Cybersecurity Compliance, Indian Regulations and Audit Readiness

Compliance is a map, not a certificate

Many owners hear the word compliance and picture thick files, audits and penalties. For a small business, a calmer way to see it is this: compliance means knowing which rules apply to you, deciding who is responsible for each one, doing what is required and being able to show it. The rules can come from law, from sector regulators, from customer contracts and from your own policies. None of this needs to be frightening. It needs to be organised.

Where your obligations can come from

• Law and rules: national laws, the rules made under them and any directions issued by authorities.
• Sector requirements: if you work in or supply to banking, insurance, healthcare, telecom or government, there may be extra expectations from that sector.
• Customer contracts: large customers often add security clauses, questionnaires or audit rights to purchase orders and agreements.
• Partner and platform terms: payment gateways, marketplaces and cloud providers have their own security conditions.
• Your own policies: once you write a policy, people will reasonably expect you to follow it.

How to build an obligations register

1. 1List each possible requirement in plain words, for example 'protect customer personal data we collect online' or 'report certain cyber incidents to the authorities'.
2. 2Note the source: the law, direction, contract or policy it comes from, with a link to the official page or the contract clause.
3. 3Record an applicability decision: applies, does not apply, or not sure yet. Write who made the decision and why, and mark 'not sure' items for adviser review.
4. 4Name one owner for each item who will make sure it is met.
5. 5Describe the evidence that would show it is being met, such as a dated access review, a backup restore note or a signed vendor agreement.
6. 6Set a review date. Laws, directions and contracts change, so every line needs a next check.

Evidence: show, do not just say

Auditors and customers rarely ask 'Do you have a policy?' alone. They ask 'How do you know it works?' Good evidence is dated, specific and honest. A monthly access review sheet, a screenshot of a security setting with no secrets visible, a training attendance list, a backup restore test note and an incident log are all useful. Keep evidence in one approved, access-controlled folder so you can find it quickly. Never store passwords, OTPs, recovery codes or full customer records as evidence. If a step was missed, record that too and note the fix. An honest gap with a plan is far stronger than a perfect-looking file that does not match reality.

Getting audit-ready without panic

Audit readiness simply means you can answer reasonable questions calmly and quickly. Start with the questions a customer or auditor is likely to ask: who has access to what, how you protect personal data, how you handle incidents, how you back up and recover, and how you manage vendors. For each, point to the owner, the process and the evidence. If you receive a security questionnaire, answer truthfully. Do not tick 'yes' for something you only plan to do. Instead write what you do today and what you are improving, with a target date.