INDUSTRY FACT FILE · PROFESSIONAL & BUSINESS SERVICES

Cybersecurity FAQs for Professional and Business Services

Forty frequently asked questions and answers in five categories, written for managing partners and Boards, CEOs and CFOs, CIOs and CISOs, risk and general counsel, HR and payroll heads, and privacy and client-service teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, privacy and professional duties 3.  Category 3: Email, cloud, documents and platforms 4.  Category 4: SOC, incidents and fraud response 5.  Category 5: Clients, people data and suppliers

Audience: Managing partners, Boards, CEOs and CFOs

Q1. Why are professional services firms such frequent targets?

Because they concentrate other organisations' secrets, money and people data in one place. A single firm may hold deal files for dozens of clients, payment instructions for every transaction and payroll data for many employers, so one intrusion pays attackers many times over.

Q2. What are the biggest risks for an Indian professional services firm?

Business email compromise that diverts client or payroll payments, theft and extortion of client files, ransomware during peak seasons, vendor and file-transfer compromise, exposure of candidate and employee data, insider leaks by leavers and slow detection that misses CERT-In's six-hour window.

Q3. Which incidents should the leadership know about?

The Mossack Fonseca leak of 2016, NotPetya at DLA Piper in 2017, the Deloitte email breach of 2017, the MOVEit attacks on payroll provider Zellis and the LockBit attacks on Infosys McCamish in 2023, and the £14 million fine on Capita in 2025.

Q4. Is this an IT problem or a business problem?

A business problem. BEC exploits payment processes, leaks exploit access and culture, vendor breaches exploit contracts, and every incident lands on the client relationship. The managing partner or Board must own it, with IT, finance, risk, HR and client-service leaders sharing responsibility.

Q5. What should leadership review each quarter?

BEC attempts and payment-control exceptions, mailbox and identity security status, access to client files, vendor and file-transfer risks, client audit findings, backup and restore tests, SOC coverage, incidents and near misses, and progress on ISO 27001, SOC 2 and DPDP.

Q6. Who should own cybersecurity in a partnership?

A named partner with risk responsibility and a CISO or security lead with authority across all offices and service lines, supported by the general counsel, the finance head and a data protection officer, with a single inventory of systems, vendors and client data.

Q7. How should we prioritise investment?

Protect identities and email first with phishing-resistant MFA; put call-back controls on every payment change; restrict and monitor access to client files; harden remote access; assess the vendors that hold data; add 24x7 monitoring; then build privacy and client-assurance programmes.

Q8. How can Codec Networks help?

Codec Networks provides email and identity reviews, external and application testing, data protection and DLP reviews, DPDP programmes, ISO 27001 and SOC 2 readiness, CERT-In-aligned audits, 24x7 managed SOC and BEC, payroll and insider fraud investigations, delivered under strict confidentiality.

Audience: General counsel, risk partners, compliance and privacy officers

Q9. Do CERT-In Directions apply to professional firms?

Yes. They apply to service providers, intermediaries, data centres and body corporates generally. Cyber incidents must be reported within six hours of noticing them and ICT logs retained for 180 days in India; CERT-In's 2025 audit guidelines expect risk-based independent audits.

Q10. Are we a data fiduciary or a data processor under DPDP?

Usually both. A firm is a data fiduciary for its own staff, partners and candidates, and often a data processor when it handles client data on the client's instructions. Some advisory work may make the firm a fiduciary in its own right; analyse each service line.

Q11. What does DPDP require of processors?

A fiduciary may engage a processor only under a valid contract, and remains responsible for safeguards over data processed on its behalf. Expect clients to require encryption, access control, monitoring, log retention, breach notification and deletion at the end of the engagement in your contracts.

Q12. How does professional confidentiality relate to cybersecurity?

The Chartered Accountants Act treats disclosure of client information without consent as misconduct, and advocates' communications are protected by Bar Council rules and Section 132 of the Bharatiya Sakshya Adhiniyam. Poor security that exposes client files can therefore raise professional as well as legal questions.

Q13. Why do our bank clients ask so many security questions?

RBI's Master Direction on IT outsourcing requires banks and other regulated entities to manage risks in outsourced IT and IT-enabled services, including service-provider controls and audit rights. Those duties flow into your contract as questionnaires, audits and evidence requests.

Q14. Does SEBI's CSCRF affect us?

It applies directly to SEBI-regulated entities, including registrars and share transfer agents, and indirectly to firms that provide them with technology or outsourced services. Listed firms and listed clients also disclose cyber incidents under SEBI LODR. Confirm applicability against the circulars.

Q15. Do the labour codes create security work?

Indirectly. The four codes in force since 21 November 2025 change wage definitions, social security and records, prompting payroll and HR platform changes and data migrations. Each change should be tested for access control, data accuracy and exposure of employee records.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs independent audits, DPDP assessments, ISO 27001 and SOC 2 gap assessments and client-assurance reviews, with evidence that clients, insurers and regulators can rely on, under confidentiality terms suited to professional firms.

Audience: CIOs, CISOs, IT, knowledge-management and platform teams

Q17. How do we stop mailbox takeover?

Use phishing-resistant MFA such as security keys or passkeys for partners, finance and administrators, apply conditional access and device compliance, block legacy authentication, protect against token theft, alert on new forwarding rules and review administrator roles regularly.

Q18. How should Microsoft 365 or Google Workspace be reviewed?

