Compliance Portal — Three-Track Hub
India-focused compliance intelligence across three tracks: the CAR framework for compliance automation, CSA Zero Trust v1.1 for cloud security posture, and statutory checklists for DPDP Act, CERT-In, IT Rules, and AI synthetic content obligations.
Track 1 — Automation
CAR
CAR Framework
Compliance Automation Revolution — four implementation pathways for policy-as-code, evidence automation, and continuous control monitoring.
Track 2 — Zero Trust
CSA
CSA Zero Trust v1.1
Cloud Security Alliance Zero Trust Guiding Principles — 5-pillar mapping matrix with capability assessment and India cloud context.
Track 3 — Statutory Compliance
INDIA
DPDP Act 2023
Digital Personal Data Protection Act — 44-point compliance checklist with penalty exposure calculator.
INDIA
CERT-In Directions 2022
6-hour reporting, 180-day retention, NTP sync, VPN/cloud provider obligations — interactive compliance validator.
INDIA
IT Rules 2021 + Amendments
Intermediary due diligence, grievance officer, content takedown, Part III AI content obligations.
NEW
Synthetic Content Validation
AI-generated content labelling requirements under IT Rules 2021, deepfake obligations, C2PA standards, and validation checklist.
CAR Framework — Compliance Automation Revolution
The CAR framework defines four implementation pathways to transform compliance from periodic assessments to continuous, automated monitoring. Reduces audit effort by 60–75% and provides real-time compliance posture visibility.
CAR Framework Architecture
The Compliance Automation Revolution (CAR) framework moves compliance programmes through four technology-enabled tracks. Organisations typically begin with Track A (policy digitisation), layer in Track B (automated evidence), then achieve continuous compliance via Tracks C and D.
| Track | Name | Goal | Key Technologies | Effort Saved |
|---|---|---|---|---|
| A | Policy-as-Code | Encode compliance policies as machine-executable rules | OPA/Rego, Terraform Sentinel, AWS Config Rules, Azure Policy | ~40% |
| B | Evidence Automation | Automate collection of compliance evidence | API integrations, CSPM tools, log aggregation pipelines | ~55% |
| C | Continuous Control Monitoring | Real-time control effectiveness measurement | GRC platforms (ServiceNow, Archer), SIEM correlation, dashboards | ~65% |
| D | Risk Automation | Automated risk scoring and escalation | ML-based anomaly detection, automated risk workflows, SOAR | ~75% |
Track A — Policy-as-Code Implementation
ℹ️ Policy-as-code encodes compliance requirements as version-controlled, machine-executable rules that run in CI/CD pipelines — catching violations before they reach production.
Step 1: Control Inventory
Map all compliance controls (ISO 27001, DPDP Act, CERT-In, RBI) to infrastructure-level checks. Each control gets an ID, a testable assertion, and a data source. Output: a control register with ~200 enforceable checks.
Step 2: OPA/Rego Rules
Write Open Policy Agent (OPA) rules in Rego language. Example: `deny[msg] { input.resource.type == "s3_bucket"; not input.resource.encryption_enabled; msg := "S3 bucket not encrypted — violates CERT-In S.4(1)(iv)"}`. Run in Terraform plan, Kubernetes admission, and API gateway.
Step 3: Cloud-Native Policies
AWS Config Rules for CERT-In/RBI requirements: `encrypted-volumes`, `mfa-enabled-for-iam-console-access`, `cloudtrail-enabled`, `vpc-flow-logs-enabled`. Azure Policy for DPDP data residency: deny resources outside `centralindia` and `southindia` regions.
Step 4: CI/CD Integration
Embed policy checks in GitHub Actions/GitLab CI: `terraform plan | conftest test --policy ./policies/`. Block merges that introduce policy violations. Compliance gates run in under 90 seconds. Failed checks link directly to the relevant control and remediation guidance.
