Cyber Security Services in India: Avoid Compliance Gaps

Quick answer: Cyber security services in India should be chosen against Indian obligations, not a global template. Start with the CERT-In Directions of April 2022 (6-hour incident reporting, 180-day logs kept in India), add your sector regulator's rules and the DPDP Act, then buy the services that close those gaps: log monitoring, audits, incident response and staff training.

Many Indian organisations buy cyber security services the way they buy antivirus: a package, a price, a renewal date. The package often comes from a global playbook. It may look complete, yet nobody has checked whether it lets you report an incident to CERT-In within six hours, or whether your logs are stored in India for 180 days as required.

The gap usually shows up at the worst moment: during an incident, a regulator's inspection or an audit. This guide maps the Indian rules that shape what you need, compares the main services, and gives you a step-by-step method to build a security setup that fits the law and your budget.

Why Global Security Packages Leave Indian Firms Exposed

Generic security offerings are built for broad markets. They are useful, but they often miss what is specific to India.

• Reporting timelines are tighter than many expect. CERT-In requires covered entities to report listed cyber incidents within 6 hours of noticing them. A provider whose escalation process runs on another time zone, or only during office hours, makes that hard.
• Log location matters. The CERT-In Directions ask service providers, intermediaries, data centres, body corporates and government organisations to keep ICT system logs for a rolling 180 days within Indian jurisdiction. A cloud logging setup outside India may not meet this.
• Sector regulators add their own layer. Banks, NBFCs, market intermediaries and insurers each have separate cyber security rules on top of CERT-In.
• Audits need the right auditor. Many Indian obligations, including government website hosting and several regulator requirements, call for audits by CERT-In empanelled auditors. A general consultant's report may not be accepted.

None of this means you need the most expensive provider. It means the scope must be written around Indian obligations first.

The Indian Rules That Shape Cyber Security Services

The table below summarises the main frameworks as published. Always confirm the current text with the issuing body and your legal adviser, because rules are updated and this is not legal advice.

Rule or framework	Issued by and when	Who it applies to	Key points for your security setup
CERT-In Directions under Section 70B(6) of the IT Act	CERT-In, 28 April 2022	Service providers, intermediaries, data centres, body corporates and government organisations	Report listed incidents within 6 hours; keep logs for 180 days in India; sync clocks with NIC or NPL time servers; name a point of contact
Comprehensive Cyber Security Audit Policy Guidelines	CERT-In, 25 July 2025	CERT-In empanelled auditors and the organisations they audit	Annual comprehensive audit of ICT systems, extra audits after major changes, defined audit conduct rules
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025	Parliament and MeitY; Rules notified November 2025	Organisations processing digital personal data	Reasonable security safeguards and breach intimation; main duties on data fiduciaries due to apply from May 2027
Master Direction on IT Governance, Risk, Controls and Assurance Practices	RBI, 7 November 2023, effective 1 April 2024	Banks, NBFCs and other regulated entities named in it	IT and information security governance, risk management, audit and business continuity
Cybersecurity and Cyber Resilience Framework (CSCRF)	SEBI, 20 August 2024	SEBI regulated entities	Graded controls by entity category, security operations, audits and resilience testing
Information and Cyber Security Guidelines	IRDAI, 2023	Insurers and other IRDAI regulated entities	Information security policy, controls, audits and incident handling

For a closer look at the first and most widely applicable rule, see our CERT-In 6-hour incident reporting checklist. NBFCs can also read our note on RBI cyber security requirements.

Which Cyber Security Services Map to Which Obligation

Once you know your obligations, the services become easier to choose. This comparison shows what each common service does for compliance and for real protection.

Service	What it does	Obligations it helps meet	Typical buyer
Log management and SIEM	Collects and stores logs, raises alerts	180-day log retention in India, evidence for investigations	Almost every organisation covered by CERT-In Directions
Security monitoring (SOC or MDR)	Watches alerts around the clock, investigates and escalates	Fast detection so 6-hour reporting is possible	Firms without a 24x7 in-house team
VAPT and security audit	Finds weaknesses in applications, networks and cloud	CERT-In audit guidelines, regulator audits, website hosting audits	Anyone launching or changing applications
Incident response retainer	Expert help to contain and investigate an attack	Incident handling and reporting duties	Regulated entities and firms with critical systems
Email and endpoint security	Blocks phishing, malware and ransomware on devices	Reasonable security safeguards	All organisations
Policy, risk and compliance advisory	Writes policies, maps controls, prepares for audits	RBI, SEBI, IRDAI and DPDP governance requirements	Boards and management of regulated or larger firms
Security awareness training	Teaches staff to spot phishing and report incidents	Supports every framework above	All organisations

Two services are often skipped because they are less visible: log retention and incident response planning. Yet those are the two that decide whether you can meet CERT-In's timelines at all. Our post on SOC as a service in India explains how monitoring can be bought without building a full in-house team.