Assess identity and MFA settings, conditional access, external sharing, mailbox auditing and retention, administrator roles, third-party app consents, data loss prevention and logging, and compare them with a hardened baseline suited to confidential professional work.

Q19. How should document-management systems be secured?

Apply matter-based access so only the engagement team can open client files, use ethical walls where conflicts exist, log every access, alert on bulk downloads, expire external links and review access when people change teams or leave.

Q20. How should client portals and payroll platforms be tested?

Test every endpoint for object-level authorisation so one client or employee cannot see another's data, check file upload and download controls, session handling and rate limits, and include mobile apps, APIs and integrations with banks and HR systems.

Q21. Are file-transfer tools a real risk?

Yes. Internet-facing transfer tools have been mass-exploited, as MOVEit was in 2023. Keep an inventory, restrict exposure, patch within days, encrypt files, delete them after transfer and monitor for unusual downloads by unknown users.

Q22. How do we secure remote and hybrid work?

Require MFA on every remote path, patch VPN and gateway devices quickly, manage and encrypt laptops, avoid client data on personal devices, use zero-trust access to sensitive systems and test remote access at least annually.

Q23. How should staff use generative AI on client work?

Approve specific enterprise tools with contractual data protections, prohibit pasting client material into public tools, classify what may be used, log usage, and check engagement letters and client instructions before using AI on a matter.

Q24. Do we need data loss prevention?

For most firms holding client files, yes. Start with classification and visibility of where sensitive data goes, then block high-risk actions such as uploads to personal storage, mass downloads and external sharing of labelled documents.

Audience: SOC, IT, finance, incident response and crisis teams

Q25. Do professional firms need a SOC?

Yes, if client files, payments or people data matter. Around-the-clock monitoring of mailboxes, identities, endpoints, cloud and vendor activity is the only reliable way to catch takeovers, exfiltration and fraud early and to meet the six-hour reporting window.

Q26. What should the SOC monitor?

Sign-ins and MFA events, mailbox rules and forwarding, administrator changes, bulk downloads and external sharing, endpoint alerts, VPN and remote-access sessions, file-transfer activity, help-desk resets, bank-detail changes and lookalike domains.

Q27. What should we do in the first hour of a BEC?

Call the bank to request a recall and freeze, preserve the mailbox and logs, reset credentials and revoke sessions, remove malicious rules, warn the client and others in the thread, assess CERT-In reporting and engage forensics to establish what was read.

Q28. What should an incident playbook include?

Containment, decisions on client notification, bank and police contact, CERT-In reporting within six hours, DPDP intimation, insurer notification, professional-body considerations, disclosure if listed, communication with staff and press handling.

Q29. How should backups be designed?

Immutable or offline backups of document, audit, payroll and email data, kept separate from everyday administrator credentials, with regular restore tests and a plan for which client deadlines to protect first.

Q30. Should we run exercises?

Yes—annual tabletop exercises with partners, finance, HR, IT and client-service leaders using BEC, data-extortion, payroll and vendor-breach scenarios, plus help-desk vishing tests and technical restore drills.

Q31. When should forensics be engaged?

As soon as a payment diversion, mailbox compromise, data theft, insider leak or ransomware is suspected, to preserve evidence for CERT-In, police, banks, insurers and courts, establish what client data was accessed and identify the root cause.

Q32. How do we handle an extortion demand?

Contain the intrusion, establish what was taken through forensics, take legal advice, inform affected clients, report to CERT-In and the police, consider insurer requirements and avoid commitments to attackers without leadership and legal agreement.

Audience: Client-service, HR, payroll, recruitment and procurement teams

Q33. How do we answer client security questionnaires efficiently?

Build a maintained evidence library of policies, test reports, certifications and monitoring summaries, align it to ISO 27001 or SOC 2 controls, assign an owner and refresh it after each audit so answers are consistent and defensible.

Q34. Should we pursue ISO 27001 or SOC 2?

ISO 27001 is widely recognised by Indian and global clients; SOC 2 is often requested by US clients and technology buyers. Many firms start with ISO 27001 and add a SOC 2 report when client demand justifies it.

Q35. How should recruitment and staffing firms protect candidate data?

Collect only what is needed, encrypt identity documents, test the ATS and cloud storage, limit recruiter access, set retention periods and delete old CVs, manage job boards and verification vendors as processors and prepare for DPDP from May 2027.

Q36. How do we stop fake recruiter scams using our name?

Monitor job sites, social networks and messaging apps for impersonation, register lookalike domains or have them taken down, publish clear warnings that you never charge candidates, and give candidates a simple way to verify a recruiter.

Q37. How should payroll providers protect employer data?

Segregate each employer's data, encrypt files at rest and in transit, harden file transfer and APIs, require MFA for payroll administrators, verify bank-detail changes and give clients processor terms, breach notification and audit evidence.

Q38. How should we assess our own vendors?

Tier them by the data and access they hold, review certifications and test reports, check how they exchange files, add security, notification and audit clauses, monitor their exposure and reassess critical vendors at least annually.

Q39. How should staff be trained?

Short, regular BEC and phishing simulations for partners and finance, vishing tests for help desks, data-handling rules for client files and AI tools, and briefings for HR and recruiters on candidate data and impersonation scams.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your practices, platforms, clients, vendors and contract obligations; Codec Networks will then propose a confidentiality-first assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments applicable to your firm, profession, registrations and client contracts.