INDUSTRY FACT FILE · CONGLOMERATES, HOLDING COMPANIES & INVESTMENT GROUPS

Cybersecurity FAQs for Conglomerates and Investment Groups

Forty frequently asked questions and answers in five categories, written for Boards and promoters, risk and compliance teams, deal and portfolio teams, group IT and shared services, and treasury, privacy and response teams.

In this document 1.  Category 1: Group cyber risk, governance and strategy 2.  Category 2: Companies Act, SEBI, RBI, CERT-In and regulatory requirements 3.  Category 3: M&A, investments and portfolio companies 4.  Category 4: Group IT, shared services and identity 5.  Category 5: Treasury, family offices, data protection and incident response

Audience: Boards, promoters, chairmen and group leadership

Q1. Why is cybersecurity a group-level concern rather than a company-level one?

Because group companies share directories, networks, ERP, treasury, suppliers and brands. An incident in one entity can stop others, move into shared systems and reach the parent's reputation and value, so the Board must see and govern cyber risk across the whole group.

Q2. What are the biggest cyber risks for groups and investment firms?

Uneven maturity across entities, shared identity compromise, group-wide malware, subsidiary ransomware, inherited breaches in acquisitions, deal data leaks, deepfake and email payment fraud, outsourcer access, portfolio weaknesses and slow detection that misses CERT-In's six-hour reporting window.

Q3. Which public events should our Board know about?

NotPetya at Maersk and Mondelez in 2017, Marriott's inherited Starwood breach and its £18.4 million UK fine, the US$350 million cut in Verizon's Yahoo price, Arup's 2024 deepfake loss and the 2025 JLR attack, which the UK Cyber Monitoring Centre estimated at £1.9 billion.

Q4. Does a holding company's oversight replace each subsidiary's own duties?

No. Each company keeps its own Board, legal and regulatory duties, including CERT-In reporting and DPDP obligations. The holding company should set the group standard, measure compliance and provide shared capabilities, while each entity remains accountable for applying them.

Q5. What should the Board or risk committee review each quarter?

Comparable maturity scores for material entities and investees, top risks and remediation progress, incidents and near misses across the group, results of treasury and deepfake simulations, deal pipeline cyber findings, supplier and outsourcer assurance, SOC coverage, insurance position and readiness for disclosure.

Q6. Who should own cyber risk in a group?

A group CISO with a Board mandate, working with each company's security lead, the group CIO, CFO and treasury, legal, risk, the data protection officers and deal teams, under a group cyber standard that defines what is decided centrally and what each entity must do.

Q7. How should a group prioritise investment?

Protect shared identity and privileged access first, then treasury and payment controls, a group SOC and incident response, diligence on every material deal, maturity scoring of each entity, backups and recovery, outsourcer assurance and group data protection, improving over successive cycles.

Q8. How can Codec Networks help?

Codec Networks provides group cyber standards and maturity scoring, cyber due diligence and compromise assessments, directory and privileged access reviews, treasury and deepfake simulations, portfolio assessments, CERT-In empanelled audits, CSCRF reviews, DPDP programmes, a shared SOC and incident response for groups and investment firms.

Audience: Company secretaries, compliance, legal, risk and audit teams

Q9. What does the Companies Act 2013 expect of Boards on risk?

The Board's report must include a statement on developing and implementing a risk management policy, the audit committee evaluates internal financial controls and risk management systems, and independent directors should satisfy themselves that risk management systems are robust. Cyber risk belongs within these duties.

Q10. What does SEBI's LODR Regulation 21 require?

The top 1,000 listed entities by market capitalisation must have a risk management committee, with at least one independent director, that meets at least twice a year and whose role specifically covers cyber security. Each listed group company with this obligation needs its own committee.

Q11. What must listed entities disclose about cyber incidents?

Under Regulation 27(2)(ba) of the LODR, listed entities disclose cyber security incidents and breaches, and related losses, in their quarterly corporate governance reports. Material events may also need disclosure under the event disclosure rules; confirm against the current SEBI and exchange requirements.

Q12. How do SEBI's insider trading regulations relate to cybersecurity?

