Resources Categories
INDUSTRY FACT FILE · CLOUD, DATA CENTRES & HOSTING
Industry Overview: Cloud, Data Centres and Hosting in India
Who runs the infrastructure others depend on, the duties CERT-In and customers place on them, who buys cybersecurity and why each needs a distinct approach.
|
In this document 1. Why infrastructure security matters now 2. The ecosystem at a glance 3. Categories of cloud, data centre and hosting providers 4. The obligations that reach infrastructure providers 5. Government, customer and private participants 6. Who buys cybersecurity inside an infrastructure provider 7. Why each provider type needs a different approach 8. How Codec Networks works with infrastructure providers |
|
Sector scope Sector: cloud, data centres and hosting — cloud providers, colocation operators, managed hosting and VPS and infrastructure providers. Primary service proposition: cloud configuration reviews, virtualisation security, SOC, resilience and customer assurance. SaaS vendors and IT service firms are covered in separate fact files. |
1. Why infrastructure security matters now
India's cloud, data centre and hosting capacity is expanding rapidly to serve enterprises, government, BFSI, SaaS companies and AI workloads. Each provider runs shared hypervisors, control planes, out-of-band management networks and physical facilities on which thousands of customers depend.
|
6 hours To report cyber incidents to CERT-In |
5 years Subscriber records kept by cloud and VPS providers |
180 days ICT logs to be kept in India |
May 2027 Most DPDP obligations take effect |
Shared infrastructure means shared failure. The ESXiArgs campaign of February 2023 encrypted thousands of exposed hypervisors worldwide, the March 2021 fire at a large European provider's Strasbourg site showed how one facility event can take many customers offline, and the July 2024 faulty security-software update showed how quickly a single change can cascade across global infrastructure.
CERT-In's April 2022 Directions name data centres, cloud and VPS providers directly—requiring six-hour incident reporting, 180-day logs, clock synchronisation and five-year subscriber records. Regulated customers add MeitY empanelment with STQC audits, SEBI's cloud framework and RBI and IRDAI cloud requirements.
|
Key takeaway For an infrastructure provider, every customer's security rests on the provider's hypervisors, consoles and facilities. Proving that layer is secure is what regulated customers buy. |
2. The ecosystem at a glance
Figure 1: India's cloud, data centre and hosting ecosystem.
3. Categories of cloud, data centre and hosting providers
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Cloud service providers |
IaaS and PaaS platforms, including sovereign and government clouds |
Global hyperscalers, Indian clouds, telecom-led clouds |
CERT-In Directions; MeitY empanelment; DPDP; customer regulator rules |
|
Colocation operators |
Space, power, cooling and interconnection for customer equipment |
Indian and international data centre companies |
CERT-In Directions; facility safety rules; customer contracts |
|
Managed hosting providers |
Hosted servers, private clouds and managed platforms |
Hosting companies and MSPs |
CERT-In Directions; DPDP; customer contracts |
|
VPS and infrastructure providers |
Virtual private servers, bare metal and edge infrastructure |
Hosting companies and start-ups |
CERT-In Directions incl. subscriber records |
|
Edge and GPU cloud providers |
AI training and inference infrastructure, edge sites |
New-generation cloud providers |
CERT-In Directions; customer contracts |
|
Interconnection providers |
Internet exchanges, carrier-neutral facilities, cloud on-ramps |
Exchanges and carriers |
Telecom rules; CERT-In |
|
Backup and disaster recovery providers |
Backup-as-a-service and DR sites |
Specialist providers |
Customer contracts; DPDP |
4. The obligations that reach infrastructure providers
|
Instrument |
What it means for infrastructure providers |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours; ICT logs kept for a rolling 180 days in India; clocks synchronised to NIC or NPL NTP servers Data centres, cloud and VPS providers keep validated subscriber records for five years after cancellation |
|
MeitY cloud empanelment |
Cloud services for government use are empanelled by MeitY, with STQC audits |
|
SEBI cloud framework (March 2023) |
SEBI-regulated entities adopting cloud must meet governance, security, data localisation and audit requirements, which flow to providers |
|
RBI and IRDAI requirements |
RBI's IT outsourcing Directions cover cloud services for banks and NBFCs; IRDAI's 2026 guidelines require MeitY-empanelled CSPs with valid STQC audit status |
|
DPDP Act 2023 and DPDP Rules 2025 |
Safeguards for customer personal data processed on the platform; most obligations from May 2027 |
|
NCIIPC |
Systems notified as critical information infrastructure or protected systems face additional protection requirements |
|
How these apply CERT-In's provider duties apply directly; customer regulator requirements usually apply through empanelment and contracts. Confirm against the official instruments. |
5. Government, customer and private participants
- CERT-In sets incident reporting, logging, clock synchronisation and subscriber-record duties for providers.
- MeitY empanels cloud services for government and oversees the DPDP framework; STQC audits empanelled services.
- SEBI, RBI and IRDAI set cloud and outsourcing requirements for their regulated entities.
- NCIIPC protects notified critical information infrastructure.
- Customers—from start-ups to ministries—share responsibility for their own workloads.
6. Who buys cybersecurity inside an infrastructure provider
|
Stakeholder |
What they care about |
What they buy |
|
CEO and Board |
Uptime, customer trust, growth |
Board advisory, resilience programmes |
|
CISO |
Platform security and incidents |
VAPT, red teaming, SOC |
|
Platform and cloud engineering |
Hypervisors, control plane, isolation |
Virtualisation and configuration reviews |
|
Data centre operations |
Power, cooling, BMS, physical security |
Facility OT and physical assessments |
|
Compliance and certifications |
Empanelment, ISO, SOC 2, customer audits |
Readiness and audit support |
|
Customer success and sales |
Regulated-customer assurance |
Evidence packs and reports |
|
Trust and safety / abuse |
Platform abuse and law-enforcement requests |
Onboarding and abuse-process reviews |
7. Why each provider type needs a different approach
|
Provider type |
Highest-consequence risk |
Starting point for assurance |
|
Cloud service provider |
Control-plane takeover and tenant isolation failure |
Control-plane, IAM and isolation testing |
|
Colocation operator |
Facility BMS and physical compromise |
Facility OT and physical security assessments |
|
Managed hosting provider |
Hypervisor ransomware across customers |
Virtualisation hardening, backup reviews, SOC |
|
VPS provider |
Abuse for criminal infrastructure |
Onboarding, records and abuse-handling review |
|
Edge and GPU provider |
Firmware and out-of-band management exposure |
BMC and firmware security testing |
|
Sovereign or government cloud |
Targeted attacks and empanelment scrutiny |
Red teaming and empanelment audit support |
8. How Codec Networks works with infrastructure providers
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For infrastructure providers we deliver cloud configuration and control-plane reviews, virtualisation and BMC security testing, managed SOC, resilience and DR testing, facility OT assessments and customer assurance support.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. Customer regulator requirements apply through contracts and empanelment. Confirm obligations against the official CERT-In, MeitY, SEBI, RBI and IRDAI instruments before making compliance decisions.