Resources Categories
INDUSTRY FACT FILE · CONGLOMERATES, HOLDING COMPANIES & INVESTMENT GROUPS
Applicable Cybersecurity Services and Codec Networks Bundles for Groups
How Codec Networks services and bundled service models help groups and investment firms resolve their threats and meet Board, investor, lender, insurer, SEBI, RBI, CERT-In and DPDP expectations.
|
In this document 1. Our approach 2. Mapping threats to services 3. Codec Networks service catalogue for the sector 4. Codec Networks bundles for the sector 5. Sector programmes built from the bundles 6. Packages: Foundation, Assurance and Continuous Resilience 7. Regulatory requirement-to-bundle mapping 8. Threat-to-bundle coverage matrix 9. Delivery methodology and deliverables 10. Why Codec Networks 11. Annex: indicative commercial ranges |
1. Our approach
Groups and investment firms need security that works across entities and stands up to Boards, investors and regulators. Codec Networks works on four principles:
- One standard, many entities: every engagement starts from a group cyber standard and a common baseline, so the holding company, each subsidiary and each investee can be measured and compared.
- Follow the links: we trace how identity, networks, ERP, treasury, shared services, outsourcers and deals connect companies, because that is how incidents spread.
- Respect the deal and the target: pre-acquisition work is discreet, done only with the target's consent and under agreed rules, and timed to signing and closing.
- Prove it to the Board: findings mapped to the Companies Act, SEBI's LODR, PIT Regulations and CSCRF, RBI's CIC directions, CERT-In's Directions and audit guidelines, the DPDP Act and your deal documents and insurance policies.
2. Mapping threats to services
The table maps the 18 threats identified in Document 4 of this set to the Codec Networks services that help mitigate them.
|
Threat / challenge |
Applicable Codec Networks services |
Intended outcome |
|
Uneven cyber maturity across group entities |
Group cyber standard, maturity scoring of every entity, remediation roadmaps |
Every entity measured against one baseline |
|
Shared identity and directory compromise |
Directory, SSO and trust review, tiered administration, PAM design |
No single account that unlocks the group |
|
Group-wide malware through shared networks |
Segmentation and isolation review, red team from a subsidiary foothold |
Companies that can be isolated in hours |
|
Subsidiary ransomware that disrupts the group |
Ransomware readiness, EDR and backup testing per entity, IR retainer |
One company's incident stays contained |
|
Inherited breaches in acquired companies |
Cyber due diligence, compromise assessment before closing, Day-1 monitoring |
No intruder bought with the business |
|
Deal data, data room and UPSI leaks |
Data room and deal process review, UPSI database and access controls |
Deal information that stays confidential |
|
Deepfake executive and promoter impersonation |
Treasury control testing, deepfake simulations, call-back and dual approval design |
No transfer approved by a cloned voice |
|
Business email compromise in group payments |
Email security review, payment change verification, BEC simulations |
Payments that reach the right account |
|
Shared services centre and group ERP compromise |
Shared ERP and HR access review, segregation by entity, SOC use cases |
Shared services that do not share breaches |
|
Privileged access by IT outsourcers and MSPs |
Outsourcer and MSP access assessment, PAM, contract security clauses |
Vendor access that is named and watched |
|
Promoter, family and principal data exposure |
Family office privacy, device and account review, awareness for principals |
A family that is hard to target |
|
Portfolio company weaknesses that erode value |
Portfolio baselines, investee VAPT and cloud reviews, exit readiness |
Investees that hold their value |
|
Uncontrolled intra-group personal data sharing |
Group DPDP gap assessment, data maps, intra-group sharing rules |
