Resources Categories
INDUSTRY FACT FILE · PROFESSIONAL & BUSINESS SERVICES
Industry Overview: Professional and Business Services in India
Who advises, audits, staffs and runs the back office for India's businesses, the obligations that apply, who buys cybersecurity and why each type of firm needs its own approach.
|
In this document 1. Why professional services cybersecurity matters now 2. The ecosystem at a glance 3. Categories of professional and business services firms 4. The regulatory, professional and standards framework at a glance 5. Government, regulatory, professional and private participants 6. Who buys cybersecurity inside a professional services firm 7. Why each type of firm needs a different approach 8. How Codec Networks works with professional and business services firms |
|
Sector scope Sector: law firms, chartered accountancy and audit firms, consulting, recruitment and staffing, payroll and HR outsourcing, business support and shared-services organisations. Primary service proposition: confidential data protection, email and cloud security, privacy, SOC and fraud investigations. IT services, BFSI and government have separate fact files. |
1. Why professional services cybersecurity matters now
Professional and business services sit behind almost every significant decision an Indian business takes. Law firms draft the transaction documents and run the litigation; chartered accountancy and audit firms sign the financial statements, file the tax returns and advise on restructuring; consultancies shape strategy, deals and transformation programmes; recruitment, executive-search and staffing firms find and employ the people; payroll and HR outsourcers pay them; and business support and shared-services organisations, including the global capability centres that Nasscom and Zinnov counted at more than 1,700 in FY24 employing over 1.9 million people, run finance, HR and customer operations for Indian and global clients. The Institute of Chartered Accountants of India alone has more than four lakh members, and thousands of firms of every size serve listed groups, banks, start-ups and governments.
|
US$3.05bn BEC losses reported to the FBI IC3 in 2025 |
11.5m Documents leaked from one law firm in 2016 |
1,700+ Global capability centres in India (Nasscom-Zinnov, FY24) |
6 hours To report cyber incidents to CERT-In |
What these firms sell is trust, and what they hold is other people's secrets. A mid-size law firm keeps merger drafts, litigation strategy and privileged advice; an audit firm keeps working papers and unpublished results; a consultancy keeps the client's cost base, deal targets and Board papers; a staffing or payroll provider keeps salary, bank, PAN and identity details for lakhs of employees and candidates. Almost all of it now lives in cloud email, document-management and collaboration platforms, client portals and data rooms, file-transfer tools, practice-management, payroll and applicant-tracking software, and on the laptops of a hybrid workforce. That makes the firm's mailbox, identity platform and vendors the most valuable targets in the client's own supply chain.
The record is long. The Panama Papers leak of April 2016 put about 11.5 million documents from the law firm Mossack Fonseca into the hands of journalists, and the firm announced its closure in March 2018, citing reputational damage. The NotPetya attack of June 2017 took down email and systems at the global law firm DLA Piper for days. Deloitte confirmed in 2017 that attackers had accessed its email system through an administrator account reported to lack two-factor authentication. Allen & Overy reported a data incident affecting storage servers in November 2023 after the LockBit group claimed an attack; LockBit also hit Infosys McCamish Systems in November 2023, affecting about six million people. In the United Kingdom, Clop's exploitation of MOVEit in June 2023 exposed staff data held by payroll provider Zellis for employers including British Airways and the BBC, and the Information Commissioner fined outsourcer Capita £14 million in October 2025 over a 2023 attack affecting about 6.6 million people. Business email compromise, the classic fraud against firms and their clients, accounted for about US$3.05 billion of losses reported to the FBI in 2025.
In India the obligations are layered. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be kept for 180 days, and its 2025 audit policy guidelines expect risk-based independent audits. The DPDP Act and Rules make firms data fiduciaries for their own staff and candidates and, in most client work, data processors that may act only under a valid contract, with reasonable security safeguards and breach intimation applying from May 2027. Professional confidentiality runs deeper still: the Chartered Accountants Act, 1949 treats disclosure of client information without consent as professional misconduct, the Bar Council of India's rules and Section 132 of the Bharatiya Sakshya Adhiniyam, 2023 protect advocate-client communications, and the Supreme Court reaffirmed that privilege in October 2025. Clients add their own layer: RBI's IT outsourcing directions, SEBI's Cybersecurity and Cyber Resilience Framework and listed-company disclosure under SEBI LODR all flow down to the firms that serve them, usually as SOC 2, ISO/IEC 27001 and security-questionnaire demands.
|
Key takeaway In professional services, a cyber incident is a breach of the client relationship itself. Mailboxes, identities, documents, payments and people data must be protected together, and the firm must be able to prove it to clients who are themselves regulated. |
2. The ecosystem at a glance
Figure 1: India's professional and business services ecosystem.
