In short
Cyber incidents demand more than a technical response. They can trigger statutory reporting obligations, regulatory scrutiny, contractual commitments and potential civil liability, requiring organisations to coordinate legal, compliance, management and technical functions. A well-defined Cyber Incident Response Team provides the governance structure for making timely decisions, preserving digital evidence, managing regulatory communications and allocating responsibilities during a live incident. This article examines how such teams should be constituted, how decision-making authority should be allocated, and the legal risks that arise when roles and responsibilities are unclear under India’s cyber regulatory framework.
1. Why Every Organisation Needs a Defined Cyber Incident Response Team
Cyber incidents rarely remain confined to technical systems. A ransomware attack, unauthorised access to business networks, or personal data breach can quickly trigger statutory reporting obligations, regulatory scrutiny, contractual notifications and potential civil liability. Responding effectively therefore requires coordinated legal, operational and management decisions rather than technical remediation alone.
In India, this governance framework is reflected in the Information Technology Act, 2000, under which Section 70B establishes the Indian Computer Emergency Response Team (CERT-In) as the national agency for cyber incident response. Its statutory functions include coordinating responses to cyber incidents, issuing directions and guidelines, and requiring information from affected entities. Further, the CERT-In Directions dated 28 April 2022, issued landmark directions under Section 70B(6) of the IT Act, 2000, which require specified cyber incidents to be reported within six hours of becoming aware of the incident, mandate organisations to designate and maintain a Point of Contact for CERT-In communications, and require specified ICT system logs to be retained for 180 days within India. Failure to comply with these directions may attract penalties under Section 70B(7) of the Information Technology Act.
Comparable governance obligations also arise under the Digital Personal Data Protection Act, 2023, the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 for listed entities, and the Reserve Bank of India’s Master Direction on IT Governance, Risk, Controls and Assurance Practices for regulated entities. Collectively, these obligations demonstrate that cyber incident response is a multidisciplinary governance function. A clearly constituted Cyber Incident Response Team enables organisations to allocate responsibilities in advance, coordinate timely decision-making, and respond to legal and regulatory obligations in a structured and defensible manner.
2. What Is a Cyber Incident Response Team?
A Cyber Incident Response Team (CIRT) is a multidisciplinary governance structure responsible for coordinating an organisation’s response to a cyber incident. While technical teams investigate, contain and remediate the incident, the CIRT brings together legal, compliance, management and operational functions to ensure that statutory obligations, regulatory reporting requirements and business decisions are addressed in a coordinated manner.
Neither the Information Technology Act, 2000 nor the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013 prescribes the composition of an incident response team. Instead, they establish the legal framework within which organisations are expected to respond to cyber incidents. Section 70B of the Information Technology Act establishes CERT-In as India’s national agency for cyber incident response and empowers it to coordinate incident response activities, issue directions and advisories, and call for information from affected entities. The CERT-In Directions dated 28 April 2022 further require organisations to report specified cyber incidents, designate a Point of Contact and retain specified ICT logs, all of which require coordinated action across multiple organisational functions.
Accordingly, a Cyber Incident Response Team should not be viewed as synonymous with the IT department or a Security Operations Centre (SOC). Rather, it is the organisational mechanism through which technical, legal and business functions coordinate decision-making, allocate responsibilities and ensure that regulatory obligations are met within prescribed timelines. The precise composition may vary according to an organisation’s size, sector and regulatory profile, but its purpose remains the same: enabling a timely, coordinated and legally compliant response to a cyber incident.
3. Core Members of the Cyber Incident Response Team and Their Legal Responsibilities
The composition of a Cyber Incident Response Team (CIRT) depends on an organisation’s size, business activities and regulatory obligations. While the law does not prescribe a mandatory team structure, organisations should allocate responsibilities in a manner that enables compliance with applicable legal and regulatory requirements. A multidisciplinary team helps ensure that technical response measures are aligned with reporting obligations, evidence preservation, contractual commitments and governance requirements.
Senior Management or Incident Commander
A senior executive should lead the overall response, coordinate decision-making across business functions and ensure that sufficient resources are available to manage the incident. This role is responsible for activating the incident response plan, approving strategic decisions and escalating significant incidents to the board where appropriate. For regulated entities, management oversight also supports compliance with governance expectations under sector-specific regulatory frameworks.