Listed companies and those handling their unpublished price-sensitive information must keep a structured digital database of who shared and received it, with time stamps and audit trails, and maintain internal controls. Deal teams, data rooms and advisers' access should be designed around these duties.

Q13. Does SEBI's CSCRF apply to our fund or portfolio management business?

SEBI's Cybersecurity and Cyber Resilience Framework of August 2024 covers SEBI-regulated entities, including AIF managers and portfolio managers, with requirements scaled by category and a self-certification tier for smaller entities. Categories and timelines were clarified in 2025; confirm your category against the latest circulars.

Q14. What do RBI's directions require of core investment companies?

RBI's August 2020 revision introduced a group risk management committee for the group's CIC, minimum independent directors and chief risk officers for CICs with assets above ₹5,000 crore. RBI's 2023 IT governance direction excludes CICs, so cyber oversight should sit within group risk governance.

Q15. What do CERT-In's Directions require of each group company?

Service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them, keep ICT logs for 180 days in India and synchronise clocks. Each affected group company has these duties, so group escalation must be faster.

Q16. Does the DPDP Act allow us to share personal data freely within the group?

No. The DPDP Act does not create a general intra-group exemption. Each company deciding why and how data is processed is a data fiduciary and needs a lawful basis, notice and safeguards for sharing, with processor contracts for shared services. Most obligations apply from May 2027.

Audience: Corporate development, deal partners, operating partners and portfolio teams

Q17. What does cyber due diligence cover?

External exposure and leaked credentials, identity and privileged access, cloud and network architecture, signs of existing compromise, backups and recovery, data stores holding personal data, past incidents and disclosures, regulatory obligations, key suppliers and the security team's capacity, matched to the deal's size and timetable.

Q18. When should cyber diligence happen in a deal?

Start before signing, so findings can shape price, warranties, indemnities and conditions; run a compromise assessment before closing where access allows; and keep the target separate from group systems until it passes an integration security gate, with monitoring from Day 1.

Q19. What lessons do Marriott and Yahoo hold for acquirers?

Marriott bought Starwood in 2016 with attackers already in Starwood's systems since 2014, and the breach and fine followed later. Verizon cut its Yahoo price by US$350 million after breach disclosures. Both show that unknown cyber liabilities transfer with the business.

Q20. How can we test a target without breaching confidentiality or law?

Agree scope and rules with the target in writing, use non-intrusive external reviews before access is granted, run deeper testing only with the target's consent, protect findings under the deal's confidentiality terms and avoid any testing of systems the target has not authorised.

Q21. How should we integrate an acquired company safely?

Connect it in stages behind a security gate: reset privileged credentials, deploy endpoint detection and logging, assess for compromise, fix critical findings, then add directory trusts and network links only where needed. Keep the ability to disconnect it quickly for the first months.

Q22. How should a PE or VC fund manage portfolio cyber risk?

Set a baseline at entry, score each investee annually against the same framework, require MFA, tested backups, monitoring and an incident plan, track remediation at Board level, offer shared services such as a portfolio SOC and prepare exit-ready evidence well before sale.

Q23. What should be done before an exit or carve-out?

Review the business against what buyers will test, fix high-risk findings, assemble an evidence pack, plan the separation of identity, email, data and shared systems, remove the seller's lingering access after transitional services end and agree how shared data will be split.

Q24. How does Codec Networks support deals and portfolios?

Codec Networks provides discreet pre-signing diligence, compromise assessments, inputs to warranties and indemnities, integration security gates, portfolio baselines and benchmarking, investee testing, portfolio SOC and exit readiness reviews, all timed to the deal and investment calendar.

Audience: Group CIO and CISO, shared-services, IT operations and outsourcing teams

Q25. Why is a shared directory such a risk?

Because one privileged account, trust relationship or synchronisation service can reach every company that uses it. Attackers who compromise a weak subsidiary often aim straight for directory administration, and from there for ERP, email and backups across the group.

Q26. How should administration be structured across entities?

Separate tiers so that group-wide administrators use dedicated accounts and devices with MFA and privileged access management, limit who can administer more than one entity, remove standing access in favour of just-in-time elevation and review trusts and service accounts regularly.

