Direct answers on AWS, Microsoft Azure, Google Cloud, migration, SAP, security, disaster recovery, FinOps, data and generative AI, written for Indian CIOs, CTOs and IT teams. Every answer links to the page that covers it in depth.
Multi Cloud Strategy & Advisory should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Multi Cloud Strategy & Advisory when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Multi Cloud Strategy & Advisory should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Hybrid Cloud Architecture should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Hybrid Cloud Architecture when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Hybrid Cloud Architecture should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Multi Cloud Landing Zones should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Multi Cloud Landing Zones when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Multi Cloud Landing Zones should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Cloud Governance should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Cloud Governance when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Cloud Governance should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Cross Cloud Networking should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Cross Cloud Networking when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Cross Cloud Networking should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Identity & Access Governance should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Identity & Access Governance when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Identity & Access Governance should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Multi Cloud Security Operations should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Multi Cloud Security Operations when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Multi Cloud Security Operations should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Multi Cloud Backup & DR should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Multi Cloud Backup & DR when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Multi Cloud Backup & DR should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Multi Cloud Observability should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Multi Cloud Observability when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Multi Cloud Observability should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Multi Cloud FinOps should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Multi Cloud FinOps when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Multi Cloud FinOps should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Kubernetes & Container Platforms should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Kubernetes & Container Platforms when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Kubernetes & Container Platforms should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →Multi Cloud Data & AI should cover the business requirement, current-state assessment, target architecture, implementation dependencies, security, resilience, operating ownership and optimization. The exact scope depends on the workload rather than a fixed product bundle.
Read the full page →Consider Multi Cloud Data & AI when a defined limitation in scalability, operations, integration, recovery, security, data access or cost can be improved. Assessment should confirm the expected outcome before implementation.
Read the full page →Assess users, workload criticality, data, dependencies, performance, identity, network, availability, recovery, compliance needs, operating skills and expected economics before selecting the architecture.
Read the full page →Security for Multi Cloud Data & AI should address identity, least privilege, network controls, encryption, secrets, logging, configuration and incident response according to workload risk and data sensitivity.
Read the full page →Define business RPO and RTO first. Then determine which data, configuration and service components require backup, replication, rebuild automation or a separate recovery architecture, and test the recovery path.
Read the full page →Often yes. A phased approach can retain stable components while modernizing the parts that create the greatest operational or business constraint. The migration path should be chosen after dependency and compatibility assessment.
Read the full page →Define monitoring, alert ownership, incident response, backup oversight, capacity, security review, change control and recurring optimization before production go-live.
Read the full page →Track ownership and usage, then review sizing, scaling, storage, data transfer, retention, licensing or commitments relevant to the service. Cost optimization should not weaken required performance or recoverability.
Read the full page →AWS states Spot Instances can cost up to 90% less than On-Demand, though the real discount varies by instance type, Availability Zone and time. In our designs blended savings on Spot-eligible tiers typically land between 50% and 70% because we diversify across many instance types and keep an On-Demand base. Spot suits work that can tolerate a two-minute interruption notice.
Read the full page →For most Indian mid-size estates, Compute Savings Plans are the better default because the discount follows you if you change instance family, move to Graviton, shift Regions or move workloads to Fargate or Lambda. EC2 Instance Savings Plans give a deeper discount but lock you to one family in one Region. We usually commit only to the lowest sustained hourly usage and top up quarterly.
Read the full page →Yes. AWS Application Migration Service replicates on-premises servers block by block to EC2 and lets you run non-disruptive test launches before cutover. NTSPL usually rehosts first, right-sizes using two to four weeks of CloudWatch data, and only then introduces Auto Scaling, which requires the application to keep session state off the instance.
Read the full page →Asia Pacific (Mumbai), ap-south-1, has the widest range of instance families and Availability Zones and is the usual primary choice. Asia Pacific (Hyderabad), ap-south-2, gives a second in-country Region for disaster recovery, which helps organizations that want data processed within India under the DPDP Act 2023 or sector rules from regulators such as RBI. We verify instance family availability in Hyderabad before designing DR.
Read the full page →Scaling decisions happen within a minute or so of the metric breaching, but the real limit is how long a new instance takes to pass health checks. With golden AMIs and warm pools we typically bring web tiers to under 90 seconds. For spikes that arrive faster than that, such as a sale opening at a fixed time, we use scheduled actions and predictive scaling to add capacity in advance.
Read the full page →The risk is mostly in dependencies, not your own code. Interpreted and JVM languages typically run unchanged on arm64; native libraries, older agents and some commercial software may need arm64 builds. NTSPL runs a compatibility scan and a side-by-side canary behind the same load balancer, sending 5-10% of traffic to Graviton targets before committing.