Sample OPA Rules — India Compliance Context
| Rule | Regulation | OPA Check |
|---|---|---|
| S3/Blob encryption at rest | CERT-In S.4(1)(iv) | not input.resource.server_side_encryption → deny |
| MFA on all IAM/Entra users | CERT-In S.4(2)(vii) | not input.user.mfa_enabled → deny for console access |
| CloudTrail enabled — all regions | CERT-In Log Retention S.6 | input.cloudtrail.multi_region_enabled == false → deny |
| Data residency — India regions only | DPDP Act S.16 | not startswith(input.resource.region, "ap-south") → deny for PII data stores |
| No public S3 buckets | DPDP Act S.8 Security | input.resource.public_access_block.block_public_acls == false → deny |
| KMS CMK rotation enabled | RBI IT Framework | not input.key.enable_key_rotation → deny for BFSI regulated keys |
Track B — Evidence Automation Pipeline
Evidence automation eliminates manual screenshot-and-upload cycles. API integrations pull evidence directly from source systems and store it in a timestamped, tamper-evident repository.
CSPM Integration
Cloud Security Posture Management tools (Prisma Cloud, AWS Security Hub, Microsoft Defender for Cloud) export compliance posture as API-queryable data. Schedule nightly pulls and store as structured JSON evidence with control-ID tags.
Log Evidence Pipeline
CERT-In S.6 requires 180-day log retention. Automate: CloudTrail → S3 (lifecycle policy: 180 days standard + 5 years Glacier Deep Archive). Generate evidence package for auditors: log stream config export + S3 lifecycle policy screenshot + retention report.
Vulnerability Scan Evidence
Tenable/Qualys API: schedule weekly scan, pull JSON report, extract: total criticals, mean time to remediate by severity, patch coverage %. Map to CERT-In VAPT requirement. Automatically link to control CERT-IN-5.3 in your GRC platform.
Access Review Automation
Pull AD/Entra privileged group membership monthly. Compare against approved access matrix. Generate differential report: new additions (require sign-off), removals (auto-confirm), unchanged (auto-evidence). Reduces access review from 8 hours to 20 minutes.
Track C — Continuous Control Monitoring
| Control Domain | Monitoring Method | KPI Metric | Alert Threshold |
|---|---|---|---|
| Access Management | Identity analytics (Entra/Okta logs) | % accounts with MFA enabled | <95% → P1 alert |
| Vulnerability Management | Scanner API daily pull | Critical CVEs >30 days unpatched | >0 → P1 alert |
| Log Retention | S3/Blob lifecycle API check | All log streams have 180-day+ retention | Any gap → P1 alert |
| Encryption | Cloud config API scan | % data stores encrypted at rest | <100% → P1 alert |
| Incident Response | Ticketing system API | CERT-In reportable incidents filed within 6 hours | SLA breach → P1 alert |
| Backup Integrity | Backup service API test restores | Last successful restore <7 days old | >7 days → P2 alert |
| Patch Compliance | WSUS/SCCM/Ansible API | % endpoints current within 30 days of release | <90% → P2 alert |
Track D — Risk Automation
Automated Risk Scoring
Connect vulnerability scanner output, CSPM findings, and threat intelligence to your risk register. Auto-calculate inherent risk: CVSS score × asset value × threat actor targeting = inherent risk score. Trigger risk review when score crosses defined threshold.
Residual Risk Tracking
After control application: residual_risk = inherent_risk × (1 - control_effectiveness). Control effectiveness scores updated from Track C continuous monitoring data. Risk register stays current without manual updates.
SOAR Risk Workflows
SOAR playbooks triggered on risk threshold breach: escalate to risk owner → request remediation plan → set due date → auto-close on re-scan green → generate audit trail. Full lifecycle documented without manual GRC system updates.
AI-Assisted Risk Narratives
Generate risk report narrative from structured data: "The unencrypted S3 bucket containing PII (DPDP Act scope) presents HIGH inherent risk due to active scanning activity (Shodan indexed 2024-09-18). Residual risk remains HIGH — no compensating control applied. Recommended: enable SSE-KMS within 48 hours."
CAR Maturity Assessment
Rate your organisation's current implementation for each CAR track (0=None, 1=Ad-hoc, 2=Defined, 3=Automated).
