Cybersecurity Compliance Checklist for Companies Operating in India

Cybersecurity compliance is a legal, operational and governance priority for companies operating in India. A practical cybersecurity compliance checklist helps organisations identify applicable laws, protect business information, respond to cyber incidents and demonstrate accountability to regulators, customers and business partners. It is relevant to large enterprises, growing businesses, technology companies and organisations handling personal or commercially sensitive data.

However, there is no single cybersecurity law or universal checklist covering every Indian business. Obligations depend on the company’s activities, the information it processes, its industry and the services it provides. Companies should therefore combine baseline security controls with sector specific requirements and a documented compliance review.

1. Identify the Laws and Regulations Applicable to Your Business

The first step is to map the legal framework governing the organisation. The Information Technology Act, 2000 provides the foundation for several cybersecurity related obligations. Section 43 addresses certain unauthorised acts involving computer systems, while Section 70B establishes the role of the Indian Computer Emergency Response Team (CERT In) in cyber incident response. Section 70B(6) empowers CERT In to issue directions covering information security practices and incident reporting.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are also important for organisations processing digital personal data. Their provisions have phased commencement dates, so companies should verify which duties are in force at the relevant time rather than assuming every requirement applies immediately.

Sector specific requirements may add further obligations. Banks and certain financial institutions are subject to Reserve Bank of India directions. Securities market entities may fall within the Securities and Exchange Board of India’s Cybersecurity and Cyber Resilience Framework. Other regulated businesses should check the requirements issued by their relevant regulator.

The official CERT In cybersecurity directions provide a useful starting point for understanding incident reporting, log retention and related obligations.

2. Maintain a Cybersecurity Risk Assessment and Asset Register

A company cannot protect systems effectively without knowing what it owns, operates and relies upon. Maintain an up to date inventory of computers, servers, cloud environments, applications, databases, network devices, mobile devices and connected systems. Include systems managed by external vendors where they support business operations or process company information.

Classify assets according to their sensitivity and business importance. Customer records, financial information, employee data, intellectual property and privileged administrator accounts usually require stronger controls than low risk public information.

Conduct documented risk assessments at planned intervals and after material changes, such as launching a new application, moving workloads to the cloud, acquiring a business or appointing a critical technology provider. Record identified threats, existing safeguards, residual risks, responsible owners and target completion dates.

Senior management should review significant risks and unresolved security issues. This turns cybersecurity from an informal IT task into a managed business responsibility.

3. Implement Access Controls and Strong Authentication

Access should be limited to people who need it for their work. Apply the principle of least privilege across business applications, cloud platforms, databases and internal networks. Review user permissions regularly, especially for administrators, finance teams, developers and personnel handling sensitive information.

Multi factor authentication should be enabled for remote access, privileged accounts, email and critical business applications wherever supported. Remove access promptly when employees leave or change roles. Shared accounts should be avoided where individual accountability is necessary.

Establish clear password and authentication policies, secure administrative access and monitor unusual login activity. Where possible, separate everyday user accounts from privileged accounts. Record access approvals and periodic reviews so the company can demonstrate how permissions are granted and withdrawn.

4. Protect Data Through Encryption and Secure Handling

A cybersecurity compliance checklist should address the full data lifecycle, from collection and storage to access, sharing, retention and deletion. Identify personal data, confidential business information and regulated records. Restrict collection to legitimate business needs and avoid retaining information indefinitely without a valid reason.

Use appropriate encryption for sensitive data in transit and at rest. Protect encryption keys separately, limit access to them and establish procedures for key rotation and recovery. Secure backups and ensure they cannot be altered or deleted easily by an attacker using compromised administrator credentials.

Data handling policies should address approved file sharing, removable media, email attachments, remote working and the use of personal devices. Staff should understand how to transfer sensitive information securely and whom to contact if information is sent to the wrong recipient.

Companies should also map where personal data is stored and processed, including with cloud providers and other service partners. This supports privacy compliance and helps identify exposure during a security incident.

5. Establish a CERT In Incident Reporting Process

One of the most time sensitive requirements in India is reporting specified cyber incidents to CERT In. The directions issued under Section 70B(6) of the Information Technology Act require covered entities to report listed incidents within six hours of noticing them or being informed of them.

Reportable incident categories include specified data breaches and leaks, ransomware, unauthorised access, phishing, identity theft, website defacement and certain attacks affecting servers, cloud systems or other ICT infrastructure. Organisations should consult the official directions and accompanying FAQs to determine whether a particular event falls within the reporting categories.

Create a written incident response procedure defining how employees report suspicious activity, who assesses incidents and who is authorised to submit regulatory reports. Maintain current contact details for the internal response team and the designated point of contact where required.

Do not wait for a full forensic investigation before considering the reporting deadline. CERT In guidance allows available information to be submitted within the prescribed period, with additional details provided later as appropriate. The incident team should preserve relevant logs, identify affected systems, record decisions and maintain a timeline of events.

A report to CERT In does not automatically satisfy separate obligations to regulators, affected customers, contractual counterparties or other authorities. Assess each obligation independently.

6. Retain Logs and Synchronise System Clocks

Logging supports threat detection, incident investigation and regulatory compliance. Under the CERT In directions, covered entities must enable and securely maintain ICT system logs for a rolling period of 180 days, within Indian jurisdiction, as specified by the directions.