Group data shared lawfully and safely |
|
Cloud and SaaS sprawl across entities |
Cloud tenant and SaaS posture assessments, shadow IT discovery |
Every tenant known and configured |
|
Integration, carve-out and separation gaps |
Integration security gates, carve-out access removal and data separation |
Clean connections and clean exits |
|
Cyber insurance gaps and group aggregation |
Cyber insurance limit, exclusion and aggregation review, control evidence |
Cover that matches group scenarios |
|
Weak Board visibility of group cyber risk |
Board and risk committee dashboards, escalation and disclosure playbooks |
A Board that sees the whole group |
|
Weak logs, monitoring and 6-hour reporting |
Log architecture review, shared managed SOC, group IR retainer |
Provable timelines, on-time reporting |
3. Codec Networks service catalogue for the sector
|
Service line |
Sector-relevant services |
|
Security Vulnerability Assessment & Penetration Testing |
Group and subsidiary networks, external attack surface of every entity, acquisition targets with consent, red teaming from a subsidiary foothold to group systems |
|
Group cyber governance & maturity |
Group cyber standard and policies, roles for holdco and subsidiaries, maturity scoring and benchmarking, cyber risk appetite and registers |
|
M&A and investment cyber due diligence |
Pre-signing diligence, external exposure and leaked credential reviews, compromise assessments, warranty and indemnity inputs, integration and separation plans |
|
Identity, cloud & zero trust |
Shared directories, SSO and trusts, tiered administration, privileged access management, cloud tenants and SaaS posture, segmentation and isolation |
|
Application & deal platform security |
Data rooms, Board and investor portals, treasury and banking integrations, group portals and APIs |
|
Supply chain & third-party risk |
IT outsourcers, MSPs, shared-services providers, advisers, data room providers and critical suppliers of group companies |
|
Information security audit & compliance |
CERT-In empanelled audits, SEBI CSCRF reviews for AIF and portfolio managers, support for LODR risk committee reporting and lender and LP questionnaires |
|
Data privacy & protection |
Group DPDP programmes, data maps across entities, intra-group sharing rules, shared-services and family office data, breach workflows |
|
Treasury, fraud & impersonation resilience |
Payment approval and call-back controls, deepfake and BEC simulations, banking portal reviews, awareness for principals and staff |
|
24/7 Managed SOC & incident response |
Shared SOC across holdco, group and portfolio companies, cross-entity detection, ransomware, fraud and inherited breach response, CERT-In and disclosure support |
4. Codec Networks bundles for the sector
Eleven of the twelve bundles in the Codec Networks Bundled Service Models apply directly to diversified business groups, holding companies, core investment companies, family offices, PE and VC firms, their portfolio companies and shared-services centres; the Global Cyber Back-Office SPV Program (Bundle 12) is offered separately for international clients.
Figure 6: Codec Networks bundles applied to the sector.
|
Bundle |
Name |
Sector-relevant scope |
Best suited for |
Key deliverables |
|
B1 |
Cyber Assessment & VAPT Assurance Program |
Group, subsidiary and portfolio company VAPT; acquisition targets with consent |
Diversified groups, PE funds, acquisition platforms |
Assessment reports, retests and closure tracker |
|
B2 |
Application, API & DevSecOps Security Program |
Data rooms, Board and investor portals, treasury and group APIs |
Holdcos, funds, family offices |
Test reports, fix verification, secure SDLC findings |
|
B3 |
Cloud, Infrastructure & Zero Trust Security Program |
Shared directories, trusts, PAM, cloud tenants and segmentation |
Groups with consolidated IT, shared services |
Architecture review and remediation roadmap |
|
B4 |
Regulatory Cybersecurity Audit & Compliance Assurance Program |
