29 security controls for Indian IT & SaaS firms, and what answers each

Endpoint detection and response, or a managed service that watches it 24×7.

Central log management or SIEM with retention set to the longest clock you owe.

Single sign-on everywhere, with FIDO2 or passkey MFA that a phone call cannot reset.

Identity governance: automated joiner-mover-leaver, contractors included, with access reviews.

Unified endpoint management, so work happens only on devices you can see, patch and wipe.

A secure email gateway or API-based protection, with awareness training that tests people.

Immutable or air-gapped backup, including Microsoft 365 and Google Workspace, with tested restores.

Continuous scanning and exposure management, plus annual penetration testing.

A GRC or compliance-automation platform that collects evidence continuously instead of before the audit.

Consent, notices, data-principal requests and a record of processing.

Third-party risk management: who your subcontractors are, what they can reach, and what they have promised.

Data discovery and posture management, encryption with keys you control, tokenisation where it fits.

Privileged access management with vaulted credentials, just-in-time access and session recording.

ZTNA or SASE in place of the flat VPN, so a home laptop reaches one client’s apps and nothing else.

Data-loss prevention and insider-risk monitoring sized for support and operations teams.

Virtual desktops or a secure enterprise browser, so client data and code never land on the laptop.

RMM, PSA and remote support — kept off the open internet, patched, and behind MFA.

The contact-centre, workforce-management and quality stack — with call records kept and card details masked.

A hardened Git platform and CI/CD: SSO on every account, protected branches, isolated runners, nothing internet-facing that need not be.

Software composition analysis, an SBOM per release, and a repository firewall in front of npm and PyPI.

A secrets vault with short-lived credentials, secret scanning in commits, and protected code-signing keys.

Cloud-native application protection: misconfiguration, identities and entitlements, and runtime threats.

WAF and API security, bot and DDoS defence, and payment-page script monitoring.

Sign-in, MFA and account-takeover defence for your own customers.

Guardrails and firewalls for the AI you ship, and governance that maps to ISO 42001 and the EU AI Act.

A help-desk procedure that proves who is asking before any password or MFA reset.

Identity and background verification at offer and onboarding, with in-person or verified-video steps for privileged roles.

Who calls CERT-In, who calls each client, in what order, with what.

Audit rights, data location, subcontractor flow-down and incident terms — in your client contracts and your customers’ DPAs.