Read the full page →Choose by three criteria. Runtime shape: requests that finish in under 15 minutes and arrive in bursts suit Lambda; long-running services suit EC2 or Fargate. Packaging: if the application is already containerized and the team does not want to patch operating systems, Fargate removes host management at a higher per-vCPU rate; if you need custom kernels, GPUs, Windows licensing, specific instance storage or the deepest Spot and Graviton discounts, EC2 wins. Utilization: at high, steady utilization EC2 with Savings Plans is usually the cheapest per unit of compute, while Lambda is cheapest when traffic is low or intermittent. Many NTSPL designs mix them: EC2 for the core application and batch solvers, Fargate for side services and Lambda for event glue.
Read the full page →S3 charges per GB stored each month, with the rate depending on storage class, plus per-request charges for reads and writes, retrieval charges for infrequent-access and Glacier classes, and data transfer out to the internet. Archive classes are far cheaper per GB but carry minimum storage durations and retrieval fees, so we model access patterns before moving data.
Read the full page →No. Intelligent-Tiering charges a small monthly monitoring fee per object and does not auto-tier objects smaller than 128 KB. For datasets whose access drops predictably with age, explicit lifecycle rules usually cost less. Intelligent-Tiering is best for large objects with unpredictable access, where it avoids retrieval charges and manual tuning.
Read the full page →For a few hundred terabytes over a stable 1 Gbps or faster link, AWS DataSync can move data in scheduled windows with checksum verification and incremental syncs before cutover. Where bandwidth is limited, a partner-led offline transfer seeds the bulk copy (AWS Snowball Edge is no longer offered to new customers). NTSPL typically seeds the bulk copy, runs incremental syncs for a week, then cuts users over in a short freeze.
Read the full page →Yes. S3 buckets, EBS volumes, EFS and FSx file systems stay in the Region you create them in, such as Asia Pacific (Mumbai) or Asia Pacific (Hyderabad), unless you configure replication elsewhere. This helps meet data residency expectations under the DPDP Act 2023 and sector guidance. CloudFront caches copies at edge locations, so for strictly in-country content we restrict the distribution's price class and geography accordingly.
Read the full page →Yes. CloudFront operates edge locations in several Indian metros, including Mumbai, Chennai, New Delhi, Hyderabad, Bengaluru and Kolkata, which shortens time-to-first-byte for users across the country. Viewers in smaller towns are served from the nearest metro edge. Origin Shield further reduces load on the origin bucket in Mumbai.
Read the full page →Enable S3 Versioning and S3 Object Lock in compliance mode, which prevents any user, including the root account, from deleting or overwriting an object version until its retention date. Combine it with AWS Backup Vault Lock for EBS, EFS and FSx backups. This is a strong defence against ransomware and insider deletion, but retention must be set carefully because it cannot be shortened.
Read the full page →Decide by access method first. If applications read and write whole files through an API or HTTP, choose S3: it is the cheapest per GB, scales without limit and tiers to archive automatically. If many Linux servers or containers need a shared POSIX file system, choose EFS, which grows and shrinks automatically. If users and Windows applications need SMB shares with Active Directory permissions, choose FSx for Windows File Server; for NetApp-style snapshots and replication, FSx for NetApp ONTAP; for high-throughput HPC scratch, FSx for Lustre. Then check cost: per GB, S3 is lowest, file systems cost more for the convenience of mounting. Many estates use S3 as the long-term store and a file system only for active working sets.
Read the full page →For 500 users asking about 10 questions a day with RAG context of about 5,000 tokens, model costs typically range from INR 1 to 6 lakh per month depending on model choice and routing, plus INR 30,000 to 1.5 lakh for the vector store, Guardrails and AgentCore. We publish a cost-per-answer figure during evaluation so the business case is based on measured usage.
Read the full page →No. Amazon Bedrock does not use your prompts and completions to train AWS or third-party base models, and does not share them with model providers. Your documents, knowledge base vectors and invocation logs stay in your AWS account, encrypted with your KMS keys. Fine-tuned custom models are private to your account.
Read the full page →Documents, knowledge bases, vector stores and logs can all stay in ap-south-1. Inference location depends on the model: some run on-demand in Mumbai, while others use cross-Region inference profiles that may process requests in other Asia Pacific Regions. For SEBI, RBI or IRDAI regulated workloads with strict residency, we select in-Region models or host an open-weight model on SageMaker AI in Mumbai.
Read the full page →Usually in four to six weeks. Prompts and orchestration code port with modest changes, documents are re-ingested into a Bedrock Knowledge Base, and existing embeddings are rebuilt because embedding models differ. The most valuable thing to carry over is your test questions; if the pilot had none, we build the golden set first and score both versions.
Read the full page →By making it cite and refuse. Answers must quote retrieved passages, Guardrails contextual grounding checks block responses not supported by those passages, and the prompt instructs the model to say when sources do not cover the question. We measure hallucination rate on the golden set before release and track thumbs-down answers weekly after launch.
Read the full page →Rarely for knowledge, often for format or classification. RAG is better for facts that change, because updating a document is instant while retraining is not. Fine-tuning on SageMaker AI or Bedrock helps when you need a consistent output style, domain terminology or a high-volume classification task where a small tuned model is cheaper and faster than prompting a large one.