Information Security Team
The Chief Information Security Officer (CISO), IT security team or equivalent technical personnel are responsible for identifying the nature and scope of the incident, containing the threat, preserving affected systems and supporting forensic investigations. Their technical findings form the basis for determining whether statutory reporting obligations are triggered, including those under the CERT-In Directions.
Legal Counsel
Legal counsel plays a central role in assessing statutory obligations, interpreting regulatory requirements and advising on legal risk throughout the incident lifecycle. This includes determining whether notifications to regulators or affected individuals may be required, advising on contractual obligations to customers or business partners, coordinating with external legal advisers where necessary, and helping preserve legal privilege over sensitive communications and investigative work where applicable. Legal oversight also helps ensure that public statements, regulatory submissions and internal communications remain accurate and consistent.
Compliance Officer or Data Protection Officer
Where an organisation has a compliance function or Data Protection Officer, that function should monitor compliance with applicable data protection and sector-specific regulatory requirements. The Data Fiduciary remains responsible for implementing reasonable security safeguards and complying with statutory obligations relating to personal data breaches. Compliance personnel also assist in coordinating regulatory reporting and maintaining records of decisions taken during the incident.
Company Secretary, Human Resources and Communications
For listed entities, the Company Secretary typically assists with governance processes, board reporting and regulatory disclosures where required under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015. Human Resources should manage incidents involving employees, insider threats or compromised personnel records, while the communications team should coordinate external messaging only after consultation with legal and senior management to minimise legal and reputational risks.
External Specialists
Depending on the nature of the incident, organisations may engage external forensic investigators, cybersecurity consultants or specialist legal advisers. Their responsibilities should be clearly defined before an incident occurs, including reporting lines, confidentiality obligations and authority to interact with regulators or law enforcement. Clear contractual arrangements help avoid uncertainty during time-critical investigations and support a coordinated and legally defensible response.
4. Decision-Making Authority During a Cyber Incident
An effective Cyber Incident Response Team depends not only on having the right members but also on clearly allocating decision-making authority before an incident occurs. During a live cyber incident, organisations often need to make multiple legal, technical and commercial decisions simultaneously. Uncertainty over who has authority to make those decisions can delay regulatory reporting, increase business disruption and expose the organisation to legal risk.
Technical decisions should ordinarily remain with the information security team. These include determining the nature and scope of the incident, containing the threat, isolating affected systems and preserving digital evidence. However, technical findings should be communicated promptly to legal counsel and senior management because they frequently determine whether statutory or regulatory obligations are triggered.
Legal counsel should assess the organisation’s reporting obligations, contractual commitments and potential legal exposure. This includes advising whether the incident falls within the categories of reportable cyber incidents under the CERT-In Directions, whether personal data breach notification obligations may arise under the Digital Personal Data Protection Act, 2023, and whether engagement with law enforcement or external regulators is appropriate. Legal oversight also helps ensure that communications with regulators, customers and business partners remain accurate, consistent and legally defensible.
Senior management should retain responsibility for strategic business decisions, including activating business continuity measures, approving engagement of external forensic specialists, allocating financial resources and determining whether the incident requires escalation to the board of directors. Significant incidents affecting listed entities may also require consideration of disclosure obligations under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, with the Company Secretary or Compliance Officer coordinating the necessary governance processes. For listed entities, significant cyber incidents may trigger disclosure obligations under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015. Escalation to the board of directors is therefore essential, both to satisfy regulatory disclosure requirements and to demonstrate that directors exercised oversight consistent with their fiduciary duties. Documented escalation procedures should specify when incidents must be reported to the board, how information is presented, and who is responsible for coordinating disclosures. This ensures that governance processes remain robust and that the organisation can demonstrate compliance with SEBI’s expectations during regulatory reviews.
These responsibilities should be documented in the organisation’s incident response plan before an incident occurs. Clearly defined decision rights reduce duplication of effort, prevent conflicting instructions and enable organisations to comply with statutory reporting timelines while maintaining a coordinated response. During a rapidly evolving cyber incident, a documented governance framework allows each function to make decisions within its area of responsibility while ensuring that critical legal and regulatory obligations are not overlooked.
5. Legal Risks When Roles and Responsibilities Are Unclear
A cyber incident often unfolds under significant time pressure, requiring multiple decisions to be taken simultaneously. Where roles and responsibilities are not clearly allocated in advance, delays and inconsistent decision-making can expose an organisation to regulatory action, civil liability and avoidable operational disruption. In many cases, the legal risk arises not from the cyber incident itself but from failures in governance during the response.
