Skip to content
Menu

Guides for Indian IT teams, dated and sourced.

Guides, definitions and research for IT and security teams in India. Each piece carries a byline, the date its sources were checked, the Indian sources it rests on and one link to the service it belongs to. The newest was published on 8 October 2026.

Privacy and compliance

DPDP and privacy engineering

What the Rules require of networks, cloud and applications by 13 May 2027, and the cryptography underneath.

  1. 10 minutes

    DPDP Rules 2025: what your IT team has to build before 13 May 2027.

    The DPDP Rules’ substantive duties apply from 13 May 2027. For IT, that means Rule 6’s seven safeguards, at least a year of logs, a 72-hour breach report to the Board and erasure that runs.

  2. 11 minutes

    India’s post-quantum roadmap starts with a cryptographic inventory.

    A Department of Science and Technology task force wants critical information infrastructure on post-quantum cryptography by 2029, and other enterprises by 2033. Both tracks begin with an inventory of cryptographic assets, and the report would make vendor CBOMs mandatory in procurement from FY 2027-28.

Security operations

Detection and response

Patch windows, email authentication, incident reporting and the CERT-In duties around each.

  1. 10 minutes

    How to meet CERT-In’s 12-hour patch window.

    CERT-In’s blueprint of 25 May 2026 gives known exploited flaws on internet-facing and crown-jewel systems 12 hours to patch, mitigate or remove exposure, “where feasible”. Promise it only for a short, named list of systems, each with a pre-approved emergency change.

  2. 10 minutes

    DMARC at p=reject: list every sender first, then enforce.

    In Proofpoint’s June 2026 analysis, 41% of the 2025 Fortune 100 India companies did not enforce DMARC at reject. To reach p=reject, find every system that sends as your domain, sign each with aligned DKIM, then tighten the policy domain by domain.

  3. 10 minutes

    Ransomware in India: who to report to, how fast and how to recover.

    CERT-In’s Directions require ransomware to be reported within 6 hours of noticing it, with what you know by then. Sector regulators and, from 13 May 2027, the DPDP Rules add their own clocks. A tested restore decides how fast you recover.

Infrastructure and networks

Infrastructure that has outgrown its design

End-of-support estates, multi-site networks and what to do first.

  1. 11 minutes

    Windows 10 ESU, Server 2016 and SQL Server 2016: the dates to 2027.

    Three dates fall in the next 100 days: 13 October 2026 for Windows 10 ESU Year One and Office 2021, 10 November for Windows 11 Enterprise 23H2 and 12 January 2027 for Windows Server 2016. Decide each system before its date: upgrade, replace, isolate with a written exit date or buy ESU as a dated bridge.

  2. 10 minutes

    Wi-Fi 7 on India’s lower 6 GHz band, and the VPN to retire.

    Since 21 January 2026, offices in India can run Wi-Fi in 5925 to 6425 MHz without a licence, on type-approved equipment. Refresh for Wi-Fi 7 where density already hurts and the switches can feed it. Put the internet-facing VPN on the same plan: CERT-In’s April 2026 advisory says to harden or replace older VPN appliances.

Cloud

Cloud cost and control

Region choice, the monthly bill and what a migration should cost.

  1. 11 minutes

    Cloud region and spend in India: prove residency, then cut waste.

    Microsoft now runs four cloud regions in India, each paired with another Indian region, so primary, backup and disaster recovery copies can stay in India. Choose the region for what your regulator asks you to prove, and test residency every month. On cost, tag and review spend before you buy commitments.

AI and automation

AI that reaches production

The governance step before anything reaches a system of record.

  1. 10 minutes

    AI governance in India: what to build before an agent acts.

    India has no AI statute: existing law applies, and CERT-In’s guidance now recommends an AI inventory, usage monitoring and audit logs. Before an agent writes to a system of record, put five things in place: an inventory entry, its own scoped identity, a human approval step, logs and outbound controls.

Running IT

Running IT well

Managed IT, new office floors, annual maintenance contract (AMC) scope and tested restores.

  1. 10 minutes

    GCC setup in Bengaluru: one IT baseline for two rulebooks.

    A new GCC floor in Bengaluru answers to its parent’s security standard and to Indian law: the CERT-In Directions from opening day, the DPDP Act’s duties from 13 May 2027. Build it once, from a one-page crosswalk, so the floor’s systems produce the evidence both will ask for.

How these guides are written.

Each guide is researched and written for IT and security leads in India. Every fact carries a numbered source, and each source is checked on the date shown. A guide’s Updated date moves only when its content changes. To report an error, write to reachus@netscale.in with Correction in the subject.

Book a free assessment.

It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.

Book a Free AssessmentBring Us the Problem

Prefer to talk? +91 96320 28993reachus@netscale.in

What we put in writing

  1. The written findings are yours whether we ever work together or not.
  2. Each phase is fixed-scope and signed off separately.
  3. You can stop at any phase boundary.
  4. Runbooks, configurations and credentials are yours.