CSA Zero Trust Guiding Principles v1.1 — Mapping Matrix
The Cloud Security Alliance Zero Trust (v1.1, 2023) defines five interdependent security pillars and three cross-cutting capabilities. This module maps your existing controls to each pillar and generates a capability gap assessment.
CSA Zero Trust — 5 Pillars + 3 Cross-Cutting Capabilities
Zero Trust shifts from perimeter-based security to "never trust, always verify" across every access request. CSA v1.1 adds supply chain and AI-specific guidance missing from earlier versions.
| Pillar | Core Principle | Key India Controls | Maturity Levels |
|---|---|---|---|
| Identity | Verify every user with strong authentication | MFA for all (CERT-In), Aadhaar-based identity for govt | 0 Basic → 3 Adaptive |
| Device | Ensure device health before granting access | MDM enrollment, EDR compliance, BYOD controls | 0 Basic → 3 Autonomous |
| Network | Micro-segment and encrypt all traffic | Zero trust network access (ZTNA), VPC segmentation | 0 Basic → 3 Dynamic |
| Application | Authorise per-session, per-resource access | API gateway with JWT/OAuth, RBAC, least privilege | 0 Basic → 3 Continuous |
| Data | Classify, label, and protect data at all states | DPDP Act data classification, DLP, encryption | 0 Basic → 3 Autonomous |
Cross-Cutting Capabilities (v1.1)
Visibility & Analytics
Centralised logging and behavioural analytics across all pillars. SIEM integration, UEBA for anomaly detection, continuous monitoring dashboards. Maps to CERT-In log retention requirement.
Automation & Orchestration
Automated policy enforcement via SOAR, IaC policy-as-code (OPA), and dynamic access control. Policy decisions made in real-time without human intervention for routine access requests.
Governance
Zero Trust policy ownership, risk-based access decisions, and compliance mapping. DPDP Act data fiduciary obligations align directly with Zero Trust Data pillar governance requirements.
Identity Pillar — Controls Mapping
| Control | Maturity Level | Implementation | India Regulatory Mapping |
|---|---|---|---|
| Strong authentication (MFA) | L2 Defined | TOTP/FIDO2 for all users; hardware keys for privileged | CERT-In S.4(2)(vii) |
| Passwordless authentication | L1 Ad-hoc | Windows Hello, passkeys for pilot group | Best practice; CERT-In strongly recommends |
| Just-in-time privileged access | L0 None | PIM/PAM for time-bound admin access | CERT-In S.4 least privilege |
| Identity governance & access review | L1 Ad-hoc | Quarterly access reviews; automated via Track B | ISO 27001 A.9, RBI MRM |
| Federated identity (SAML/OIDC) | L2 Defined | SSO via Entra ID/Okta for SaaS applications | Best practice |
| Risk-based conditional access | L0 None | Block legacy auth; location + device signal policies | CERT-In, DPDP Act S.8 security safeguards |
Device Pillar — Controls Mapping
| Control | Status | Implementation | Regulatory Mapping |
|---|---|---|---|
| MDM enrollment (corporate devices) | L2 Defined | Intune/Jamf enforced on all corporate endpoints | CERT-In S.4, ISO 27001 A.8.1 |
| EDR on all endpoints | L2 Defined | Defender for Endpoint / CrowdStrike deployed | CERT-In S.4(2), RBI IT Framework |
| Device compliance gate | L1 Ad-hoc | Conditional access blocks non-compliant devices | Best practice, ISO 27001 A.9.1 |
| BYOD isolation | L0 None | MAM without MDM for personal devices, container | DPDP Act S.8 — personal data on BYOD is in scope |
| Software inventory / asset management | L1 Ad-hoc | CMDB updated monthly via automated scan | CERT-In S.4(1), ISO 27001 A.8.1 |
Network Pillar — Controls Mapping
| Control | Status | Implementation | Regulatory Mapping |
|---|---|---|---|
| Micro-segmentation (cloud VPCs) | L2 Defined | VPC security groups, subnet isolation, NACLs | CERT-In S.4(1), RBI IT Framework |
