Free tools / Compliance check
Ten yes-or-no questions about how you run your servers and handle personal data. Your answers stay in your browser unless you choose to send them. This is general guidance, not legal advice.
1.Do you keep server and access logs for at least 180 days?
Indian government cyber-security directions (CERT-In, 2022) ask organisations to keep logs of their IT systems for a rolling 180 days, stored within India.
2.Are your servers' clocks kept in sync with a reliable time source (NTP)?
Correct timestamps make logs trustworthy. The same directions ask for clocks to be synchronised with the Indian government time servers.
3.Does someone know how to report a cyber incident to CERT-In within 6 hours of noticing it?
The 2022 directions require certain incidents to be reported within 6 hours.
4.Do you keep backups away from the server, and have you tested a restore?
A backup that lives on the same server is lost with it, and an untested backup is only a hope.
5.Do you install security updates within a fixed time (for example critical ones within a week)?
Most hacks use weaknesses that already have a fix.
6.Does every person have their own server login (SSH keys, no shared passwords), and are leavers removed?
Shared credentials mean nobody can tell who did what, and old accounts are a common way in.
7.Is HTTPS forced on every page, and is the admin area protected by a second step (2FA) or IP limits?
Logins and personal data must not travel unencrypted, and admin areas are attacked constantly.
8.Do you know where customers' personal data is stored (which servers, which vendors, which countries)?
You cannot protect, or delete, data you cannot locate. India's Digital Personal Data Protection Act, 2023 makes you responsible for the personal data you handle.
9.Do you have a written plan for a data breach, including who to tell and how?
The DPDP Act expects organisations to be able to notify the regulator and the people affected when the law requires it.
10.Do you have a privacy notice that tells people what personal data you use and why, and do you ask for consent where needed?
Clear notice and consent are at the heart of the DPDP Act.