SICHERTEN Blog https://sicherten.com/blog.html Cybersecurity, audits and India compliance insights from SICHERTEN. en-in Wed, 08 Jul 2026 18:58:18 +0530 Do you need a Data Protection Officer under the DPDPA?https://sicherten.com/blog-do-you-need-a-dpo-under-dpdpa.htmlhttps://sicherten.com/blog-do-you-need-a-dpo-under-dpdpa.htmlTue, 07 Jul 2026 09:00:00 +0530DPDPASome organisations must appoint a DPO under the DPDPA; many others benefit from one. Who needs it, what the role does, and how to resource it. Mobile application penetration testing: what to test and whyhttps://sicherten.com/blog-mobile-application-penetration-testing.htmlhttps://sicherten.com/blog-mobile-application-penetration-testing.htmlSat, 04 Jul 2026 09:00:00 +0530VAPTMobile apps run on devices you do not control - which changes everything. What mobile pen-testing covers, and why web testing alone misses it. DPDP Rules 2025 are here: your countdown to 13 May 2027https://sicherten.com/blog-dpdp-rules-2025-countdown-to-may-2027.htmlhttps://sicherten.com/blog-dpdp-rules-2025-countdown-to-may-2027.htmlWed, 01 Jul 2026 09:00:00 +0530DPDPAThe Rules that operationalise the DPDP Act are notified and the clock is ticking to 13 May 2027. Here is the phased timeline - and what to do in 2026. GDPR for Indian companies serving EU customershttps://sicherten.com/blog-gdpr-for-indian-companies.htmlhttps://sicherten.com/blog-gdpr-for-indian-companies.htmlTue, 30 Jun 2026 09:00:00 +0530Regulatory UpdatesThe GDPR reaches beyond Europe. When it applies to Indian companies, what it requires, and how it overlaps with your DPDPA work. Writing an AI acceptable-use policy for your organisationhttps://sicherten.com/blog-writing-an-ai-acceptable-use-policy.htmlhttps://sicherten.com/blog-writing-an-ai-acceptable-use-policy.htmlSat, 27 Jun 2026 09:00:00 +0530AI GovernanceThe simplest, highest-impact AI governance step: a clear acceptable-use policy. What to put in it, and how to make it stick. DPDPA 2023: what Indian businesses must do nowhttps://sicherten.com/blog-dpdpa-2023-what-indian-businesses-must-do-now.htmlhttps://sicherten.com/blog-dpdpa-2023-what-indian-businesses-must-do-now.htmlWed, 24 Jun 2026 09:00:00 +0530DPDPAWho the Act applies to, the obligations that matter, the penalties at stake, and a practical six-step plan to get ready. ISO 27701: extending your ISMS to privacyhttps://sicherten.com/blog-iso-27701-extending-isms-to-privacy.htmlhttps://sicherten.com/blog-iso-27701-extending-isms-to-privacy.htmlSat, 20 Jun 2026 09:00:00 +0530ISO & AuditsISO 27701 turns your security management system into a privacy one too. What it adds, who it suits, and how it maps to GDPR and DPDPA. Consent Managers under the DPDPA: what they are and how to preparehttps://sicherten.com/blog-consent-managers-under-the-dpdpa.htmlhttps://sicherten.com/blog-consent-managers-under-the-dpdpa.htmlTue, 16 Jun 2026 09:00:00 +0530DPDPAThe DPDP framework introduces a new intermediary - the Consent Manager. Here is what it is, who can be one, and how to get your systems ready. Cloud penetration testing: securing AWS, Azure and GCP workloadshttps://sicherten.com/blog-cloud-penetration-testing.htmlhttps://sicherten.com/blog-cloud-penetration-testing.htmlSat, 13 Jun 2026 09:00:00 +0530VAPTCloud breaks differently from on-prem - usually through configuration, not code. What cloud pen-testing examines, and where the real risk sits. The OWASP Top 10, explained for busy teamshttps://sicherten.com/blog-owasp-top-10-explained.htmlhttps://sicherten.com/blog-owasp-top-10-explained.htmlWed, 10 Jun 2026 09:00:00 +0530VAPTThe industry reference for web application risk, in plain English - what each category means and why it still catches teams out. CCPA and CPRA: what US-facing businesses must knowhttps://sicherten.com/blog-ccpa-and-cpra-explained.htmlhttps://sicherten.com/blog-ccpa-and-cpra-explained.htmlSat, 06 Jun 2026 09:00:00 +0530Regulatory UpdatesCalifornia privacy law gives consumers real rights and businesses real duties. Who is covered, what it