| Zero Trust Network Access (ZTNA) | L0 None | Replace VPN with identity-aware proxy | Best practice replacing CERT-In VPN requirements |
| DNS security (DoH/DoT + filtering) | L1 Ad-hoc | Umbrella/Cisco DNS filtering deployed | CERT-In NTP/DNS S.4(4) |
| TLS 1.3 everywhere | L1 Ad-hoc | Internal services still using TLS 1.2 | CERT-In encryption requirement S.4(1)(v) |
| VPC Flow Logs enabled | L2 Defined | All VPCs flow logs → S3 with 180-day retention | CERT-In S.6 log retention |
| East-west traffic inspection | L0 None | Service mesh (Istio/Linkerd) for microservices | RBI advanced threat management |
Application Pillar — Controls Mapping
| Control | Status | Implementation |
|---|---|---|
| API gateway with AuthN/AuthZ | L2 Defined | AWS API Gateway + Cognito JWT validation on all external APIs |
| Secrets management (not hardcoded) | L1 Ad-hoc | AWS Secrets Manager for DB credentials; still migrating legacy apps |
| WAF + DDoS protection | L2 Defined | AWS WAF v2 + Shield Standard; CloudFront for public endpoints |
| SAST + DAST in CI/CD | L1 Ad-hoc | Semgrep SAST in pipeline; DAST (OWASP ZAP) run quarterly only |
| Software composition analysis (SCA) | L0 None | Snyk/Dependabot not yet integrated in all repos |
| Zero-trust application access | L0 None | All internal apps exposed on VPN; no app-level Zero Trust proxy |
Data Pillar — Controls Mapping (DPDP Act Aligned)
| Control | Status | Implementation | DPDP Mapping |
|---|---|---|---|
| Data classification schema | L1 Ad-hoc | 4-tier: Public/Internal/Confidential/Restricted. Manual tagging. | S.8 data minimisation |
| Encryption at rest (all stores) | L2 Defined | AES-256 for all S3, RDS, EBS via AWS KMS CMKs | S.8 security safeguards |
| Encryption in transit | L2 Defined | TLS 1.2+ enforced; moving to TLS 1.3 | S.8 security safeguards |
| DLP (Data Loss Prevention) | L0 None | Microsoft Purview DLP in scoping phase | S.8 security, S.16 cross-border transfer |
| Data residency (India) | L1 Ad-hoc | Primary data in ap-south-1; DR in ap-south-2; some SaaS unclear | S.16 cross-border transfer |
| Right to erasure implementation | L0 None | No automated data deletion capability across all systems | S.12 right to erasure |
Zero Trust Capability Assessment
Rate each pillar (0=None, 1=Ad-hoc, 2=Defined, 3=Automated). Generates gap analysis with recommended next steps.
DPDP Act 2023 — 44-Point Compliance Checklist
Interactive compliance checklist for the Digital Personal Data Protection Act 2023. Organised by obligation category with status tracking, penalty exposure, and remediation priorities.
44-Point DPDP Compliance Checklist
Penalty Exposure by Violation
| Section | Obligation | Max Penalty | Aggravating Factors |
|---|---|---|---|
| S.5 | Processing beyond purpose/not notified | Rs.50Cr | Sensitive data, large scale |
| S.6 | Invalid consent; bundled consent used | Rs.250Cr | Biometric data, children |
| S.7 | Sensitive data without additional safeguards | Rs.200Cr | Health, financial, biometric |
| S.8 | Failed security safeguards; data minimisation | Rs.250Cr | Prior breach, negligence |
| S.8(7) | Failed breach notification to DPBI | Rs.200Cr | Delay, cover-up |
| S.9 | Children's data without parental consent | Rs.200Cr | Profiling, targeting children |
| S.12–13 | Failed data principal rights | Rs.50Cr | Repeated refusal |
| S.16 | Cross-border transfer to non-approved country | Rs.200Cr | Sensitive data transferred |
| S.17 | SDF failing additional obligations (DPO/DPIA) | Rs.150Cr | Pattern of non-compliance |
DPDP Breach Response SLA Tracker
T+0: Detect
Identify the personal data breach. Scope: which data, how many data principals, nature of compromise (access/disclosure/loss/alteration). Activate breach response team and begin clock.
