The 3R DCDR Framework
DCDR — Our Security Philosophy in Practice
3R Infotech DCDR Framework
Every security programme we design, every service we deliver, and every control we recommend is anchored to a single, coherent operating model: the 3R DCDR Framework. DCDR — Detect, Contain, Defend, Recover — is our structured approach to building organisational resilience against cybersecurity threats across all four critical phases of the security lifecycle.
Unlike compliance checklists that focus on what controls to implement, DCDR focuses on what outcomes those controls must achieve — and ensures every element of your security programme works toward measurable, mission-critical results.
The Four Pillars of DCDR
D — DETECT
You cannot stop what you cannot see.
Detection is the foundational pillar. The average time between a threat actor gaining access to an environment and that access being discovered — the 'dwell time' — remains dangerously long in organisations without mature detection capability. Our DETECT practice is built to shrink that window to minutes, not months.
DETECT — Services & Capabilities
Threat Visibility
- SOC-as-a-Service: 24/7 monitoring, SIEM management, threat hunting
- Endpoint Detection & Response (EDR) deployment and tuning
- Network traffic analysis and anomaly detection
- User and Entity Behaviour Analytics (UEBA)
- Cloud security posture monitoring (CSPM)
- OT/ICS environment monitoring for manufacturing clients
Deception & Early Warning
- Honeypot infrastructure — decoy systems across network segments
- Honey credentials and deception tokens in AD and cloud
- XSecuritas document watermarking for exfiltration detection
- Dark web monitoring for credential exposure and brand mentions
- Threat intelligence feeds and IOC correlation
- Attack surface monitoring and external exposure scanning
DETECT — Key Metrics We Track
- Mean Time to Detect (MTTD): target < 15 minutes for critical alerts
- Alert fidelity rate: > 90% actionable alerts (minimise false positives)
- Threat hunting coverage: 100% of MITRE ATT&CK techniques mapped
- Log coverage: ≥ 95% of critical asset log ingestion into SIEM
- Decoy interaction rate: zero false positives by design
C — CONTAIN
Speed is everything. Every minute of uncontained threat is exponential damage.
Detection without containment is merely early warning. The CONTAIN pillar is built for velocity — ensuring that the moment a threat is confirmed, the blast radius is frozen. Containment is not just technical; it is also operational, legal, and communicative.
CONTAIN — Services & Capabilities
Technical Containment
- Incident Response: immediate remote containment activation
- Network isolation and segmentation enforcement
- Account lockdown and privileged access revocation (CyberArk)
- Endpoint quarantine and device isolation (Omnissa UEM)
- SOAR-automated containment playbooks for known threat types
- Firewall and proxy rule emergency deployment
- Cloud resource isolation and IAM access suspension
Operational & Legal Containment
- Evidence preservation and chain-of- custody initiation
- Stakeholder notification and crisis communication activation
- CERT-In 6-hour reporting (mandatory incident notification)
- Regulatory liaison: RBI, SEBI, IRDAI, DPDP Act obligations
- Legal hold initiation and forensic evidence packaging
- PR and media communication playbook activation
- Third-party and supply chain notification management
CONTAIN — Key Metrics We Track
- Mean Time to Contain (MTTC): target < 1 hour from detection to isolation
- Blast radius: number of systems/accounts affected before containment
- Regulatory notification compliance: 100% within mandatory timelines
- Evidence integrity: 100% chain-of-custody documentation
D — DEFEND
Resilience is built before the attack, not after it.
The DEFEND pillar is the most expansive — it encompasses all the proactive, preventive, and hardening activities that reduce the probability and impact of successful attacks. Defence is not a single product; it is a layered architecture of controls, policies, training, and technology working in concert.
DEFEND — Services & Capabilities
Proactive Security Testing
- VAPT: regular adversarial testing of all attack surfaces
- Red Team: APT simulation to test detection and response maturity
- Web App & API Security: pre-production and continuous testing
- Cloud security posture assessment and hardening
- Social engineering and phishing simulation programmes
- Secure configuration review and CIS benchmark validation
Architecture & Controls
- Enterprise Security Stack design (identity, endpoint, data, network)
- Zero-trust architecture implementation
- CyberArk PAM: privileged access governance
- Omnissa UEM: endpoint compliance and access control
- Veritas data protection: backup, recovery, and data governance
- DevSecOps integration: security in every CI/CD pipeline
Governance & Compliance
- GRC programme design and implementation
- ISO 27001, PCI-DSS, RBI, SEBI, DPDP Act compliance
- Policy, standard, and procedure documentation
- Third-party risk management programme
- Security awareness training and phishing simulation
- Virtual CISO (vCISO) executive leadership
Document & Data Defence
- XSecuritas digital watermarking for sensitive documents
- DLP integration and policy enforcement
- Data classification and labelling programme
- Email security and anti-phishing gateway
- Encryption at rest and in transit review
- Access control and least-privilege enforcement
DEFEND — Key Metrics We Track
- VAPT finding closure rate: > 90% critical and high findings remediated within SLA
- Phishing simulation click rate: target < 5% across workforce
- Patch management SLA compliance: > 95% of critical patches within 72 hours
- Privileged account coverage: 100% of privileged accounts under PAM governance
- Compliance posture score: continuous measurement against target framework
R — RECOVER
Recovery is not the end of the incident — it is the beginning of a stronger posture.
The RECOVER pillar closes the loop. Recovery is not simply restoring systems to their pre-incident state — that state was compromised. True recovery means rebuilding with enhanced controls, validating the integrity of restored assets, and capturing institutional learning that strengthens the organisation's security posture permanently.
RECOVER — Services & Capabilities
Technical Recovery
- Veritas NetBackup: ransomware-resilient backup and verified recovery
- System rebuilding with hardened baseline configurations
- Post-eradication validation: confirm no threat actor residue
- Enhanced monitoring deployment during recovery period
- Integrity verification of restored data and applications
- Business continuity plan (BCP) execution and coordination
- Cloud environment recovery and configuration revalidation
Operational Recovery
- Lessons learned workshop: root cause analysis and post-mortem
- Post-incident report for board, regulators, and insurers
- Control improvement roadmap from incident findings
- Updated IR playbooks incorporating incident learnings
- Cyber insurance claim support and documentation
- Reputational recovery advisory and stakeholder communication
- Third-party trust re-establishment programme
RECOVER — Key Metrics We Track
- Recovery Time Objective (RTO): target system restoration within agreed SLA
- Recovery Point Objective (RPO): maximum acceptable data loss window
- Post-incident control uplift: measurable improvement in security posture score
- Lessons learned implementation rate: > 100% of critical findings addressed
- Regulatory clearance: closure of all mandatory incident reporting obligations
