IT Manager Hub

Essential Endpoint Controls

• Deploy EDR (Endpoint Detection & Response) on all devices — not just antivirus
• Enforce full-disk encryption (BitLocker / FileVault) on all laptops
• Enable automated OS and application patch management within 72 hours of release
• Restrict admin privileges — apply Least Privilege Access principle
• Block USB storage devices unless whitelisted by policy
• Enforce screen lock after 5 minutes of inactivity

Mobile Device Management

• Enroll all company and BYOD devices in MDM solution
• Enable remote wipe capability for all registered devices
• Enforce device PIN/biometric lock policies
• Separate corporate data from personal data via containerization

Monitoring

• Review EDR alerts daily — assign to security team for triage
• Generate monthly patch compliance reports
• Audit device inventory quarterly — decommission unused assets

Phase 1 — Foundation (Month 1–2)

• Obtain top management commitment and appoint ISMS Lead
• Define ISMS scope: business units, locations, assets covered
• Conduct initial gap assessment against ISO 27001:2022 clauses
• Build project plan with milestones and resource allocation

Phase 2 — Risk Assessment (Month 2–3)

• Build complete information asset register
• Identify threats and vulnerabilities for each asset
• Calculate risk ratings: Likelihood × Impact
• Select controls from Annex A to treat identified risks
• Produce Statement of Applicability (SoA)

Phase 3 — Implementation (Month 3–6)

• Develop and approve mandatory ISMS policies and procedures
• Implement selected Annex A controls
• Conduct staff awareness training
• Run internal audit against all implemented controls

Phase 4 — Certification (Month 6–9)

• Conduct management review meeting
• Remediate all internal audit non-conformities
• Stage 1 audit: documentation review by certification body
• Stage 2 audit: on-site/remote implementation audit
• Address any non-conformities raised by auditor

Key Obligations Under DPDP Act

• Obtain explicit, informed consent before processing personal data
• Process data only for the purpose it was collected (purpose limitation)
• Appoint a Data Protection Officer (DPO) if you are a Significant Data Fiduciary
• Implement reasonable security safeguards to prevent breaches
• Report data breaches to the Data Protection Board promptly
• Honor data principal rights: access, correction, erasure, nomination

Immediate Actions for IT Managers

• Conduct a data mapping exercise — document all personal data flows
• Audit consent mechanisms on all customer-facing systems
• Review third-party data processor contracts for DPDP compliance clauses
• Build a data breach detection and notification workflow (72-hour target)
• Train HR, sales, and customer service teams on data handling obligations

Penalties for Non-Compliance

• Up to ₹250 crore for failure to implement security safeguards
• Up to ₹200 crore for failure to notify data breaches
• Up to ₹50 crore for non-fulfillment of data principal rights

Define Your Recovery Objectives

• RPO (Recovery Point Objective): Maximum acceptable data loss — how old can your backup be?
• RTO (Recovery Time Objective): Maximum acceptable downtime — how fast must you recover?
• Classify systems: Tier 1 (mission-critical), Tier 2 (important), Tier 3 (non-critical)

The 3-2-1 Backup Rule

• 3 copies of data (production + 2 backups)
• 2 different storage media types (e.g. disk + cloud)
• 1 copy offsite or air-gapped (critical for ransomware protection)

Ransomware-Proof Backup Strategy

• Immutable backups: write-once, cannot be encrypted or deleted by ransomware
• Isolate backup infrastructure from production network
• Test restoration monthly — a backup never tested is not a backup
• Store offline/air-gapped copy for critical systems

DR Testing Schedule

• Restoration test: Monthly — restore a random file or VM
• Partial DR drill: Quarterly — test recovery of a non-critical system
• Full DR exercise: Annually — simulate complete site failure