Q27. How should IT outsourcers and MSPs be controlled?

Give each engineer a named account with MFA and least privilege, broker access through privileged access management, log and review sessions, limit access by entity and time, write security and notification clauses into contracts and assess critical providers each year.

Q28. How do we stop one company's incident spreading to others?

Segment networks between entities, restrict east-west traffic and management protocols, keep backups isolated and tested per entity, monitor cross-entity logins centrally and prepare playbooks that let the SOC isolate one company within hours without stopping the rest.

Q29. How should a shared-services centre protect many companies' data?

Segregate data and access by entity, give staff only the rights each process needs, minimise and mask personal data in shared HR and payroll systems, alert on bulk exports and unusual hours, and treat the centre as a data processor under DPDP contracts.

Q30. How should cloud tenants and SaaS across the group be governed?

Keep an inventory of every tenant and critical SaaS application, enforce central identity with MFA, apply baseline configurations, monitor for open storage and risky integrations, and require new tenants to be registered before they are used for business data.

Q31. What should we do about OT in industrial group companies?

Assess OT networks against IEC 62443, separate them from group IT, control remote access by vendors, keep offline recovery plans for production systems and include OT in CERT-In's risk-based audits where applicable, since production outages ripple through suppliers and customers.

Q32. How does Codec Networks assess group IT?

Codec Networks reviews directories, trusts, privileged access, segmentation, cloud tenants, outsourcer access and shared-services controls, runs red team exercises from a subsidiary foothold in agreed conditions and maps findings to the group standard and regulatory expectations.

Audience: Treasury, family office, privacy, security operations and incident response teams

Q33. How do we protect treasury from deepfake and email fraud?

Require call-backs to independently known numbers for new payees and urgent transfers, two independent approvers above a threshold, cooling periods for bank detail changes and confidential-deal procedures that never bypass controls, and rehearse deepfake requests with the people who approve payments.

Q34. What are the particular risks for family offices?

Principals are public figures whose voices and faces are easy to clone, staff act quickly on their instructions, and the office holds banking access and sensitive family data, often on personal devices and home networks. Payment controls, device security, privacy reviews and awareness matter most.

Q35. How should Board papers and deal information be protected?

Use a managed Board portal with MFA and device controls, limit downloads and forwarding, keep the UPSI database accurate and tamper-resistant, vet data room permissions and audit logs, and verify advisers' instructions and bank details by independent channels.

Q36. How should cyber insurance be arranged for a group?

Map policy limits to realistic group scenarios, check whether limits are shared across entities, review exclusions, including war and state-backed attack clauses, confirm notification duties and preferred responders, and keep evidence of the controls insurers ask about.

Q37. What should a shared group SOC monitor?

Directory and privileged account activity, cross-entity logins, outsourcer sessions, email and payment anomalies, cloud configuration changes, endpoint alerts in every company, data exports from shared services, OT remote access and relevant CERT-In advisories, with clear escalation to the group and each entity.

Q38. What should we do in the first hour of an incident at one subsidiary?

Isolate affected systems and, if needed, the subsidiary's links to the group, protect backups and directory administration, preserve logs, assess spread to shared systems, start CERT-In reporting within six hours, inform the Board and prepare stock exchange, lender and insurer notifications as applicable.

Q39. Should Boards and family principals take part in exercises?

Yes. Annual tabletops with directors, promoters, the group CFO, treasury, legal, communications and affected company leaders, using subsidiary ransomware, deepfake transfer, inherited breach and data leak scenarios, test decisions on isolation, payment, disclosure and communication.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your group structure, shared services, deals, portfolio, payment flows, data and obligations; Codec Networks will propose a practical governance, testing and monitoring plan mapped to Board, investor, CERT-In, SEBI and DPDP expectations.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, regulatory, investment, transaction or insurance advice. Confirm obligations against the official instruments applicable to each entity, its listing status and registrations, the funds it manages and your contracts. Pre-acquisition testing is referred to only as authorised work with the target's consent and under agreed rules.