Data Breach Response Playbook: First 48 Hours
Execute rapid breach response with containment, investigation, notification, and recovery in the critical first 48 hours.
Hour 0-2: Immediate Actions
- Activate incident response team
- Preserve evidence
- Initial containment
- Notify management
- Engage legal counsel
Hour 2-8: Investigation
- Scope the breach
- Identify compromised data
- Determine attack vector
- Document timeline
- Secure affected systems
Hour 8-24: Containment
- Isolate affected systems
- Reset credentials
- Patch vulnerabilities
- Block attacker access
- Monitor for persistence
Hour 24-48: Notification
- Regulatory notifications (CERT-IN, DPDP)
- Affected individuals
- Partners/vendors
- Public disclosure (if required)
- Media management
Post-Breach Actions
- Full forensic analysis
- Root cause identification
- Remediation plan
- Security improvements
- Lessons learned
Communication Plan
- Internal communication
- Customer notification
- Regulatory filing
- Media statement
- Ongoing updates
Need breach response support? 24/7 emergency hotline.