grants, and what compliance takes. VAPT, penetration testing and vulnerability scanning: what’s the difference?https://sicherten.com/blog-vapt-pentest-vulnerability-scanning-difference.htmlhttps://sicherten.com/blog-vapt-pentest-vulnerability-scanning-difference.htmlWed, 03 Jun 2026 09:00:00 +0530VAPTThese three terms get used interchangeably, but they solve different problems. Here is how to tell them apart and choose the right one. Data mapping and records of processing: the first step to compliancehttps://sicherten.com/blog-data-mapping-and-ropa.htmlhttps://sicherten.com/blog-data-mapping-and-ropa.htmlSun, 31 May 2026 09:00:00 +0530DPDPAEvery privacy programme starts here: knowing what personal data you hold and where it flows. How to build a data map and records of processing. API security: why your APIs are now the biggest attack surfacehttps://sicherten.com/blog-api-security-biggest-attack-surface.htmlhttps://sicherten.com/blog-api-security-biggest-attack-surface.htmlThu, 28 May 2026 09:00:00 +0530VAPTAPIs quietly became the backbone of modern apps - and a favourite target. Why they need dedicated testing, and the flaws we see most. Red teaming vs penetration testing: which does your organisation need?https://sicherten.com/blog-red-teaming-vs-penetration-testing.htmlhttps://sicherten.com/blog-red-teaming-vs-penetration-testing.htmlSun, 24 May 2026 09:00:00 +0530VAPTBoth simulate attackers, but they answer different questions. How red teaming differs from pen-testing - and which one you actually need. SOC 2 or ISO 27001: which does your business actually need?https://sicherten.com/blog-soc-2-or-iso-27001-which-do-you-need.htmlhttps://sicherten.com/blog-soc-2-or-iso-27001-which-do-you-need.htmlWed, 20 May 2026 09:00:00 +0530ISO & AuditsBoth prove you take security seriously - but they work differently and suit different buyers. A practical guide to choosing, or doing both efficiently. AI risk assessment: identifying and managing the risks in your AIhttps://sicherten.com/blog-ai-risk-assessment.htmlhttps://sicherten.com/blog-ai-risk-assessment.htmlSun, 17 May 2026 09:00:00 +0530AI GovernanceAI carries risks a standard assessment misses - bias, drift, explainability, new security exposure. How to assess and manage them. RBI, SEBI and IRDAI: keeping pace with India’s financial-sector cyber ruleshttps://sicherten.com/blog-rbi-sebi-irdai-financial-sector-cyber-rules.htmlhttps://sicherten.com/blog-rbi-sebi-irdai-financial-sector-cyber-rules.htmlThu, 14 May 2026 09:00:00 +0530Regulatory UpdatesThe financial regulators have raised the bar on cyber resilience. A high-level map of what RBI, SEBI and IRDAI expect - and how to stay current. RBI IT governance: a primer for NBFCshttps://sicherten.com/blog-rbi-it-governance-for-nbfcs.htmlhttps://sicherten.com/blog-rbi-it-governance-for-nbfcs.htmlMon, 11 May 2026 09:00:00 +0530Regulatory UpdatesThe RBI has raised the bar on IT governance for NBFCs. A high-level primer on the expectations - and how to meet them without drowning in circulars. Your first ISO 27001 audit: a practical readiness checklisthttps://sicherten.com/blog-first-iso-27001-audit-checklist.htmlhttps://sicherten.com/blog-first-iso-27001-audit-checklist.htmlFri, 08 May 2026 09:00:00 +0530ISO & AuditsHeading into your first ISO 27001 certification audit? A plain-English readiness checklist covering the ISMS, evidence and what auditors look for. Understanding the Statement of Applicability (SoA)https://sicherten.com/blog-understanding-statement-of-applicability.htmlhttps://sicherten.com/blog-understanding-statement-of-applicability.htmlTue, 05 May 2026 09:00:00 +0530ISO & AuditsThe SoA is the document that ties your whole ISMS together - and the one auditors scrutinise. What it must contain, and how to get it right. CERT-In’s six-hour incident reporting: what Indian organisations must dohttps://sicherten.com/blog-cert-in-6-hour-incident-reporting.htmlhttps://sicherten.com/blog-cert-in-6-hour-incident-reporting.htmlSat, 02 May 2026 09:00:00 +0530Regulatory