T+6hrs: DPBI Notify
Notify the Data Protection Board of India. Required content: nature of breach, categories and estimated number of data principals, likely consequences, measures taken. Use DPBI portal when live. Currently: email notification acceptable.
T+24hrs: Data Principal Notice
Notify affected data principals if breach is likely to cause harm. Plain English notice: what happened, what data was involved, what you are doing, what they should do. Do not delay to "assess impact" — notify and update.
T+72hrs: Root Cause
Complete root cause analysis. Preserve forensic evidence. Document timeline. Identify contributing failures. Prepare remediation plan. Regulatory note: RBI, SEBI, and IRDAI have separate and potentially shorter breach notification obligations.
CERT-In Directions 2022 — Compliance Checklist
Interactive checklist for CERT-In's Information Security Practices, Procedures, Prevention, Response and Reporting of Cyber Incidents (2022). Mandatory for all Indian organisations, intermediaries, and data centres.
CERT-In 2022 — Key Technical Requirements
| Requirement | Obligation | Deadline/SLA | Evidence Required |
|---|---|---|---|
| 6-Hour Incident Reporting | Mandatory reporting of 20 categories of cyber incidents to CERT-In within 6 hours of detection | 6 hours from detection | Incident ticket timestamp, CERT-In portal submission receipt |
| 180-Day Log Retention | ICT system logs retained for 180 days within Indian jurisdiction | Always-on | Log retention policy, S3 lifecycle rules, retention compliance report |
| NTP Synchronisation | All ICT infrastructure synchronised to NTP servers of NIC/NPTEL/STQC or connected to the National Informatics Centre | Always-on | NTP config screenshots, time sync verification report |
| VPN Provider Information | VPN service providers must maintain customer data for 5 years | 5-year retention | Applicable only to VPN service providers; customer data log |
| Cloud/DC Provider Logs | Data centre, cloud, VPS providers must maintain subscriber information and logs for 5 years | 5-year retention | Subscriber registration data, access logs with 5-year lifecycle policy |
| VAPT Requirements | Regular vulnerability assessments and penetration testing; patch critical vulnerabilities within defined timelines | Annually minimum; critical patches within 30 days | VAPT report signed by CERT-In empanelled auditor, patch timeline evidence |
| MFA for all privileged access | Multi-factor authentication for all admin, remote access, and cloud management consoles | Always-on | MFA enforcement policy, Azure AD/AWS IAM MFA compliance report |
20 Reportable Incident Categories
Critical Infrastructure
Attacks on power, banking, telecom, healthcare, transportation systems. Always report within 6 hours. Include: attack vector, affected systems, impact assessment, initial containment measures.
Data Breaches
Unauthorised access to personal data, financial data, or sensitive information. CERT-In notification required regardless of DPDP Act breach notification status — two separate obligations.
Malware / Ransomware
Detection of malware including ransomware, spyware, botnets, rootkits. Report even if contained. Include malware hash, affected system count, propagation method if known.
DDoS Attacks
Distributed denial of service attacks affecting availability. Report within 6 hours of detection. Include traffic volume, source ASNs, affected services, and mitigation measures deployed.
Log Retention Architecture — 180 Days
| Log Type | CERT-In Requirement | AWS Implementation | Azure Implementation |
|---|---|---|---|
| API access logs | 180 days, India jurisdiction | CloudTrail → S3 ap-south-1 (lifecycle: 180d standard) | Activity Log → Storage Account centralindia (180d retention) |
| Network flow logs | 180 days | VPC Flow Logs → CloudWatch Logs (180d retention) or S3 | NSG Flow Logs → Storage Account (180d) |
| Authentication logs | 180 days | CloudTrail + IAM events; Cognito user pool logs | Entra ID Sign-in Logs (P1/P2: 30d, archive to Storage) |
| DNS query logs | 180 days | Route 53 Resolver Query Logging → S3 | Azure DNS Analytics → Log Analytics (180d) |
| System event logs | 180 days | CloudWatch Agent → Log Groups (180d retention) | Diagnostic settings → Log Analytics (180d) |
| VPN/Remote access logs | 180 days; 5 years for VPN providers | Client VPN logs → CloudWatch; session logs retained | VPN Gateway logs → Storage + Log Analytics |
IT Rules 2021 + 2023 Amendment — Compliance Checklist
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 and the 2023 amendment introducing Part III AI content obligations. Mandatory for significant social media intermediaries and online platforms.
