Modern SOC for Indian Enterprises: DPDP Act, CERT-In Reporting & What to Log

Most Indian security teams discover their logging gaps during an incident, not before one. By then the six-hour reporting clock has already started, and nobody can prove when the intrusion actually began. That is the real test of a modern SOC in India, not how many tools it runs, but whether it can produce a defensible timeline on demand.

This guide explains what the modern security operations center must do to satisfy CERT-In’s reporting directions and the DPDP regime, which log sources you need to retain, and the four gaps that most often cause Indian organisations to miss their deadlines.

See how CyberSIO helps strengthen your security posture: Schedule a Free Demo.

What a Modern SOC Means in India Today

A modern SOC is a security operations centre where detection, investigation and response are unified across identity, endpoint, network and cloud, with evidence retained in a form regulators accept.

Globally the conversation is about automation. In India, there is a second, harder requirement layered on top: provable compliance. A modern SOC here has to answer three questions within hours, not weeks, what happened, when it started, and whose personal data was touched.

The Two Clocks Your Modern SOC Now Runs On

1. CERT-In: Six Hours From Detection

Under the CERT-In Directions issued on 28 April 2022 under Section 70B of the IT Act, every organisation operating in India must report cybersecurity incidents to CERT-In within 6 hours of detection, with non-compliance carrying a fine of up to ₹1 lakh and imprisonment of up to one year. The directive applies to all body corporates, service providers, intermediaries, data centre operators and government organisations regardless of size, startups are not exempt. 

The directions also carry obligations beyond reporting. Organisations must retain ICT system logs for a rolling period of 180 days within Indian jurisdiction and maintain accurate time synchronisation across ICT systems using approved reference time sources. 

Six hours is not an investigation window. It is barely enough for detection, validation, escalation and submission, which is why a modern SOC treats initial reporting as a rehearsed workflow, not a decision. 

2. DPDP Act: Two Dates That Matter

The DPDP Rules 2025 were notified on 13 November 2025 and phase the Act in across three dates: definitions and the Data Protection Board from 13 November 2025, enforcement powers and penalties from 13 November 2026, and substantive obligations, notice, consent, data principal rights, retention, transfers and breach obligations, in full from 13 May 2027. Penalties reach ₹250 crore for a single instance of failing to take reasonable security safeguards, and the Board can adjudicate, demand remediation and restrict cross-border transfers. 

Key takeaway: 2026 is your build year. From November 2026 the Board can levy penalties, long before the May 2027 full-compliance date. 

Crucially, “reasonable security safeguards” is not a paperwork exercise. It is demonstrated through what your SOC detects, logs and retains. 

Also read: SOC as a Service vs In-House SOC: Which Model Delivers Better ROI?

The Cost of a Slow SOC in 2026

The numbers make the business case without help. IBM’s 2026 Cost of a Data Breach Report found the average breach cost in India hit an all-time high of ₹25.5 crore, up 15.9% over the previous year’s ₹22 crore, with 39,500 records compromised on average and 26% of malicious breaches being AI-generated.  

Speed is where the money sits. Organisations with no AI and automation in security operations paid ₹31.6 crore per breach versus ₹21.3 crore for those using it extensively, and took 236 days to identify a breach compared with 175 days. Financial services recorded the highest average breach cost in India at ₹40.9 crore, followed by technology at ₹35.7 crore, while phishing was the most common initial attack vector at 19%, ahead of drive-by compromise at 16% and supply chain compromise at 15%. 

A 236-day detection gap against a 180-day log retention floor means the evidence is gone before the investigation starts. 

What Your Modern SOC Must Log

Retention alone is not enough. Logs must be searchable under pressure, time-aligned, and stored within Indian jurisdiction. 

Four Gaps That Break Indian SOCs

1. No single detection timestamp: If three tools disagree on when an event occurred, the six-hour clock is unverifiable. 
2. Cloud logs outside India: Default SaaS regions frequently violate the residency requirement. 
3. Missing identity context: Without identity telemetry you cannot map a breach to affected data principals, so DPDP notification becomes guesswork. 
4. Manual escalation chains: Approval loops built for 72-hour windows collapse at six hours. 

Also read: AI in Cybersecurity: 12 Emerging Trends Reshaping Security in 2026

How CyberSIO Helps Build a Modern SOC

Building a modern SOC is not just about adding more security tools. It is about bringing detection, investigation and response together with the visibility and automation needed to act quickly. 

CyberSIO helps organisations move toward this model by unifying SIEM, SOAR, UEBA and identity security on a single platform. This enables SOC teams to centralise security events, understand user and entity behaviour, investigate threats with greater context and automate response workflows. 

For Indian enterprises, this unified approach can help create a SOC that is better equipped to detect threats faster, investigate incidents effectively, respond consistently and maintain audit-ready security evidence as security and compliance requirements continue to evolve. 

With CyberSIO, organisations can take the next step from a traditional, fragmented SOC toward a modern, unified and automation-driven security operations centre. 

Must Read Articles:

• Understanding Identity Threat Detection and Response (ITDR)
• What Is Network Access Control (NAC)?
• Patch Management: Benefits, Challenges, and Best Practices for Modern IT Environments
• IAM: A Complete Guide to Identity and Access Management

Frequently Asked Questions About Modern SOC

Sources