One of the most immediate risks is failure to comply with mandatory reporting obligations. The CERT-In Directions require specified cyber incidents to be reported within six hours of an organisation becoming aware of the incident. If responsibility for assessing reportability or authorising notifications is unclear, valuable time may be lost while different business functions seek approvals or attempt to determine who is responsible for communicating with CERT-In. Similar risks arise where an organisation has not clearly designated or maintained its Point of Contact for regulatory communications.
Unclear responsibilities may also affect compliance with obligations relating to personal data breaches. Under the Digital Personal Data Protection Act, 2023, Data Fiduciaries are responsible for implementing reasonable security safeguards and notifying the Data Protection Board of India and affected Data Principals of a personal data breach in the prescribed manner. Where legal, compliance and technical teams operate independently without coordinated decision-making, organisations may struggle to assess the nature of the breach, identify affected individuals or prepare accurate regulatory notifications.
Governance failures may also compromise the preservation of digital evidence. The CERT-In Directions require specified ICT system logs to be enabled, retained for 180 days within India and produced to CERT-In when required. If technical teams restore systems or overwrite logs before appropriate preservation measures are taken, organisations may face difficulties during regulatory investigations, internal reviews or subsequent legal proceedings.
For regulated entities, unclear escalation procedures may result in non-compliance with sector-specific supervisory requirements. The RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices requires regulated entities to maintain documented incident response processes, clearly defined roles and escalation mechanisms, together with time-bound reporting obligations. Likewise, listed entities must ensure that governance processes support timely regulatory disclosures where required under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015.
Finally, inadequate governance may increase an organisation’s exposure to civil liability. Section 43A of the Information Technology Act, 2000 provides a compensation framework where a body corporate handling sensitive personal data is negligent in implementing reasonable security practices and procedures, resulting in wrongful loss or wrongful gain. Although liability will depend on the facts of each case, clearly allocating responsibilities before an incident occurs helps demonstrate that the organisation has adopted an organised and accountable approach to cyber incident management.
6. Building a Legally Defensible Incident Response Governance Framework
An effective Cyber Incident Response Team is not defined by the number of people involved but by the clarity with which responsibilities are allocated before a cyber incident occurs. A documented governance framework enables organisations to respond promptly while meeting statutory and regulatory obligations under applicable laws.
The incident response plan should clearly identify the members of the Cyber Incident Response Team, define their respective responsibilities and establish decision-making authority for key actions such as technical containment, regulatory reporting, engagement of external advisers, communications with stakeholders and escalation to senior management or the board. Organisations should also ensure that their designated Point of Contact for CERT-In remains current and that internal reporting procedures enable compliance with the reporting timelines prescribed under the CERT-In Directions.
Governance arrangements should be supported by documented escalation procedures, decision logs and record-keeping practices. Maintaining clear records of the information available, decisions taken and the reasons for those decisions assists organisations in demonstrating accountability during regulatory reviews, internal investigations or subsequent legal proceedings. Technical procedures should likewise support compliance with applicable requirements relating to the preservation of ICT system logs and other digital evidence.
Regular review of the incident response framework is equally important. Changes in business operations, organisational structure, technology or applicable regulation may affect reporting obligations and internal responsibilities. Periodic tabletop exercises and incident response simulations allow organisations to test decision-making processes, identify governance gaps and refine escalation procedures before an actual cyber incident occurs.
Ultimately, a legally defensible incident response capability depends on effective governance rather than ad hoc decision-making. By clearly allocating responsibilities, documenting authority and integrating legal, compliance and technical functions into a single response framework, organisations are better positioned to manage cyber incidents while complying with their legal and regulatory obligations.