CERT-In empanelled audits and SEBI CSCRF reviews |
Listed group companies, AIF and portfolio managers |
Audit report, gap matrix, evidence tracker |
|
B5 |
GRC, ISO, SOC 2 & Cyber Maturity Program |
Group cyber standard, maturity scoring, ISO/IEC 27001 and Board metrics |
Holdcos, CICs, funds and their companies |
Maturity scorecard, policies, Board dashboard |
|
B6 |
Data Privacy, DPDPA & Data Protection Program |
Group DPDP programme, intra-group data sharing, shared services data |
Groups, shared services, family offices |
Privacy gap assessment, data map, roadmap |
|
B7 |
Managed SOC, MDR & Continuous Threat Monitoring Program |
Shared 24x7 SOC across holdco, group and portfolio companies |
Groups and funds with many entities |
SOC reports, MTTD/MTTR, incident records |
|
B8 |
Digital Forensics, Incident Response & Malware RCA Program |
Ransomware, payment fraud and inherited breach response, compromise assessments |
Any entity facing a compromise or a deal |
Forensic report, RCA, reporting support |
|
B9 |
Third-Party Risk Management & Supply Chain Cyber Risk Program |
Outsourcer, MSP, adviser and critical supplier assurance |
Groups, shared services, funds |
Vendor risk register and assessment reports |
|
B10 |
Cyber Simulation, Awareness, Tabletop & Crisis Readiness Program |
Group crisis, deepfake treasury and Board tabletop exercises |
Boards, risk committees, treasury, family offices |
Exercise reports and playbooks |
|
B11 |
Emerging Technology, AI, Web3 & Future Security Program |
AI and deepfake risk, emerging technology in group and portfolio companies |
Groups and funds adopting AI |
Risk review, readiness roadmap, findings |
5. Sector programmes built from the bundles
Codec Networks packages the catalogue bundles into six group and investment programmes.
|
Programme |
Built from bundles |
Challenges addressed |
|
Group Cyber Governance |
B5, B4, B10 |
One standard, maturity scoring, roles, Board and risk committee reporting |
|
Deal Cyber Diligence |
B1, B8, B9 |
Pre-signing diligence, compromise assessment, warranties, integration gates |
|
Shared SOC for the Group |
B7, B3, B8 |
Cross-entity monitoring, isolation, CERT-In reporting and response |
|
Portfolio Cyber Assessment |
B5, B1, B3 |
Baselines, benchmarking, investee testing and exit readiness |
|
Treasury and Payment Integrity |
B10, B2, B7 |
Deepfake and BEC resilience, approvals, banking portals and monitoring |
|
Group Data Protection |
B6, B9, B3 |
Intra-group sharing, shared services, outsourcers and DPDP readiness |
6. Packages: Foundation, Assurance and Continuous Resilience
|
Package element |
Foundation |
Assurance |
Continuous Resilience |
|
Typical organisation |
Family offices and VC funds |
PE funds and acquisition platforms |
Diversified groups and holdcos |
|
Testing |
B1: external exposure and email review |
B1 + B8: due diligence and compromise assessment |
B1 + B3: group red team from a subsidiary foothold |
|
Audit and GRC |
B5: payment and access policies |
B4 + B5: CSCRF review, portfolio maturity scoring |
B4 + B5: CERT-In audits, group standard and scoring |
|
Architecture and privacy |
B6: family and office data review |
B3 + B6: investee cloud reviews, DPDP for deals |
B3 + B6 + B9: directory, PAM, outsourcers, group DPDP |
|
Monitoring and response |
IR retainer (B8) + B10 simulations |
B7: portfolio SOC + B8 |
B7: shared group SOC + B8 retainer |
|
Reporting |
Principal and investment committee reporting |
LP, buyer and lender-ready reporting |
Board, risk committee and regulator-ready reporting |
7. Regulatory requirement-to-bundle mapping
|
Requirement (source) |
How Codec Networks helps |
Bundle |
|
Statement on development and implementation of a risk management policy (Companies Act 2013, Section 134(3)(n)) |
Group cyber risk assessment and Board reporting |
B5, B4 |
|
Risk management committee role covering cyber security (SEBI LODR Regulation 21) |
Risk committee dashboards, maturity scoring, exercises |
B5, B10 |
|