UpdatesCERT-In requires certain cyber incidents to be reported within six hours of detection. What that means in practice - and how to be ready. DPDPA and employee data: privacy obligations for HRhttps://sicherten.com/blog-dpdpa-and-employee-data.htmlhttps://sicherten.com/blog-dpdpa-and-employee-data.htmlTue, 28 Apr 2026 09:00:00 +0530DPDPAPrivacy law does not stop at customers - your employees are Data Principals too. What the DPDPA means for HR and the data it holds. SOC 2 Type I vs Type II: which report does your customer want?https://sicherten.com/blog-soc-2-type-i-vs-type-ii.htmlhttps://sicherten.com/blog-soc-2-type-i-vs-type-ii.htmlFri, 24 Apr 2026 09:00:00 +0530ISO & AuditsSOC 2 comes in two flavours, and buyers care which one you have. A short, practical guide to Type I vs Type II - and how to choose. How often should you run a penetration test?https://sicherten.com/blog-how-often-penetration-test.htmlhttps://sicherten.com/blog-how-often-penetration-test.htmlMon, 20 Apr 2026 09:00:00 +0530VAPTOnce a year? After every release? The honest answer is it depends - here are the factors that set the right cadence for your organisation. PCI DSS v4.0.1 in 2026: every requirement is now mandatoryhttps://sicherten.com/blog-pci-dss-4-0-1-mandatory-2026.htmlhttps://sicherten.com/blog-pci-dss-4-0-1-mandatory-2026.htmlWed, 15 Apr 2026 09:00:00 +0530Regulatory UpdatesThe grace period is over - since March 2025 every PCI DSS v4.x requirement is enforceable. What changed, and what card-handling businesses must do now. HIPAA for Indian IT and healthcare service providershttps://sicherten.com/blog-hipaa-for-indian-service-providers.htmlhttps://sicherten.com/blog-hipaa-for-indian-service-providers.htmlSat, 11 Apr 2026 09:00:00 +0530Regulatory UpdatesServe US healthcare clients? You may be a HIPAA business associate. What that means, the safeguards required, and how to prove them. Shadow AI: the governance risk hiding in your organisationhttps://sicherten.com/blog-shadow-ai-governance-risk.htmlhttps://sicherten.com/blog-shadow-ai-governance-risk.htmlWed, 08 Apr 2026 09:00:00 +0530AI GovernanceYour staff are already using AI tools you may not know about. What shadow AI is, the risks it creates, and how to bring it into the light. Governing generative AI: a practical checklist for leadershttps://sicherten.com/blog-governing-generative-ai.htmlhttps://sicherten.com/blog-governing-generative-ai.htmlThu, 02 Apr 2026 09:00:00 +0530AI GovernanceGenerative AI brings its own risks - hallucination, leakage, IP, prompt injection. A practical governance checklist for leaders rolling it out. The EU AI Act, explained for organisations outside Europehttps://sicherten.com/blog-eu-ai-act-outside-europe.htmlhttps://sicherten.com/blog-eu-ai-act-outside-europe.htmlMon, 30 Mar 2026 09:00:00 +0530AI GovernanceThe EU AI Act can reach organisations well beyond Europe. What it is, why it might apply to you, and how its phased, risk-based rules work. ISO/IEC 42001: putting governance around your use of AIhttps://sicherten.com/blog-iso-42001-governance-for-your-use-of-ai.htmlhttps://sicherten.com/blog-iso-42001-governance-for-your-use-of-ai.htmlWed, 18 Mar 2026 09:00:00 +0530AI GovernanceThe first management-system standard for AI has arrived. What an AIMS is, who needs one, and how organisations that use AI can begin. Building a data breach response plan for the DPDPAhttps://sicherten.com/blog-dpdpa-breach-response-plan.htmlhttps://sicherten.com/blog-dpdpa-breach-response-plan.htmlThu, 12 Mar 2026 09:00:00 +0530DPDPAThe DPDPA requires you to report breaches - to the Board and to affected people. What a response plan needs so you can act in time. ISO 22301: business continuity that actually workshttps://sicherten.com/blog-iso-22301-business-continuity.htmlhttps://sicherten.com/blog-iso-22301-business-continuity.htmlFri, 20 Feb 2026 09:00:00 +0530ISO & AuditsRansomware and outages make continuity a board issue. What ISO 22301 covers, and how to build a continuity plan that works when it is needed.