Governance and compliance is how a business decides who is responsible for security and data, writes down the rules, and proves it follows the laws and standards that apply to it. Brainguru helps Indian organisations build security policies, assess gaps against frameworks such as ISO 27001 and the DPDP Act, and prepare for audits and incidents.
What is governance and compliance?
Governance is the set of decisions, roles and policies that control how your organisation manages cyber security and data risk. It answers questions such as who approves access to customer data, who owns the incident plan and how often the board hears about security risk.
Compliance is showing that those practices meet the rules you are bound by: laws such as India's Digital Personal Data Protection Act, 2023, sector rules from regulators such as RBI and SEBI, contract terms from your clients, and standards such as ISO 27001 or PCI DSS.
The two depend on each other. Without governance, compliance becomes a pile of documents nobody follows. Without compliance checks, governance has no way of knowing whether the rules work. The NIST Cybersecurity Framework makes the same point: when NIST released CSF 2.0 on 26 February 2024, it added Govern as a sixth core function alongside Identify, Protect, Detect, Respond and Recover, and said cyber security is a major source of enterprise risk that senior leaders should weigh alongside finance and reputation.
Indian rules every governance programme should cover
For most Indian businesses, two sets of rules set the baseline, whatever the sector.
CERT-In directions: The CERT-In directions of 28 April 2022, issued under section 70B of the IT Act, require service providers, intermediaries, data centres, body corporates and government organisations to report listed cyber incidents to CERT-In within 6 hours of noticing them. They must also keep logs of all their ICT systems for a rolling 180 days, within India, and synchronise system clocks with the NIC or NPL time servers or sources traceable to them.
DPDP Rules: The Digital Personal Data Protection Rules, 2025 bring the main duties of the DPDP Act into force on 13 May 2027. Rule 6 lists the minimum security safeguards: encryption, masking or similar protection, access control, logging and monitoring, backups for continued processing, and retention of logs for one year. Rule 7 requires a data fiduciary to tell the Data Protection Board about a personal data breach without delay, with a detailed report within seventy-two hours of becoming aware of it.
The two timelines are different, so your incident plan needs to handle both: a 6-hour CERT-In report for covered incidents and a 72-hour report to the Board for personal data breaches. Logs kept for 180 days may meet CERT-In's rule but not the DPDP Rules' one-year retention. Our guide to data privacy law in India explains the DPDP Act itself in plain terms.
Why governance and compliance matter now
Regulation is only part of the reason. Breaches are expensive, and the cost keeps rising. The IBM Cost of a Data Breach Report 2026, produced with the Ponemon Institute, puts the global average cost of a breach at USD 4.99 million, a 12% increase over the previous year and a record high.
Clients also ask harder questions. Enterprise buyers, banks and overseas customers now send security questionnaires before signing a contract, and expect written policies, a named owner for security, evidence of access reviews and a tested incident plan. A business that can answer quickly wins work that a business without governance loses.
Our governance and compliance services
Cyber security policy development: We help you write security policies that match how you actually work, with clear roles, responsibilities and escalation steps. Typical policies cover acceptable use, access control, data handling and classification, passwords and authentication, vendors, backups and incident management.
Regulatory compliance assessment: We run a gap analysis against the rules and standards that apply to you, such as the DPDP Act and Rules, CERT-In directions, ISO 27001, PCI DSS, GDPR for European data and HIPAA where you serve US patients. The report ranks each gap by risk and gives practical steps to close it.
Risk management frameworks: We help you set up a risk register and a method for assessing risk, based on frameworks such as the NIST CSF and ISO 31000, so decisions about where to spend on security are made on evidence rather than habit.
Audit and monitoring: We help you prepare for internal and external audits, collect evidence in an organised way, and set up monitoring so you can see whether policies are being followed between audits. Audit trails show who did what and when.
Data privacy governance: We help you build a privacy framework: a map of personal data, notices, consent records, retention rules, request handling and vendor contracts. For European customers this links with our GDPR compliance solutions.
Incident response and reporting: We help you write and rehearse an incident response plan that meets the CERT-In and DPDP timelines, with templates for regulator and customer notices. Investigation and root-cause analysis after an incident sit with our security operations team.
How a governance and compliance engagement works
- Scope: We agree which laws, standards and client requirements apply, and which systems, sites and teams are in scope.
- Current state review: We read your existing policies, interview the people who run your systems and check a sample of controls in practice.
- Gap report: Each gap is linked to the requirement it fails, rated by risk and given a practical fix and a suggested owner.
- Roadmap: We order the fixes so the most serious risks and the nearest deadlines come first.
- Implementation support: We help draft policies, set up processes and configure controls with your IT team.
- Evidence and review: We help you collect the evidence auditors and clients ask for, then review progress at agreed intervals.
Benefits of a governance and compliance programme
- Fewer surprises from regulators: You know which rules apply and have a plan for each deadline.
- A stronger security position: Clear policies and owners make basic controls, such as access reviews and patching, happen on time.
- Faster sales to larger clients: Ready answers to security questionnaires shorten procurement.
- Less duplicated effort: One set of controls can be mapped to several frameworks instead of running separate projects.
- Better decisions: A risk register gives leaders a clear view of where security money will do the most good.
Governance and compliance by industry
- Healthcare: Patient data handled under the DPDP Act, with HIPAA where you serve US patients.
- Finance: RBI and SEBI rules for regulated entities, PCI DSS for card data, and SOX where you have US-listed operations.
- E-commerce: Customer and payment data, vendor and marketing tools, and privacy laws in each market you sell to.
- Education: Student data under the DPDP Act, with FERPA where you serve US institutions.
- IT services and SaaS: Client contract terms, ISO 27001, and GDPR for data processed on behalf of European clients.
Common governance mistakes
- Policies copied from a template: They describe controls the business does not run, which auditors spot quickly.
- No single owner: Security belongs to everyone and so to no one. Name an owner and give them time and authority.
- Incident plans never tested: The first time a team reads the plan should not be during a real breach. Run a tabletop exercise at least once a year.
- Short log retention: Logs deleted after 30 or 90 days leave nothing to investigate and fall short of the CERT-In and DPDP rules.
- Compliance as a yearly event: Evidence gathered in a rush before each audit, then forgotten.
What affects the cost of governance and compliance work?
We quote after a free consultation. The main factors are:
- Number of frameworks: One standard takes less work than mapping controls to several.
- Size and complexity: The number of sites, systems, cloud accounts and vendors in scope.
- Current maturity: Existing policies and controls reduce the work; starting from nothing increases it.
- Depth of support: A gap assessment alone costs less than help with implementation, audits and ongoing review.
Questions to ask a compliance partner
- Which laws and standards will you assess us against, and why those?
- Will the gap report link each finding to the exact requirement it fails?
- Do you test controls in practice, or only read our documents?
- How will our incident plan handle the different CERT-In and DPDP timelines?
- What will we be able to show a client or auditor at the end?
Related reading: our guide to cyber security audits explains what a technical audit checks.