3. Categories of professional and business services firms
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Law firms and legal services |
Full-service and boutique firms, litigation chambers, legal process outsourcing and in-house legal teams |
Partnerships and LLPs, sole practitioners, Indian offices of global networks |
Advocates Act 1961 and BCI rules; BSA 2023 Section 132; DPDP; CERT-In |
|
Chartered accountancy and audit firms |
Statutory and internal audit, assurance, tax, forensic accounting and advisory |
Partnerships and LLPs, Indian member firms of global networks |
Chartered Accountants Act 1949; ICAI Code of Ethics; NFRA for specified audits; DPDP; CERT-In |
|
Tax, company secretarial and corporate services |
Tax practices, company secretaries, registrars and share transfer agents, filing and compliance services |
Professional firms and private companies |
ICSI and ICAI rules; SEBI rules and CSCRF for RTAs; DPDP; CERT-In |
|
Management and technology consulting |
Strategy, deals, risk, operations and digital transformation advice |
Global networks, Indian consultancies, independent experts |
Client contracts and NDAs; DPDP; CERT-In; SEBI insider-trading rules for deal information |
|
Recruitment and executive search |
Permanent hiring, executive search, campus hiring, assessments and background verification |
Private companies, global search firms, job platforms |
DPDP for candidate data; IT Act; client contracts; CERT-In |
|
Staffing and contract workforce providers |
Temporary and contract staffing, apprenticeships, managed workforce and compliance services |
Listed and private staffing companies |
Labour codes in force from November 2025; DPDP; SEBI LODR if listed; CERT-In |
|
Payroll and HR outsourcing |
Payroll processing, statutory filings, benefits, HRMS and employee self-service |
Private companies, SaaS providers, divisions of larger firms |
Labour codes; income-tax and provident fund rules; DPDP as processor; CERT-In |
|
Business support and shared services |
BPO, finance and accounting operations, contact centres, GCCs and shared-services centres |
Indian BPO firms, captive centres of global groups |
Client contracts; RBI IT outsourcing and SEBI expectations for regulated clients; DPDP; CERT-In |
4. The regulatory, professional and standards framework at a glance
|
Instrument or expectation |
What it means for professional and business services firms |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering infrastructure, cloud and applications, with closure of findings—relevant to firm networks, client portals and outsourcing platforms |
|
DPDP Act 2023 and DPDP Rules 2025 |
Firms are data fiduciaries for staff, partner and candidate data and usually data processors for client data, engaged only under a valid contract; reasonable security safeguards including encryption, access control, monitoring and one-year log retention; breach intimation; most obligations from May 2027 |
|
Chartered Accountants Act 1949 and ICAI Code of Ethics |
Disclosure of information acquired in a professional engagement without client consent, other than as required by law, is professional misconduct; confidentiality is a fundamental ethical principle |
|
Advocates Act 1961, BCI rules and BSA 2023 Section 132 |
Advocates may not disclose client communications or advice without express consent, subject to narrow exceptions; the Supreme Court in October 2025 restricted investigators from summoning advocates merely for representing clients |
|
RBI Master Direction on IT outsourcing (10 April 2023) |
Banks and other regulated entities must manage risks in outsourced IT and IT-enabled services, including service-provider controls, audit rights and oversight—passed down to business support and shared-services vendors |
|
SEBI CSCRF (August 2024) and LODR Regulations |
Cyber resilience expectations for SEBI-regulated entities, including registrars and share transfer agents; listed companies disclose cyber incidents in the quarterly corporate governance report |
|
Labour codes (in force 21 November 2025) |
Four codes consolidating 29 central labour laws change wage definitions, social security and records for payroll, staffing and HR outsourcing providers |
|
ISO/IEC 27001 and SOC 2 |
The assurance most often requested by clients in due diligence and contracts, alongside security questionnaires and right-to-audit clauses |
|
How these apply Cyber and privacy obligations are cross-sector; professional confidentiality duties depend on the profession; outsourcing and SEBI expectations usually reach firms through client contracts. Confirm against the official instruments and your agreements. |
5. Government, regulatory, professional and private participants
- The Institute of Chartered Accountants of India sets ethical standards and disciplines members; the National Financial Reporting Authority oversees audit quality for specified companies; the Institute of Company Secretaries of India regulates company secretaries.
