Building a
Cyber Crisis Management Plan (CCMP)

A regular Incident Response (IR) plan is designed for internal failures or isolated malware. A Cyber Crisis Management Plan (CCMP), as defined by CERT-In, is designed for catastrophic events that threaten national infrastructure or massive datasets.

What is a CCMP?

A CCMP is a comprehensive document that defines the hierarchy, communication channels, and actions required to recover from a high-impact cyber event. For government entities and critical service industries, maintaining an active and tested CCMP is a mandatory part of national security compliance.

Core Elements of a Successful CCMP

• Crisis Hierarchy: Who has the authority during a shutdown? Defining a clear Chain of Command.
• Cross-Department Communication: Synchronizing IT, Legal, HR, and Public Relations.
• Alternative Operation Sites: Preparing for cases where current infrastructure is compromised beyond immediate fix.
• Regulatory Reporting Workflows: Specifically for reporting to CERT-In within the 6-hour window.
• Evidence Preservation: Standard procedures for forensic log isolation.

Is a CCMP Mandatory?

While recommended for all, a CCMP is mandatory for Organizations in Critical Sectors (like Banking, Energy, and Telecom) and Government/Public entities Hosting on NIC servers. It forms the backbone of a successful CERT-In empanelled audit completion.