CYBER SECURITY & DATA PROTECTION CHECKLIST
Baseline controls for securing business systems and personal data in India.
Access & Identity
- ☐ Strong password policy enforced
- ☐ Multi-factor authentication on critical accounts
- ☐ Role-based access with least privilege
- ☐ Ex-employee access revoked promptly
System Security
- ☐ Operating systems and software patched regularly
- ☐ Antivirus / endpoint protection deployed
- ☐ Firewall and network segmentation configured
- ☐ Sensitive data encrypted at rest and in transit
Data Protection (DPDP Act)
- ☐ Personal data inventory / data map maintained
- ☐ Consent captured with clear purpose
- ☐ Data retention and deletion schedule defined
- ☐ Data principal rights (access / correction / erasure) supported
- ☐ Grievance / Data Protection Officer contact published
Backup & Continuity
- ☐ Automated regular backups configured
- ☐ Backups tested through restore drills
- ☐ Off-site / cloud backup copy maintained
- ☐ Business continuity / disaster recovery plan documented
Response & Vendors
- ☐ Incident response plan and breach notification steps ready
- ☐ CERT-In reporting timelines noted
- ☐ Third-party / vendor security due diligence done
- ☐ Staff trained on phishing and data handling
Note: Document who owns each control; timely CERT-In reporting and DPDP-aligned consent significantly reduce regulatory and reputational risk.