INDUSTRY FACT FILE · CLOUD, DATA CENTRES & HOSTING

Cybersecurity FAQs for Cloud, Data Centre and Hosting Providers

Forty frequently asked questions and answers in five categories, written for leadership, CISOs, platform, facility, compliance and abuse teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, empanelment and compliance 3.  Category 3: Platform, virtualisation and control plane 4.  Category 4: Facility, SOC and incident response 5.  Category 5: Customers, vendors, privacy and AI

Audience: CEOs, Boards and CISOs

Q1. Why are infrastructure providers targeted?

They run shared layers—hypervisors, control planes, facilities—so one compromise can affect many customers.

Q2. What are the biggest risks?

Hypervisor ransomware, control-plane takeover, exposed out-of-band management, platform abuse, facility OT compromise, backup loss and cascading outages.

Q3. Which incidents illustrate the risk?

The ESXiArgs hypervisor ransomware campaign (2023), a 2021 data centre fire in Strasbourg and the July 2024 faulty security-software update each affected many organisations at once.

Q4. What should the Board review?

Platform test results, isolation and resilience findings, CERT-In compliance, incidents, SOC performance, empanelment and certification status.

Q5. How does shared responsibility work?

The provider secures facilities, hardware, virtualisation and the control plane; customers secure their workloads and configurations—documented clearly per service.

Q6. How do customers judge our security?

Through empanelment, ISO 27001/27017/27018, SOC 2 reports, audit rights and incident commitments.

Q7. How should we prioritise investment?

Isolate management planes, harden hypervisors and BMCs, protect backups, then add SOC, red teaming and facility OT monitoring.

Q8. How can Codec Networks help?

Codec Networks provides control-plane and virtualisation testing, BMC and facility OT assessments, resilience testing, managed SOC and customer assurance support.

Audience: Compliance, legal and certification teams

Q9. What do CERT-In Directions require of providers?

Six-hour incident reporting, 180-day ICT logs in India, clock synchronisation to NIC or NPL NTP servers, and five-year subscriber records for data centres, cloud and VPS providers.

Q10. What subscriber details must be kept?

Validated names, contact details, period of hire, IP addresses allotted, purpose, ownership pattern and related information, for five years after cancellation.

Q11. What is MeitY empanelment?

MeitY empanels cloud services for government use, with audits by STQC; confirm current empanelment criteria.

Q12. How does SEBI's cloud framework affect us?

SEBI-regulated customers must meet governance, security, localisation and audit requirements when using cloud, which they pass on to providers.

Q13. What do RBI and IRDAI expect?

RBI treats cloud as IT outsourcing for banks and NBFCs; IRDAI's 2026 guidelines require MeitY-empanelled CSPs with valid STQC audit status.

Q14. How does DPDP apply?

Providers processing customer personal data must apply reasonable safeguards; most obligations take effect in May 2027.

Q15. Which certifications matter?

ISO/IEC 27001, 27017 (cloud security) and 27018 (cloud privacy), SOC 2, and PCI DSS where card data is hosted.

Q16. Can Codec Networks support audits?

Yes. Codec Networks is CERT-In empanelled and supports empanelment readiness, certification audits and customer audits.

Audience: Platform and cloud engineering teams

Q17. How do we protect hypervisors?

Keep management interfaces off the internet, patch promptly, restrict admin access with MFA and monitor management-plane activity.

Q18. How should out-of-band management be secured?

Use a dedicated isolated network, unique credentials, current BMC firmware and logging of all access.

Q19. How do we protect backups?

Keep backups immutable and outside the production administrative domain, and test restores regularly.

Q20. How should the control plane be secured?

Enforce phishing-resistant MFA for administrators, least privilege, API security testing and anomaly monitoring.

Q21. How do we prevent cross-tenant issues?

Test isolation across compute, storage, networking and shared services, and review secure defaults.

Q22. What secure defaults matter most?

Private-by-default storage and sharing, MFA prompts for customers and clear alerts for public resources.

Q23. How do we secure GPU infrastructure?

Harden firmware and drivers, isolate tenants, monitor for resource abuse and assess hardware supply chains.

Q24. How should changes be managed?

Use staged rollouts, automated checks and rollback plans to prevent cascading outages.

Audience: Data centre operations, SOC and incident response teams

Q25. Why is facility OT a cyber risk?

BMS, cooling and power systems are networked and vendor-supported; manipulating them can cause outages across halls.

Q26. How should facility OT be protected?

Segment it from corporate and customer networks, broker vendor access through monitored jump hosts and monitor OT alarms.

Q27. What physical controls matter?

Layered access control, visitor management, CCTV, rack-level locks and verification of remote-hands requests.

Q28. What should our SOC monitor?

Management and control planes, BMC access, abuse signals, DDoS, facility OT alarms and customer-impacting events.

Q29. What should incident playbooks include?

Containment, multi-customer notification, evidence preservation, CERT-In reporting within six hours and coordination with customers' regulators.

Q30. How do we handle abuse reports?

Verify quickly, suspend abusive services, preserve evidence and cooperate with lawful requests.

Q31. How often should DR be tested?

At least annually and after major changes, including failover of critical customer services.

Q32. Should we run tabletop exercises?

Yes—especially hypervisor ransomware, facility failure and cascading outage scenarios.

Audience: Customer success, vendor and privacy teams

Q33. How should we document shared responsibility?

Publish per-service responsibilities, secure configuration guides and what customers must do.

Q34. How do we support customer audits?

Maintain current certifications, evidence packs and processes for audit requests.

Q35. How should hardware vendors be assessed?

Review firmware update practices, supply-chain integrity and vulnerability disclosure.

Q36. How should facility vendors access systems?

Through brokered, time-bound, monitored remote access with named accounts.

Q37. What about data localisation?

Many regulated customers require data to stay in India; confirm region controls, backups and support access respect this.

Q38. How does DPDP affect customer data?

Apply safeguards and support customers' obligations, including breach notice once provisions commence in May 2027.

Q39. What AI infrastructure risks apply?

Model and data theft from GPU clusters, resource abuse and weak isolation between AI tenants.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your platform, facilities and customers; Codec Networks will propose an assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments and your customer agreements.