The Fix: A 6-Step Plan to Buy the Right Services

Use this sequence to turn a long list of obligations into a clear scope of work.

1. List the rules that apply to you. Start with the CERT-In Directions, then add your sector regulator, the DPDP Act and any contract terms from large customers or government clients.
2. Map each obligation to a control. For every rule, write what must exist in practice, for example "logs for 180 days stored in India" or "incident reported within 6 hours".
3. Check what you already have. Review current tools, in-house skills and vendor contracts, and mark each control as met, partly met or missing.
4. Buy services only for the gaps. Prioritise missing controls that carry legal deadlines or protect your most critical systems, then plan the rest over the year.
5. Write Indian obligations into the contract. Make the provider commit to log location, escalation times that support 6-hour reporting, use of CERT-In empanelled auditors where needed, and evidence for your audits.
6. Test the setup before an incident tests it. Run a tabletop exercise each year that walks through detection, escalation and a CERT-In report, and fix whatever breaks.

If you are still deciding which types of service to start with, our wider guide on what cyber security services to buy covers priorities by organisation type.

What Government Departments and PSUs Should Add

Government bodies follow the same CERT-In Directions, and they usually carry extra duties. Government websites and applications are commonly required to clear a security audit by a CERT-In empanelled auditor before hosting, and departments must follow guidance from their own ministry, the state IT department and, for critical systems, NCIIPC.

• Plan audits into project timelines. A portal that cannot go live without an audit certificate needs that audit booked well before launch.
• Keep evidence ready. Store audit reports, closure of findings and log retention proof in one place for inspections.
• Control vendor access. Many government systems are run by contractors. Contracts should define who can access production, how access is logged, and how it is removed when staff change.

Our article on CERT-In empanelled security audits explains what such an audit covers and how to prepare for it.

Questions to Ask a Provider of Cyber Security Services in India

• Where will our logs be stored, for how long, and can you show it in writing?
• From the moment an alert fires, how long until a person on our side is called, at any hour?
• Will you help us draft and file a CERT-In incident report? What information will you hand over?
• Are your auditors CERT-In empanelled, or will you subcontract the audit? If so, to whom?
• Which of our regulator's requirements does your service cover, and which remain our job?
• What will we receive each month as proof that the service is working?

A provider who answers with documents, named people and clear time limits is worth more than one with a longer feature list.

Frequently Asked Questions

Do the CERT-In Directions apply to small businesses?

The Directions name service providers, intermediaries, data centres, body corporates and government organisations. Many private companies fall under "body corporate". Check the exact wording and CERT-In's published FAQs with your adviser to confirm how they apply to you.

Can our logs be stored on a foreign cloud?

The CERT-In Directions require ICT system logs to be maintained securely for a rolling 180 days within Indian jurisdiction. If you use a global cloud service, confirm with the provider and your adviser that your log storage meets this requirement.

Do we need a CERT-In empanelled auditor?

For many regulated and government requirements, yes. Under CERT-In's July 2025 audit guidelines, only empanelled auditors may conduct the comprehensive audits those guidelines describe. Check what your regulator or client asks for in writing.

Is managed security cheaper than an in-house team?

For most small and mid-size organisations, round-the-clock monitoring is easier to buy as a service than to staff in-house. Larger firms often use a hybrid: an internal security lead plus an external SOC and audit partner.

How often should we review our security services?

Review the scope at least once a year, and again after any major change such as a new application, a cloud move, a new regulation or a security incident.

How Affix Center Can Help

Affix Center helps Indian enterprises, SMEs and government departments plan and run cyber security around Indian obligations. We can map your CERT-In, sector and DPDP duties to controls, review your current setup, coordinate audits and testing, and support monitoring and incident readiness. See our cyber security services and enterprise advisory work.

If you are not sure your current security setup would hold up in an incident or an audit, contact our team for a clear gap review.