Core Sections to Include

• Purpose: Define why the policy exists and who it applies to
• Internet Usage: Permitted and prohibited websites; bandwidth usage rules
• Email Usage: Professional communication standards; prohibited attachments and forwarding rules
• Device Usage: Company devices, BYOD rules, storage of company data on personal devices
• Data Handling: Classification levels, sharing restrictions, external transfer approval
• Social Media: What employees may/may not share about the company
• Passwords: Complexity requirements, sharing prohibition, MFA mandate
• Consequences: Disciplinary actions for policy violations

Deployment Steps

• Get HR and legal review before rollout
• Require all employees to sign acknowledgement (digital or physical)
• Include in new employee onboarding pack
• Review and update annually or after any major security incident

NIST 2024 Password Recommendations

• Minimum length: 12 characters (NIST recommends up to 64 characters)
• No mandatory complexity rules (uppercase/symbols) — length beats complexity
• No forced periodic rotation unless compromise is suspected
• Check passwords against known breached password databases
• Ban common passwords: "Password1", "Welcome123", company name etc.

MFA Enforcement

• Mandatory MFA for: email, VPN, cloud consoles, Active Directory, financial systems
• Preferred MFA types: Authenticator app (TOTP) or hardware key (FIDO2)
• Avoid SMS OTP where possible — susceptible to SIM-swapping attacks
• Privileged accounts (admin): hardware security key mandatory

Privileged Account Rules

• Separate admin accounts from daily-use accounts for all IT staff
• Privileged access must be time-limited and require justification
• Log all privileged activity — review monthly

Access Control

• User access reviews completed (quarterly minimum)
• Terminated employee accounts disabled within 24 hours of exit
• MFA enabled for all privileged and remote access accounts
• Service/shared accounts inventory documented and reviewed

Network Security

• Firewall rules reviewed and redundant rules removed
• Network segmentation in place for critical systems
• IDS/IPS active and alert thresholds reviewed
• Wi-Fi networks: guest network isolated from corporate

Data Protection

• Data classification policy in place and communicated
• Encryption enabled for data at rest and in transit
• DLP solution active on email and endpoint
• Backup restore tested successfully within last 30 days

Vendor & Third Party

• All vendors with data access reviewed for security posture
• NDAs and data processing agreements signed and current
• Third-party access reviewed and time-limited where possible

Phishing Red Flags — Train Your Team to Spot

• Urgency language: "Act immediately", "Your account will be suspended"
• Sender address doesn't match display name — check the actual email domain
• Hovering over links reveals a different URL than displayed text
• Unexpected attachments — even from known senders (account may be compromised)
• Generic greetings: "Dear Customer" instead of your name
• Requests for credentials, OTPs, or financial transfers via email
• Grammar errors or unusual formatting (less common now with AI-generated phishing)

2026 Alert: AI-Powered Phishing

• AI now generates grammatically perfect, personalized phishing emails
• Deepfake audio calls impersonating executives are being used for wire fraud
• QR codes in emails (quishing) are bypassing email security filters
• Always verify unusual requests via a separate phone call to a known number

Reporting Procedure

• Do NOT click links or reply — report via your IT helpdesk immediately
• Use "Report Phishing" button in email client where available
• Preserve the email as evidence — do not delete
• If you clicked a link: disconnect from network, notify IT immediately

Vendor Classification

• Tier 1 (Critical): Access to sensitive data or core systems — full assessment required
• Tier 2 (Standard): Access to non-sensitive systems — standard questionnaire
• Tier 3 (Low Risk): No data access — basic contractual controls only

Security Assessment Questions — Tier 1

• Do you hold ISO 27001, SOC 2 Type II, or equivalent certification?
• Have you had a data breach in the last 3 years? If yes, describe controls implemented
• Is our data stored in India or offshore? What jurisdiction applies?
• Do you conduct annual penetration testing? Can we review findings?
• What is your incident notification timeline if our data is compromised?
• Do you have cyber insurance? What is the coverage amount?

Contractual Must-Haves

• Data Processing Agreement (DPA) aligned with DPDP Act
• Right to audit clause — ability to conduct security reviews
• Breach notification within 24-72 hours
• Data deletion certificate upon contract termination