Cybersecurity Governance for Business Groups in India

Why Cybersecurity Governance Belongs at Board Level

Cyber risk is no longer only an IT department problem. For a business group with several companies, one weak password or an unpatched server in a single subsidiary can expose shared systems, customer data and the group's reputation. Cybersecurity governance means the board and senior leaders set direction, assign responsibility and check that protections actually work. This guide explains how Indian business groups can organise cyber governance across subsidiaries and why awareness of CERT-In incident reporting expectations belongs on the board agenda.

Boards oversee risks that can affect the survival or value of the business. A ransomware attack, data leak or payment fraud can halt operations, trigger regulatory obligations and damage trust with customers and lenders. These are business risks, not just technical ones.

Board-level cybersecurity governance does not mean directors configure firewalls. It means they ask the right questions, approve a risk appetite, ensure there is budget and skilled ownership, and receive regular reporting. Cyber risk should appear in the group risk management framework alongside financial, operational and compliance risks.

Building a Group Cybersecurity Policy Framework

A holding company can set a common baseline that every subsidiary adopts, with room for additional controls where risk is higher. Core group policies usually cover:

• Acceptable use of devices, email and internet
• Access control, strong passwords and multi-factor authentication
• Data classification, backup and retention
• Patch management and approved software
• Vendor and third-party access
• Incident response and escalation

Smaller entities often benefit from a simple starting list. The cybersecurity checklist for small businesses in India is a practical reference for baseline controls that subsidiaries can implement quickly.

Policies should be short, written in plain language and acknowledged by employees each year. A policy that runs to many pages but is never read offers little protection. Each subsidiary can add a one-page annexure listing its local systems, owners and any additional controls, so the group baseline stays consistent while local realities are captured.

Roles and Responsibilities Across Subsidiaries

Clear ownership prevents gaps. A typical structure assigns:

• The holding company board: oversight, risk appetite and periodic review
• A group technology or security lead: policy, standards and coordination
• Subsidiary leaders: implementation and local accountability
• Every employee: following policies and reporting suspicious activity

Leadership tone matters as much as policy. When senior leaders model secure behaviour and treat security as part of how the group works, staff follow. This reflects the people-first approach described in the leadership philosophy of Ashok Godara, where responsibility is shared rather than pushed down.

CERT-In Incident Reporting Awareness

CERT-In, the Indian Computer Emergency Response Team, is the national agency for responding to cyber security incidents. It has issued directions requiring certain organisations to report specified types of cyber incidents within set timelines and to maintain certain logs.

Because the scope, incident types and timelines are defined in CERT-In directions and may be updated, check the current requirements on the official CERT-In website and with legal counsel. Boards should confirm that:

• Someone in the group is responsible for monitoring CERT-In guidance
• The incident response plan includes reporting steps and contacts
• Logs are retained as required and can be retrieved quickly
• Subsidiaries know how to escalate an incident to the group immediately

Monitoring, Audit and Continuous Improvement

Governance works only when the board receives honest, regular information. Useful reporting includes open vulnerabilities, phishing test results, backup restoration tests, access reviews and any incidents or near misses.

Independent review adds assurance. Internal audit can test whether policies are followed in each entity, as explained in our practical guide to internal audit for group companies. As subsidiaries move processes to cloud platforms, structured digital transformation support helps build security into new systems from the start rather than adding it later.

Security awareness training should be repeated, not a one-time event. Short sessions on phishing, payment fraud, safe use of messaging apps and reporting suspicious emails help employees across plants, offices and field teams become the first line of defence. Lessons from every incident or near miss should feed back into policies, training and board reporting.

Next Steps for Business Group Leaders

• Add cyber risk as a standing item on the board or risk committee agenda
• Approve a group cybersecurity policy baseline
• Name accountable owners at group and subsidiary level
• Test the incident response plan, including CERT-In reporting steps
• Review progress at least quarterly

If your group wants to strengthen cybersecurity governance across its entities, contact ATTPL HOLDCO to discuss how our governance team can help.

Key takeaway: Cybersecurity governance turns cyber risk into a board-owned business issue, with a common group policy, clear roles across subsidiaries and a tested incident reporting process.

Frequently asked questions

Sources and further reading

• CERT-In (Indian Computer Emergency Response Team)
• Ministry of Electronics and Information Technology