Disclosure of cyber incidents in quarterly governance reports (SEBI LODR Regulation 27(2)(ba)) |
Incident records, SOC evidence and disclosure playbooks |
B7, B8 |
|
Structured digital database and controls for UPSI (SEBI PIT Regulations 2015) |
Deal data, database and access control review |
B2, B3 |
|
Cyber security and resilience for AIF and portfolio managers (SEBI CSCRF, 2024) |
CSCRF gap assessment and audit support |
B4, B5 |
|
Group risk management committee and CRO for larger CICs (RBI CIC directions, 2020) |
Group risk reporting and independent cyber reviews |
B5, B4 |
|
Cyber incidents to CERT-In within six hours; 180-day logs in India (CERT-In Directions, 2022) |
Shared managed SOC, log architecture, IR retainer and reporting support |
B7, B8 |
|
Reasonable security safeguards and breach intimation for personal data (DPDP Act 2023 and Rules 2025) |
Group DPDP programme and intra-group sharing rules |
B6, B8 |
|
Auditor eligibility and independence Where a regulator, Board, lender, LP, buyer or CERT-In's audit guidelines call for independent or CERT-In empanelled auditors, Codec Networks—CERT-In empanelled for information security auditing services and empanelled with NICSI for application audit and compliance services (start-up category)—confirms eligibility and independence in each proposal and does not audit systems it has designed or operates. Codec Networks does not provide legal, investment, valuation or insurance advice, and pre-acquisition testing is performed only with the target's consent and under agreed rules. |
8. Threat-to-bundle coverage matrix
|
Threat / challenge |
Primary bundle |
Supporting bundles |
|
Uneven cyber maturity across group entities |
B5 |
B1, B4 |
|
Shared identity and directory compromise |
B3 |
B1, B7 |
|
Group-wide malware through shared networks |
B3 |
B1, B7 |
|
Subsidiary ransomware that disrupts the group |
B8 |
B3, B7, B10 |
|
Inherited breaches in acquired companies |
B8 |
B1, B9 |
|
Deal data, data room and UPSI leaks |
B2 |
B3, B6 |
|
Deepfake executive and promoter impersonation |
B10 |
B7, B8 |
|
Business email compromise in group payments |
B10 |
B7, B8 |
|
Shared services centre and group ERP compromise |
B3 |
B2, B7 |
|
Privileged access by IT outsourcers and MSPs |
B9 |
B3, B7 |
|
Promoter, family and principal data exposure |
B6 |
B10, B3 |
|
Portfolio company weaknesses that erode value |
B5 |
B1, B7 |
|
Uncontrolled intra-group personal data sharing |
B6 |
B9, B3 |
|
Cloud and SaaS sprawl across entities |
B3 |
B1, B7 |
|
Integration, carve-out and separation gaps |
B3 |
B8, B9 |
|
Cyber insurance gaps and group aggregation |
B5 |
B10, B4 |
|
Weak Board visibility of group cyber risk |
B5 |
B10, B4 |
|
Weak logs, monitoring and 6-hour reporting |
B7 |
B4, B8 |
“Primary” and “supporting” indicate suggested combinations, not guaranteed mitigation or complete coverage.
9. Delivery methodology and deliverables
Figure 7: The Codec Networks delivery methodology.
Typical deliverables include a group cyber standard and policy set with roles for the holding company and each subsidiary, maturity scorecards benchmarking every group and portfolio company, directory, SSO, trust and privileged access review reports with tiered administration designs, segmentation and isolation plans, group red team reports, cyber due diligence reports with inputs to warranties and indemnities, compromise assessment reports before closing, integration security gate checklists and Day-1 and 100-day plans, data room and UPSI database reviews, treasury and payment approval control test reports, deepfake and business email compromise simulation results, outsourcer and MSP assessments, cloud tenant and SaaS posture reports, CERT-In empanelled audit reports and SEBI CSCRF gap assessments, a group DPDP gap assessment with intra-group sharing rules, Board and risk committee dashboards, cyber insurance limit and aggregation reviews, shared SOC reports, forensic and root cause reports with CERT-In and disclosure support, and exercise reports.