Part I — Intermediary Due Diligence Obligations
Part III — AI-Generated Content Obligations (2023 Amendment)
⚠️ The 2023 IT Rules amendment introduces specific obligations for platforms hosting AI-generated content. These are now in force — violation is treated as failure of due diligence under the IT Act 2000.
AI Content Labelling (Rule 3(1)(b)(v))
All synthetic/AI-generated content — images, audio, video, text — must be labelled with a clear disclosure. Platforms must implement technical mechanisms to receive and display creator-provided metadata labels. Label must be visible to end users.
Deepfake Prohibition (Rule 3(1)(b)(vii))
Platforms must not allow creation/hosting of deepfakes that impersonate real individuals without consent. A grievance mechanism must exist for individuals to flag deepfake content of themselves. Removal within 24 hours of valid complaint.
Provenance Metadata
Platforms developing or hosting AI tools for content generation must implement C2PA (Content Credentials / Coalition for Content Provenance and Authenticity) or equivalent metadata standards. Provenance must be preserved during platform sharing/re-hosting.
AI Tool Disclosure
Platforms offering AI content generation tools must publish clear notices: (1) the tool generates synthetic content; (2) the output may not represent real events; (3) how users can identify AI-generated content. Notice required at point of tool access.
Significant Social Media Intermediary (SSMI) Additional Obligations
SSMIs have more than 5 million registered users in India. Additional requirements apply.
Synthetic Content Validation Checklist
AI-generated content creates new compliance obligations under IT Rules 2021 (Part III), DPDP Act, and emerging global standards. This module helps organisations validate their AI content governance posture.
Synthetic Content Compliance Validator
C2PA Content Credentials Implementation Guide
What is C2PA?
The Coalition for Content Provenance and Authenticity (C2PA) is an open standard (ISO 21107) for embedding cryptographically signed metadata ("Content Credentials") into digital media. Members include Microsoft, Adobe, BBC, Google, Sony, and OpenAI.
Technical Implementation
C2PA manifests are embedded in JUMBF (JPEG Universal Metadata Box Format) for images/video, or as sidecar files. Each manifest contains: soft bindings (content hash), hard bindings (camera/device ID), AI assertion (`c2pa.ai_generated`), and action history.
Adobe Content Authenticity
Adobe Photoshop, Firefly, and Lightroom automatically embed C2PA credentials. Verify at contentauthenticity.org. For video: Premiere Pro adds credentials from CC 2024 onwards. Camera manufacturers Canon, Sony, Leica embed at capture time.
India Compliance Mapping
IT Rules 2021 Part III requires labelling but does not mandate C2PA specifically. C2PA implementation satisfies the spirit of the requirement and provides legal defensibility. DPBI (DPDP Act) guidance expected to reference C2PA for sensitive content.
Deepfake Compliance Obligations — India
| Obligation | Law | Who It Applies To | SLA |
|---|---|---|---|
| Display deepfake label on AI-generated content depicting real persons | IT Rules 2021 Rule 3(1)(b)(v) | All platforms hosting AI-generated content | At time of publication |
| Accept grievances from individuals whose likeness is deepfaked | IT Rules 2021 Rule 3(2) | All intermediaries | Acknowledge 24h, resolve 15 days |
| Remove non-consensual deepfake content on valid complaint | IT Rules 2021 Rule 3(1)(d) | All platforms | 24 hours of valid complaint |
| Not create/distribute deepfake that violates privacy of individual | IT Act S.66E + IT Rules | All persons and entities | Prohibited outright |
| Do not collect biometric data to train deepfake models without consent | DPDP Act S.6+7 | AI model trainers/deployers | Before training data collection |
| Disclose voice clone AI use in commercial communications | Consumer Protection Act 2019 + IT Rules Part III | All commercial communications using synthetic voice | At point of communication |