- Home
- Compliance
- Cyber Crisis Management Plan
Standard compliance
Cyber Crisis Management Plan
A Cyber Crisis Management Plan sets out who decides what, how you communicate and how you recover when a serious cyber incident hits. Regulators in India expect regulated entities to have one — and to test it.
Why teams choose Adiroha
- Led by CISA and ISO 27001 lead auditors
- Clear scope, roadmap and timeline before we start
- Evidence organised in the Cydital platform
- Support through the external audit and beyond
Scope
What we cover
- CCMP aligned to CERT-In guidance
- Crisis governance, roles and escalation
- Scenario playbooks (ransomware, data breach, DDoS, insider)
- Regulator, customer and media communication plans
- CERT-In incident reporting procedures
- Tabletop drills and plan maintenance
Deliverables
What you receive
- Board-approved CCMP document
- Scenario playbooks
- Communication templates
- Drill report with improvement actions
How we work
Discover. Assess. Remediate. Validate.
Discover
Understand your business, scope, stakeholders and the obligations that actually apply to you.
Assess
Gap assessment against the framework or regulation, turned into a prioritised, costed roadmap.
Remediate
Implement policies, controls and evidence with your teams, tracked in Cydital.
Validate
Internal audit before the external one, audit-day support, and continuous compliance after.
FAQ
Common questions
Who needs a CCMP?
Government bodies, critical sector entities and many regulated entities — including banks and financial institutions — are expected to maintain one.
How often should it be tested?
At least annually, and after major organisational or technology changes.
How is a CCMP different from an incident response plan?
An incident response plan guides technical teams. A CCMP covers the wider crisis: leadership decisions, regulators, customers, media and business continuity.
Who should own the CCMP?
Senior leadership, usually the CISO with board oversight. The plan should be approved at board or leadership level.
Do you run crisis simulation exercises?
Yes. We run tabletop drills with leadership and technical teams, then update the plan based on what the exercise reveals.
Related
Related services
SDLC Gap Analysis
Secure SDLC gap analysis against OWASP SAMM and NIST SSDF, with a practical roadmap to build security into development.
Learn moreNIST CSF 2.0
NIST CSF 2.0 maturity assessment across Govern, Identify, Protect, Detect, Respond and Recover, with a target-state roadmap.
Learn moreCloud Security Audit
Independent cloud security audit against CSA Cloud Controls Matrix, CIS Benchmarks and your compliance obligations.
Learn moreTalk to a specialist about Cyber Crisis Management Plan.
A free 30-minute consultation to understand your scope and timeline. We follow up with a fixed proposal.