10. Why Codec Networks
- CERT-In empanelled for information security auditing services, and empanelled with NICSI for application audit and compliance services (start-up category).
- Certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
- Full stack: VAPT, regulatory audit, managed SOC, forensics, privacy and Board advisory from one partner, so findings, monitoring and closure stay connected.
- Group and investment depth: group cyber standards and maturity scoring, cyber due diligence and compromise assessments, shared directory and privileged access reviews, treasury and deepfake resilience testing, portfolio assessments and shared SOC operations, combined with CERT-In empanelled audits, SEBI's LODR and CSCRF, RBI's CIC directions and the DPDP Act.
- Recognised frameworks and tools: OWASP ASVS/MASVS and API Top 10, MITRE ATT&CK, NIST CSF, ISO 27001 and PCI DSS; tools such as Burp Suite, Nessus, Metasploit, Prowler and leading SIEM/EDR platforms.
- Certified people: CEH, OSCP, CPENT, CISA, ISO 27001 LA/LI, CHFI, CTIA and ECIH professionals.
Annex: Indicative commercial ranges
For internal sales reference only—remove this annex before sharing externally. Ranges are taken from the Codec Networks Bundled Service Models and are subject to scoping, asset counts, frequency and service levels.
|
Bundle |
Package examples and indicative ranges |
|
B1 VAPT Assurance |
Essential ₹1.5–5 lakh; Professional ₹5–15 lakh; Enterprise ₹15–40 lakh; Annual retainer ₹25 lakh–₹1.5 crore |
|
B2 AppSec & DevSecOps |
API Quick Check ₹2–6 lakh; AppSec Professional ₹8–20 lakh; DevSecOps Maturity ₹12–35 lakh; Secure SDLC retainer ₹3–15 lakh/month |
|
B3 Cloud & Zero Trust |
Cloud Essential ₹3–8 lakh; Professional ₹8–25 lakh; Enterprise ₹25–75 lakh; Continuous assurance ₹2–10 lakh/month |
|
B4 Regulatory Audit |
Gap review ₹5–15 lakh; Full regulatory audit ₹15–50 lakh; Multi-framework audit ₹30 lakh–₹1.25 crore; Annual retainer ₹3–20 lakh/month |
|
B5 GRC, ISO, SOC 2 |
ISO readiness ₹5–15 lakh; ISO implementation ₹15–45 lakh; SOC 2 readiness ₹15–60 lakh; GRC retainer ₹2–12 lakh/month |
|
B6 Privacy & DPDPA |
Quick assessment ₹3–10 lakh; Implementation ₹10–40 lakh; DPO-as-a-Service ₹2–8 lakh/month; Privacy retainer ₹3–15 lakh/month |
|
B7 Managed SOC |
Starter ₹2–5 lakh/month; Professional ₹5–15 lakh/month; Enterprise ₹15–50 lakh/month; co-managed per FTE/shift |
|
B8 Forensics & IR |
Triage ₹3–15 lakh; Full investigation ₹15–75 lakh; Ransomware response ₹25 lakh–₹1.5 crore; IR retainer ₹5–50 lakh/year |
|
B9 TPRM |
₹25,000–₹2 lakh per vendor; batch pricing for 50–500 vendors; retainer ₹3–25 lakh/month |
|
B10 Simulation & Tabletop |
Awareness ₹1–5 lakh; Phishing simulation ₹2–10 lakh; Tabletop ₹5–20 lakh; Cyber war-game ₹15–75 lakh; Annual retainer ₹10 lakh–₹1 crore/year |
|
B11 Emerging Tech |
AI/LLM risk review ₹5–25 lakh; Smart contract audit ₹5–50 lakh; Emerging tech retainer ₹5–25 lakh/month |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Service scope, deliverables, monitoring coverage and service levels are confirmed during engagement scoping. Services support risk reduction and assurance but do not guarantee prevention of all cyber incidents or regulatory compliance. Regulatory references are summaries; confirm against the official instruments applicable to each entity.