180 days
Log retention mandate — CERT-In 2022
13
Log source types CERT-In mandates
43%
Teams destroy volatile evidence before capture
<30 min
Target for RAM dump + containment sequence

CISOs run the tabletop. Auditors read the report. But when a real incident hits at 2 AM, it is the infrastructure team that runs the actual commands. This guide covers what infra teams must test, prove, and fix — before a drill makes it a finding.