Identify the systems whose logs must be retained and ensure logging covers relevant authentication events, administrator activity, system changes, security alerts and network activity. Protect logs against unauthorised alteration or deletion. Restrict access and monitor for gaps in collection.

Synchronise ICT system clocks with the prescribed time sources, such as NIC or NPL Network Time Protocol servers, or another source which does not deviate from them. Accurate timestamps help investigators reconstruct the sequence of events across different systems.

Test log retrieval periodically. Retention is of limited value if records are incomplete, inaccessible or overwritten before an incident is investigated.

7. Keep Systems Updated and Test Security Controls

Outdated software and unpatched vulnerabilities create avoidable exposure. Maintain a vulnerability management process covering operating systems, applications, network devices, cloud workloads and third party components. Assess findings according to severity, exploitability and business impact, then set clear remediation deadlines.

Apply security patches promptly, with appropriate testing for critical business systems. Where immediate patching is not possible, document the reason, implement compensating controls and track the remaining risk.

Conduct vulnerability assessments and penetration testing at suitable intervals and after significant system changes. Test web applications, APIs, remote access, network segmentation and cloud configurations where relevant. Findings should lead to corrective action, followed by verification that the weakness has been addressed.

Secure software development practices should include code review, dependency checks, secrets management and testing before deployment. Production access should be restricted, and changes should follow a documented approval process.

8. Assess Vendors, Cloud Providers and Outsourced Services

Third party weaknesses can expose a company even when its own systems are well protected. Before appointing a vendor, assess its security controls, access requirements, incident response capability and relevant certifications or independent audit reports.

Contracts should address confidentiality, permitted data use, security standards, breach notification, cooperation during investigations, subcontracting and secure return or deletion of information at the end of the engagement. Set clear escalation timelines so a vendor’s notification delay does not prevent the company from meeting its own legal deadlines.

Review vendors according to risk, rather than relying solely on questionnaires completed at onboarding. Critical providers may require periodic assurance reviews, access audits or testing evidence. Cloud security responsibilities should be clearly divided between the provider and the customer.

Outsourcing technology does not automatically transfer the company’s legal obligations. Organisations should retain sufficient oversight of systems and data for which they remain responsible.

9. Prepare an Incident Response and Business Continuity Plan

A written incident response plan should explain how the company detects, contains, investigates and recovers from a cyber incident. Assign responsibilities to IT, security, legal, compliance, communications, human resources and senior management. Include a clear process for deciding whether an event requires regulatory reporting.

The plan should cover ransomware, data exposure, compromised email accounts, fraudulent payments, service disruption and vendor incidents. Define how systems can be isolated without unnecessarily destroying evidence. Preserve logs, relevant communications, forensic images and other records using documented procedures.

Maintain tested backups, disaster recovery arrangements and business continuity plans. Backups should be protected from the same compromise affecting production systems. Test restoration rather than assuming a successful backup job guarantees recovery.

Conduct tabletop exercises and simulated incidents. These help identify unclear responsibilities, missing contact details and delays in escalation before a real event occurs.

10. Train Employees and Document Compliance Evidence

Employees should receive regular training on phishing, social engineering, secure remote working, password safety and the handling of sensitive information. Training should reflect actual business risks and be repeated when systems or threats change.

Maintain evidence of policies, risk assessments, access reviews, training, security testing, vendor assessments, incident exercises and corrective actions. Assign an owner and review date to each major control. Evidence should be accessible to authorised personnel and retained according to applicable legal, regulatory and business requirements.

Where relevant, companies should also consider whether their obligations require a designated security officer, formal audit, board level oversight or reporting to a regulator. The exact requirements vary by sector and entity type.

Organisations seeking legal clarity on their obligations may consult cybersecurity compliance lawyers for businesses to review regulatory exposure, contracts, incident procedures and governance arrangements.

11. Review Privacy Duties and Potential Legal Exposure

Cybersecurity and data protection overlap, but they are not identical. Security controls help protect information, while privacy compliance also concerns the lawful handling of personal data, transparency, permitted purposes and individual rights.

Review the commencement notifications and rules under the Digital Personal Data Protection framework to determine the duties currently applicable to the organisation. Do not assume that a CERT In report alone fulfils every privacy notification requirement.

A serious incident may also lead to contractual disputes, regulatory scrutiny or criminal investigation, depending on the facts. Preserve relevant evidence, avoid unauthorised access to suspected attacker systems and ensure communications are accurate. A failed security control does not, by itself, establish criminal liability; the applicable legal provisions and evidence must be assessed.

Where allegations involve deliberate misuse of computer systems, fraud or other suspected offences, criminal lawyers for corporate offences may assist with understanding the relevant legal process and preserving the organisation’s position.

Conclusion

A reliable cybersecurity compliance checklist for Indian companies should combine legal mapping, technical safeguards, incident reporting, log retention, vendor oversight, staff training and tested recovery arrangements. Compliance should be an ongoing process supported by accountable owners and verifiable evidence, rather than a document prepared only for an audit.

The most effective approach is to identify the rules relevant to the business, prioritise the highest risks, test whether controls work in practice and update procedures as laws and threats evolve. Companies should verify current legal requirements against official notifications and sector specific directions before relying on a checklist for compliance decisions.