Key Points at a Glance
| Topic | Key Takeaway |
| Cyber Incident Response Team (CIRT) | A CIRT is a multidisciplinary governance structure that coordinates technical, legal, compliance and business functions during a cyber incident. |
| Legal Framework | Cyber incident response in India is governed by the Information Technology Act, 2000, CERT-In Directions, the Digital Personal Data Protection Act, 2023 and, where applicable, sector-specific regulatory requirements. |
| Team Composition | Although no law prescribes a mandatory team structure, organisations should clearly allocate responsibilities among senior management, IT, legal, compliance and communications functions. |
| Decision-Making Authority | Decision-making authority should be documented before an incident occurs to enable timely technical response, regulatory reporting and stakeholder communications. |
| Role of Legal Counsel | Legal counsel assesses statutory reporting obligations, contractual commitments, regulatory engagement and legal risk throughout the incident response process. |
| Regulatory Reporting | Organisations should establish internal processes that enable compliance with applicable reporting obligations, including those under the CERT-In Directions and sector-specific regulatory frameworks. |
| Evidence Preservation | Digital evidence and ICT system logs should be preserved in accordance with applicable legal and regulatory requirements to support investigations and legal proceedings. |
| Governance Risks | Unclear roles and responsibilities may result in delayed reporting, inconsistent communications, inadequate evidence preservation and increased regulatory or civil liability. |
| Governance Framework | A documented incident response plan should define team composition, decision-making authority, escalation procedures and record-keeping responsibilities. |
| Periodic Review | Organisations should periodically review and test their incident response governance framework to ensure it remains effective and aligned with evolving legal and regulatory requirements. |
Frequently Asked Questions
1. Is every organisation in India legally required to establish a Cyber Incident Response Team?
No. Indian law does not expressly require every organisation to establish a Cyber Incident Response Team (CIRT) or prescribe its composition. However, organisations may be subject to statutory and regulatory obligations relating to cyber incident reporting, data protection, evidence preservation and governance. A multidisciplinary CIRT is a practical governance mechanism that helps organisations discharge those obligations in a coordinated and legally defensible manner.
2. Does Indian law require an organisation to designate a specific person to lead cyber incident response?
Not an incident commander as such. The CERT-In Directions of 2022 do require entities to designate a Point of Contact for interfacing with CERT-In, and the Digital Personal Data Protection Act, 2023 places accountability on the Data Fiduciary as an entity rather than on any named officer. Beyond these, the allocation of decision-making authority is a governance choice — but one worth recording in advance, since the Point of Contact requirement and the Data Fiduciary’s obligations both assume someone is already answerable when the incident begins.
3. Is a forensic investigation report in India protected by legal privilege?
Not automatically. Under Section 132 of the Bharatiya Sakshya Adhiniyam, 2023, privilege attaches to confidential communications with a legal adviser made for the purpose of obtaining legal advice. A forensic report commissioned directly by an internal IT function, without counsel’s involvement in scoping and instruction, may be discoverable in later proceedings and available to regulators and opposing parties. To preserve privilege, forensic investigations should be commissioned through legal counsel and documented as part of legal advice or anticipated litigation. It is always advised to route forensic investigations through external counsel, with clear engagement letters documenting that the work is undertaken for legal advice or anticipated litigation. This approach ensures privilege protection and reduces the risk of sensitive findings being disclosed to regulators or opposing parties. In case, if the reports are routed through in‑house counsel are not privileged post‑2025, and can be summoned during investigation. In Re: Summoning of Advocates… (2025 INSC 1275), the Supreme Court clarified that in‑house counsel are not covered, as they are not “practising advocates.” Privilege attaches only to communications with external counsel.
4. What are the legal consequences of failing to comply with the CERT-In Directions?
Failure to comply may attract penalties under Section 70B(7) of the Information Technology Act, 2000, which empowers CERT‑In to enforce its directions. Delayed reporting, failure to maintain the designated Point of Contact, or failure to preserve required ICT system logs may also complicate regulatory investigations and incident response, exposing organisations to enforcement action and reputational harm.
5. Who is responsible for notifying a personal data breach under India’s Digital Personal Data Protection Act, 2023?
Under Section 8(5) of the Digital Personal Data Protection Act (DPDPA), 2023, the Data Fiduciary is responsible for implementing reasonable security safeguards and notifying the Data Protection Board of India and affected Data Principals of a personal data breach in the prescribed form and manner. While technical teams investigate the incident, the legal responsibility for compliance remains with the Data Fiduciary.
6. How often should a cyber incident response plan be reviewed under Indian law?
No general statutory review cycle applies across sectors. Regulated entities may face specific requirements — The Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI) and the Insurance Regulatory and Development Authority of India (IRDAI) each prescribe periodic review or audit obligations for entities within their remit . For all organisations, the “reasonable security safeguards” obligation under the DPDP Act is continuing rather than a one-time exercise, which makes a review triggered by material change in operations, technology or regulatory perimeter the defensible baseline.
Part of ATB Legal’s Dispute Resolution practice.