INDUSTRY FACT FILE · CONGLOMERATES, HOLDING COMPANIES & INVESTMENT GROUPS

Industry Overview: Conglomerates and Investment Groups in India

Who owns, governs, funds and serves India's business groups and investment firms, the shared systems they run, the rules that apply and why each segment needs its own security approach.

Much of Indian business is organised in groups. Diversified business groups run steel, power, consumer, financial, technology and infrastructure businesses through dozens or hundreds of companies, often held through a listed parent, an unlisted holding company or a core investment company registered with RBI. Promoter families increasingly manage their wealth through family offices, and private capital has become a permanent part of the ownership landscape: Bain & Company's India Private Equity Report 2026 put private equity and venture capital investment in India at about US$36 billion across some 1,700 deals in 2025, with exits of about US$34 billion. Each of these owners sits on top of a portfolio of companies that share brands, capital, people and, very often, technology. Group IT teams run a common directory, email and collaboration platform, ERP and treasury systems, and shared-services centres process finance, payroll and HR for many entities at once. That sharing is efficient, and it is also how a weakness in one company becomes an incident for all of them.

Group-wide incidents have shown how quickly this happens. When NotPetya spread in June 2017, the shipping group Maersk reinstalled about 45,000 PCs and 4,000 servers and estimated its cost at US$250–300 million, while Mondelez claimed more than US$100 million of losses from affected servers and laptops and then spent four years in a dispute with its insurer over a war exclusion before a settlement in 2022. In September 2025 a cyber attack forced Jaguar Land Rover to halt production at its UK plants for several weeks; the UK government announced a loan guarantee of up to £1.5 billion to support the company's supply chain, and the UK Cyber Monitoring Centre classed the event as Category 3 and estimated its UK economic impact at about £1.9 billion, affecting more than 5,000 UK organisations. One operating company's outage became a problem for suppliers, dealers, lenders, insurers and government at once.

Transactions add their own exposure. Marriott completed its acquisition of Starwood in 2016; attackers had been in Starwood's guest reservation systems since 2014, the breach was discovered in 2018, about 339 million guest records were affected, and in October 2020 the UK Information Commissioner fined Marriott £18.4 million. In February 2017 Verizon cut its price for Yahoo's operating business by US$350 million after Yahoo disclosed two large breaches, and the parties agreed how breach liabilities would be shared. Deal teams, family offices and treasury desks are also prime targets for impersonation: in 2024 the engineering firm Arup confirmed that an employee in Hong Kong had transferred about US$25 million after a video call in which the senior colleagues were deepfakes, and the FBI's Internet Crime Complaint Center recorded US$2.77 billion of business email compromise losses in 2024.

Indian law and regulation put this risk squarely in front of Boards. The Companies Act 2013 requires the Board's report to include a statement on the development and implementation of a risk management policy, asks audit committees to evaluate risk management systems and expects independent directors to satisfy themselves that those systems are robust. SEBI's LODR Regulation 21 requires the top 1,000 listed entities to have a risk management committee whose role specifically covers cyber security, and Regulation 27(2)(ba) requires cyber incidents to be disclosed in the quarterly corporate governance report. RBI's 2020 revision of the core investment company framework introduced a group risk management committee and chief risk officers for larger CICs; SEBI's Cybersecurity and Cyber Resilience Framework of August 2024 extends to AIF and portfolio managers; the SEBI insider trading regulations require tamper-resistant records of who holds price-sensitive deal information; and CERT-In's Directions require incidents to be reported within six hours. IBM's 2025 study put the average cost of a data breach in India at ₹22 crore, and the DPDP Act will govern personal data shared across group companies, with most DPDP Rules obligations applying from May 2027.

Figure 1: India's conglomerate, holding company and investment group ecosystem.

• The Ministry of Corporate Affairs administers the Companies Act 2013 and Board, audit committee and disclosure duties, while SEBI and the stock exchanges regulate listed entities, insider trading, AIFs, portfolio managers and the CSCRF.
• RBI registers and regulates core investment companies and the NBFCs, banks and payment businesses inside many groups, and sector regulators such as IRDAI, PFRDA, TRAI and CERC oversee group companies in their sectors.
• CERT-In receives incident reports and issues advisories and audit guidelines; NCIIPC protects notified critical information infrastructure in group companies in power, banking, telecom, transport and other critical sectors; MeitY frames IT and data policy, and the Data Protection Board enforces the DPDP Act.
• Promoters, holding companies, CICs, family offices and fund managers set strategy and capital allocation; Boards, audit and risk management committees and independent directors oversee risk; limited partners and lenders expect evidence.
• Group and portfolio companies, acquisition platforms and shared-services centres run the operations, and customers, suppliers, dealers and employees depend on them.
• Investment bankers, law firms, accountants, virtual data room providers, IT outsourcers, managed service providers and cyber insurers sit inside almost every deal and shared service, and their weaknesses become the group's incidents.

Codec Networks is a CERT-In empanelled information security auditing organisation, empanelled with NICSI for application audit and compliance services (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For groups and investment firms we design group cyber standards and governance models that set roles for the holding company and each subsidiary; score the maturity of every group and portfolio company against one baseline; review shared directories, trust relationships, privileged access and cloud tenants; carry out cyber due diligence before signing and compromise assessments before closing, with inputs to warranties, indemnities and Day-1 and 100-day integration plans; test data rooms, deal team devices and treasury and payment approval controls; run deepfake and business email compromise simulations for treasury, family office and deal teams; assess shared-services centres, IT outsourcers and managed service providers; carry out CERT-In empanelled audits and reviews against SEBI's CSCRF for fund and portfolio managers; build DPDP programmes for personal data shared across group companies; operate a shared 24x7 SOC across holding company, group and portfolio companies; review cyber insurance limits and conditions; prepare Board and risk committee dashboards and crisis exercises; and provide incident response and forensics for ransomware, payment fraud and inherited breaches. Pre-acquisition testing is carried out only with the target's consent and under agreed rules. Each proposal confirms auditor eligibility and independence against CERT-In's and the client's requirements. Codec Networks does not provide legal, investment, valuation or insurance advice.

Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, regulatory, investment, tax, transaction or insurance advice. Obligations differ by entity (diversified group company, listed or unlisted holding company, core investment company, family office, alternative investment fund or portfolio manager, portfolio company or shared-services centre), by listing status, registrations and regulatory category, by fund documents, transaction agreements, lender covenants and insurance policies, and by the data each entity handles; confirm them against the official MCA, SEBI, stock exchange, RBI, CERT-In, NCIIPC, MeitY and Data Protection Board instruments and your agreements. Pre-acquisition testing is described only as authorised work with the consent of the target and in agreed conditions. Incident references are summarised from official statements, regulator decisions and widely reported events, and no inference is drawn about the governance of any named organisation or its owners.