INDUSTRY FACT FILE · ITES, BPO, KPO & GCCS

Cybersecurity FAQs for ITeS, BPO, KPO and GCCs

Forty frequently asked questions and answers in five categories, written for centre heads, CISOs, operations, help-desk, HR and compliance teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, contracts and compliance 3.  Category 3: People, access and data protection 4.  Category 4: SOC, insider threat and incident response 5.  Category 5: GCCs, cloud, vendors and AI

Audience: Centre heads, delivery leaders and CISOs

Q1. Why are service centres targeted?

They give many people access to client customers' data and high-impact processes. Attackers exploit people—through bribery, impersonation and phishing—as much as systems.

Q2. What are the biggest risks?

Insider data theft, help-desk social engineering, payment and vendor-master fraud, data leakage, ransomware, WFH device risks and privileged access in GCCs.

Q3. Which incidents illustrate the risk?

Help-desk social engineering reportedly enabled a major US casino breach in 2023, and in 2025 a US crypto exchange disclosed that bribed overseas support contractors leaked customer data.

Q4. What should leadership review?

Client audit findings, access recertification, DLP coverage, insider cases, help-desk controls, incidents and SOC performance.

Q5. How do clients judge our security?

Through floor audits, questionnaires, certifications such as ISO/IEC 27001 and SOC 2, PCI DSS status and incident commitments.

Q6. Who owns insider risk?

A joint effort of security, HR, legal and operations, with clear processes for monitoring and investigation.

Q7. How should we prioritise investment?

Start with least privilege and masking, help-desk verification and DLP, then add UEBA monitoring and simulations.

Q8. How can Codec Networks help?

Codec Networks provides access reviews, DLP assessments, customer data protection reviews, managed SOC with UEBA, privacy programmes and insider investigations.

Audience: Compliance, legal and quality teams

Q9. Do CERT-In Directions apply to us?

Yes. They require six-hour incident reporting and 180-day ICT log retention in India for body corporates and service providers.

Q10. How does DPDP affect service centres?

Clients as data fiduciaries must ensure processors apply reasonable safeguards, so expect DPDP clauses in contracts. Most obligations take effect in May 2027.

Q11. How do client regulators reach us?

RBI, SEBI and IRDAI require their regulated entities to oversee service providers, often through audits, access controls and incident clauses.

Q12. When do we need PCI DSS?

When agents or systems handle cardholder data, such as payments over the phone. PCI DSS v4.0's future-dated requirements became mandatory on 31 March 2025.

Q13. Do overseas laws apply?

Through client contracts: GDPR for EU personal data, HIPAA for US health data and other client-country rules.

Q14. What about OSP registration?

DoT liberalised its Other Service Provider guidelines in 2020, easing registration and many compliance requirements; confirm current DoT terms for your setup.

Q15. Are there rules for telemarketing?

Yes. TRAI's 2018 regulations govern commercial communications, including registration and customer preferences.

Q16. Can Codec Networks support client audits?

Yes. Codec Networks is CERT-In empanelled and supports audit readiness, independent audits and evidence packs.

Audience: Operations, IT and help-desk teams

Q17. How do we limit what agents can see?

Mask sensitive fields, show data only when needed, restrict search and export, and review access regularly.

Q18. How do we stop screen photography?

Use secure floors with no-phone policies, clean-desk rules, masking and monitoring for unusual look-ups.

Q19. How should help desks verify callers?

Use strong identity checks, call back on known numbers, and require out-of-band approval for privileged or MFA resets.

Q20. How do we prevent payment fraud?

Verify bank changes by call-back, use maker-checker approvals and monitor payment anomalies.

Q21. Should we allow shared accounts?

No. Every user should have a named account so actions are traceable; remove generic logins.

Q22. What DLP controls matter most?

Endpoint, email, web and cloud DLP, USB and print controls, and policies tuned to the data each process handles.

Q23. How do we secure work-from-home delivery?

Use VDI or locked-down devices, enforce encryption and MFA, block local storage and audit home setups.

Q24. How do we handle leavers?

Remove access immediately, recover devices and review recent data activity.

Audience: SOC, HR, legal and incident response teams

Q25. Do service centres need a SOC?

Yes. Monitoring of identity, endpoint and user behaviour is essential for insider threats and six-hour reporting.

Q26. What is UEBA and why does it matter?

User and entity behaviour analytics flags unusual activity—such as bulk look-ups or after-hours exports—that may indicate insider misuse.

Q27. How should insider investigations be run?

Preserve evidence forensically, coordinate with HR and legal, protect privacy and document findings for disciplinary or legal action.

Q28. What should incident playbooks include?

Containment, client notification, evidence preservation, CERT-In reporting within six hours and coordination with clients' regulators.

Q29. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; clients may require longer.

Q30. How should we prepare for ransomware?

Segment delivery networks, protect and test backups, monitor endpoints 24x7 and rehearse recovery with clients.

Q31. Should we run simulations?

Yes—help-desk social engineering, BEC and insider scenarios reveal process gaps quickly.

Q32. When should forensics be engaged?

As soon as data theft, collusion or account misuse is suspected.

Audience: GCC leaders, cloud, vendor and innovation teams

Q33. Why are GCCs different?

GCCs often hold privileged access to global systems, so a compromise can become a global incident.

Q34. How should GCC privileges be managed?

Use a tiered admin model, PAM, phishing-resistant MFA and joint monitoring with the parent's SOC.

Q35. What about cross-border incidents?

Agree a joint India–global playbook covering CERT-In reporting and home-country obligations.

Q36. What cloud contact-centre risks exist?

Misconfigured storage of recordings and transcripts, weak integrations and excessive admin access.

Q37. How should providers be assessed?

Assess CCaaS, telecom and staffing providers before onboarding and periodically, with security clauses in contracts.

Q38. How do we prevent fake candidates?

Verify identity during hiring, use background checks and watch for unusual remote-worker behaviour.

Q39. What AI risks apply to service centres?

Customer data in AI tools, inaccurate AI suggestions and prompt-injection attacks on chatbots.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your clients, processes and delivery model; Codec Networks will propose an assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments and your client agreements.