- The Bar Council of India and State Bar Councils regulate advocates and, since March 2023, the registration of foreign lawyers and law firms on a reciprocal basis, amended in May 2025.
- MeitY and CERT-In set cyber obligations; the Data Protection Board will enforce DPDP; the Ministry of Labour and Employment administers the labour codes that drive payroll and staffing compliance.
- RBI, SEBI and IRDAI regulate the banks, market intermediaries and insurers that are among the largest buyers of professional and outsourced services, and pass their expectations down to vendors.
- Law, accounting, consulting, recruitment, staffing, payroll and shared-services firms range from sole practitioners to listed companies and Indian arms of global networks.
- Cloud email, document-management, file-transfer, payroll, HR and applicant-tracking vendors hold much of the sector's data, and are often the point where an incident begins.
6. Who buys cybersecurity inside a professional services firm
|
Stakeholder |
What they care about |
What they buy |
|
Managing partner, CEO and Board |
Client trust, reputation, professional liability, insurance |
Board advisory, resilience programmes, crisis exercises |
|
CIO, CTO and CISO |
Email, cloud, endpoint and identity security, audits |
Assessments, SOC, cloud and identity hardening |
|
General counsel and risk partner |
Confidentiality, privilege, conflicts, regulatory exposure |
Data protection programmes, investigations, policy reviews |
|
CFO and finance operations |
Payment controls, client funds, invoice and payroll fraud |
BEC defences, fraud investigations, process reviews |
|
Client service and delivery leaders |
Security questionnaires, client audits, SOC 2 demands |
ISO 27001 and SOC 2 readiness, evidence packs |
|
HR, payroll and talent heads |
Employee and candidate data, background checks, payroll runs |
DPDP programmes, HR and payroll platform testing |
|
Data protection officer and compliance |
DPDP fiduciary and processor duties, breach workflows |
DPDP gap assessments, DPO-as-a-Service, contract reviews |
7. Why each type of firm needs a different approach
|
Firm type |
Highest-consequence risk |
Starting point for assurance |
|
Law firms |
Mailbox takeover, payment diversion, theft of privileged deal and litigation files |
Email and identity hardening, DMS access review, SOC, BEC response |
|
CA and audit firms |
Ransomware and data theft in audit season; leak of unpublished results |
Remote-access and segmentation review, DLP, backups, SOC |
|
Consulting firms |
Deal espionage, insider leaks, AI tools handling client data |
Data classification, leaver controls, AI usage policy, monitoring |
|
Recruitment and staffing |
Candidate database exposure, fake recruiter scams, ID document misuse |
Cloud and ATS testing, DPDP programme, brand monitoring |
|
Payroll and HR outsourcing |
Supply chain compromise exposing salary and bank data for many employers |
Vendor risk, file-transfer hardening, encryption, processor contracts |
|
Business support and shared services |
Help-desk social engineering, payment fraud, client audit findings |
Identity verification, PAM, SOC, RBI and client evidence packs |
8. How Codec Networks works with professional and business services firms
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For professional and business services firms we deliver Microsoft 365 and Google Workspace security reviews, phishing-resistant identity design, external and remote-access assessments, client portal, payroll, HR and recruitment platform testing, data classification, document-management and data-room access reviews with data loss prevention, DPDP programmes covering both fiduciary and processor duties, ISO 27001 and SOC 2 readiness with client evidence packs, CERT-In-aligned audits, 24x7 managed SOC focused on mailbox, identity and exfiltration signals, and BEC, payroll, invoice and insider fraud investigations—delivered under strict confidentiality and connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by professional registration, client base, contracts, listing status and the data each firm handles; confirm them against the official CERT-In, MeitY, ICAI, Bar Council of India, RBI, SEBI and Ministry of Labour and Employment instruments and your own agreements.