INDUSTRY FACT FILE · IT SERVICES & SYSTEMS INTEGRATION

Cybersecurity FAQs for IT Service Providers and System Integrators

Forty frequently asked questions and answers in five categories, written for leadership, CISOs, engineering, managed services and compliance teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, contracts and compliance 3.  Category 3: Secure development and DevSecOps 4.  Category 4: Managed services, SOC and incident response 5.  Category 5: People, subcontractors, cloud and AI

Audience: CEOs, delivery leaders and CISOs

Q1. Why are IT service providers targeted?

They hold code, credentials and privileged access to many clients. Compromising one provider can open many client environments.

Q2. What are the biggest risks?

Build compromise, RMM tool abuse, privileged access misuse, secret leakage, ransomware, phishing, insiders and weak access lifecycle.

Q3. Which incidents illustrate the risk?

SolarWinds (2020), Kaseya VSA (2021) and MOVEit (2023) showed how provider-side compromises affect thousands of downstream organisations.

Q4. What should leadership review?

Client-impact risks, pipeline and RMM security, audit and certification status, incidents, subcontractor risk and SOC performance.

Q5. How do clients judge our security?

Through questionnaires, certifications such as ISO/IEC 27001 and SOC 2, VAPT reports and incident commitments in contracts.

Q6. Is security a sales advantage?

Yes. Regulated and global clients increasingly award contracts to providers who can evidence strong controls.

Q7. How should we prioritise investment?

Start with MFA on privileged tools, secure pipelines and access lifecycle, then add continuous monitoring and red teaming.

Q8. How can Codec Networks help?

Codec Networks provides secure code review, DevSecOps reviews, infrastructure and RMM testing, ISO and SOC 2 readiness, managed SOC and supply-chain assessments.

Audience: Compliance, legal and quality teams

Q9. Do CERT-In Directions apply to us?

Yes. They apply to service providers and body corporates, requiring six-hour incident reporting and 180-day ICT log retention in India.

Q10. What are CERT-In's 2025 audit guidelines?

CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (July 2025) set expectations for risk-based, independent audits, reported as at least annual.

Q11. How do RBI rules reach us?

RBI's IT outsourcing Directions require bank and NBFC clients to oversee providers through due diligence, audit rights and incident clauses.

Q12. What about SEBI and IRDAI clients?

SEBI's CSCRF and IRDAI's 2026 guidelines require their regulated entities to manage third-party service providers, often through audits and contract controls.

Q13. How does DPDP affect providers?

Clients as data fiduciaries must ensure processors apply reasonable security safeguards; expect DPDP clauses in contracts. Most obligations take effect in May 2027.

Q14. Do EU rules matter?

Yes, for European clients and products: GDPR processor duties, NIS2 supply-chain security, DORA for financial clients and the Cyber Resilience Act for products with digital elements.

Q15. Is ISO 27001 enough?

It is a strong baseline, but clients often also ask for SOC 2, VAPT, code review and regulator-specific evidence.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs independent audits, VAPT and readiness assessments.

Audience: CTOs, engineering and product teams

Q17. What should secure code review cover?

Authentication, authorisation, input handling, cryptography, secrets, logging and business logic, using manual and automated methods.

Q18. How do we secure CI/CD pipelines?

Isolate build systems, protect credentials and signing keys, require reviewed changes and verify artefacts before release.

Q19. What is an SBOM and why do clients ask for it?

A software bill of materials lists components in software. It helps clients track vulnerable dependencies and is increasingly expected.

Q20. How do we manage open-source risk?

Use SCA tools, pin and verify dependencies, monitor advisories and remove unused packages.

Q21. How do we stop secret leakage?

Scan IDEs and repositories, block commits with secrets, vault credentials and use short-lived tokens.

Q22. Should developers use AI coding tools?

Use approved, enterprise-grade tools with data controls and policies; never paste client secrets or restricted code into public tools.

Q23. How do we handle test data?

Use masked or synthetic data; if client data is unavoidable, apply production-grade controls and delete it after use.

Q24. How often should applications be tested?

Before major releases and periodically, with automated testing in the pipeline.

Audience: Managed services, SOC and operations teams

Q25. How do we secure RMM tools?

Enforce phishing-resistant MFA, restrict access by IP and role, require approvals for mass actions and monitor activity 24x7.

Q26. Should clients be segmented from each other?

Yes. Separate credentials, tooling tenants and networks so a compromise in one client cannot spread to others.

Q27. What should our SOC monitor?

Privileged and RMM activity, identity events, endpoint alerts, pipeline changes and data movement across own and managed estates.

Q28. What should incident playbooks include?

Containment, client notification, evidence preservation, CERT-In reporting within six hours and coordination with clients' regulators.

Q29. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; align retention with client contracts.

Q30. How should we prepare for ransomware?

Protect backups from privileged tools, test restoration and rehearse a multi-client scenario.

Q31. When should forensics be engaged?

As soon as a supply-chain or client-impact compromise is suspected.

Q32. Should we run tabletop exercises?

Yes—especially for build compromise and RMM-driven ransomware scenarios involving clients.

Audience: Resource management, vendor, cloud and innovation teams

Q33. How do we manage access for rotating staff?

Tie client accounts to identity lifecycle, recertify regularly and remove access on role change or exit.

Q34. How should subcontractors be assessed?

Assess security before onboarding, include flow-down clauses, monitor their access and review periodically.

Q35. What cloud controls matter most?

Least-privilege IAM, separate client tenants, encryption, logging and posture monitoring.

Q36. How do we handle client personal data?

Process only on instructions, apply safeguards, restrict access and return or delete data at the end of the engagement.

Q37. What insider-threat controls help?

Least privilege, monitoring of sensitive actions, DLP and clear offboarding.

Q38. What AI risks apply to IT service firms?

Leakage through AI tools, insecure AI-generated code and vulnerabilities in AI features built for clients.

Q39. How do we secure AI features we build?

Test for prompt injection, data leakage and excessive permissions before release, and govern models and data.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your delivery model, clients and certifications; Codec Networks will propose an assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments and your client agreements.