liaison | Risk acceptance and governance updates | Override evidence-based safety controls |
A 90-minute exercise flow
| Time | Inject | Expected output |
|---|---|---|
| 0–15 min | Initial alert with incomplete facts | Commander, severity and incident channel |
| 15–30 min | New affected system or account | Containment choice and evidence hold |
| 30–45 min | Possible reportable category | Reporting owner, deadline and known facts |
| 45–60 min | Customer or journalist inquiry | Approved holding statement and escalation |
| 60–75 min | Vendor or insurer requests data | Authorised sharing route and record |
| 75–90 min | Recovery option with residual risk | Go/no-go criteria and follow-up actions |
CERT-In and evidence checklist
- Identify whether the event matches a reportable category in Annexure I of the directions.
- Record when the organisation first noticed the incident or was brought to notice.
- Prepare the available facts promptly; later details can follow as the investigation develops.
- Preserve relevant system, identity, application, network and cloud logs.
- Maintain ICT logs securely for the applicable period and within India as required by the directions.
- Use synchronised time sources so events can be reconstructed reliably.
- Record every containment action, credential rotation and system change.
Communication guardrails
| Audience | Say | Avoid |
|---|---|---|
| Employees | What action is required and where to report | Rumour or broad blame |
| Customers | Known impact, protective steps and update time | Unverified root cause |
| Regulators | Facts, times, systems and current response | Unsupported conclusions |
| Vendors | Specific evidence or containment request | Unnecessary personal data |
| Public/media | Approved holding statement and next update | Absolute assurances before investigation |
After-action checklist
- Convert each gap into an owner, deadline and measurable fix.
- Update contact lists, escalation trees and out-of-band communication routes.
- Test backup restoration and privileged-access recovery separately.
- Reconcile insurance, vendor and regulatory notification requirements.
- Improve logging where the team could not answer basic scope questions.
- Brief the board on material gaps and accepted residual risk.
- Schedule a repeat exercise to verify that fixes work.
Founder / Business Takeaway
A good exercise ends with fewer assumptions, faster decisions and named fixes. Rehearse the clock, preserve evidence, communicate only verified facts and prove that recovery can happen without recreating the same risk.
Sources and verification
https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf
https://www.cert-in.org.in/PDF/FAQs_on_CyberSecurityDirections_May2022.pdf
https://www.indiacode.nic.in/indiacode/handle/123456789/22037?view_type=browse
Frequently Asked Questions
What is a cyber-incident tabletop exercise?
It is a discussion-based rehearsal in which decision-makers respond to a realistic incident timeline without touching live production systems.
Free Weekly Newsletter
Subscribe to BSA startup funding alerts
- Every Sunday, all Indian startup funding alerts in one place
- Monthly funding report on the last day of the month
- Free, concise, founder-focused, and easy to unsubscribe
Get the complete Indian startup funding roundup in your inbox, covering deals, sectors, investor moves, and founder readiness notes from the week.
Built for founders, investors, CFOs, and advisors
No spam. Unsubscribe anytime.
How often should a startup run the exercise?
Run it at least annually and after major changes to infrastructure, payments, vendors or leadership; higher-risk businesses should rehearse more often.
Does every incident have to be reported to CERT-In within six hours?
The six-hour rule applies to the reportable incident categories and entities covered by the CERT-In directions. Classify quickly and obtain specialist advice when scope is uncertain.
Should the exercise include customers and vendors?
Include internal owners first, then test how critical vendors, insurers, counsel and communications partners will be contacted and coordinated.
Suggested internal links
Need a founder-focused review?
BSA supports Indian startups with contracts, compliance, fundraising readiness and decision-grade documentation.