Read the full page →Choose by how much you need to build and control. Amazon Quick, the successor to Amazon Q Business, fits a general internal assistant over common enterprise sources, live in weeks with little code, but with limited control over retrieval logic, evaluation and custom workflows. Amazon Bedrock fits custom applications: domain assistants, drafting tools and agents where you control prompts, retrieval, Guardrails and tools, paying per token with no infrastructure. SageMaker AI fits when you need to train or fine-tune your own models, host open-weight models on dedicated instances for residency or cost at very high volume, or build classical ML such as classifiers and forecasts. Most NTSPL deployments combine Bedrock for the language layer with SageMaker AI for a specialised model behind one of the agent's tools.
Read the full page →For a mid-size landscape with a 1 to 1.5 TB production HANA, Pacemaker HA, three non-production systems and Hyderabad DR, infrastructure typically lands between INR 12 and 25 lakh per month with three-year commitments on production and scheduled non-production. SAP licences are separate and unchanged. Our sizing workshop produces a five-year model comparing this with an appliance refresh.
Read the full page →It depends on your timeline and change appetite. If hardware is ending support soon, move ECC first, often onto HANA with a database migration, then convert to S/4HANA on AWS. If the S/4HANA programme is already funded, SUM DMO with system move combines the database migration, AWS move and conversion in one downtime window, avoiding two cutovers.
Read the full page →Yes. Production runs in ap-south-1 and DR in ap-south-2, so SAP data, backups and replicas remain in India. GST e-invoicing and e-way bill integrations call government IRP and GSP endpoints from AWS like from any data centre, usually through a NAT gateway with fixed Elastic IPs that you allowlist with your GSP.
Read the full page →Within Mumbai, a Pacemaker-managed HSR takeover between Availability Zones typically completes in a few minutes, depending on database size and whether column tables are preloaded on the secondary. A cross-Region DR takeover to Hyderabad, including application servers, is usually measured in tens of minutes to a couple of hours, and we establish the actual figure in a drill.
Read the full page →Yes. SAP certifies specific Amazon EC2 instance types for SAP HANA and SAP NetWeaver, listed in SAP's Certified and Supported SAP HANA Hardware Directory and related SAP Notes. Support requires certified instances, supported operating systems and the AWS data provider for SAP installed so SAP support can see infrastructure metrics.
Read the full page →Through the AWS Backint Agent, which is SAP-certified and streams HANA data and log backups directly to Amazon S3, with no backup servers or tape. Backups can also be orchestrated with AWS Backup via Systems Manager for SAP. We add S3 Object Lock, lifecycle rules and cross-Region replication to Hyderabad for ransomware resilience.
Read the full page →Compare control, contract model and five-year cost. RISE with SAP gives one SAP subscription covering software, hyperscaler infrastructure and technical operations; it suits firms wanting fewer vendors, but limits choice of instance sizes, maintenance windows, DR design and direct AWS integration. Customer-managed SAP on AWS retains your existing licences, gives full control of sizing, HA and DR, and lets SAP data feed your AWS data lake and AI services directly; it requires a strong Basis team or partner. An on-premises HANA refresh suits firms with recent data-centre investment and stable workloads, but buys peak capacity upfront and leaves DR testing on you. For most Indian mid-size manufacturers with an AWS footprint, NTSPL finds customer-managed SAP on AWS the best balance of control and cost.
Read the full page →Both charge per instance hour and per GB of storage. Aurora Standard also charges per million I/O requests, while Aurora I/O-Optimized has no I/O charge but higher instance and storage rates. RDS charges for provisioned storage and, on io1 or io2, provisioned IOPS. We compare a month of real CloudWatch metrics across options before recommending one.
Read the full page →Yes. AWS DMS performs a full load while the source stays live, then replicates ongoing changes through change data capture, so the target stays seconds behind. Cutover is a short, rehearsed freeze to drain changes and switch connections, usually 30-60 minutes. Schema and PL/SQL conversion is the longer effort and is done and tested before data moves.
Read the full page →Yes, but their work changes. AWS handles hardware, OS and engine patching, backups and failover mechanics. Your DBAs or NTSPL's managed service still own schema design, query tuning, index strategy, capacity planning and access reviews. Performance Insights makes that tuning faster because top SQL and wait events are visible without extra tooling.
Read the full page →Yes, regulated entities can use cloud services provided they meet RBI's directions on IT outsourcing and IT governance, including due diligence, data access for the regulator and audit rights. Hosting Aurora or RDS in Asia Pacific (Mumbai) with backups in Asia Pacific (Hyderabad) keeps data in India. NTSPL maps controls to these requirements, but your compliance team owns the final assessment.
Read the full page →Avoid DynamoDB when you cannot list your access patterns up front, when users need ad hoc reporting across many attributes, or when relationships between entities change often. Those needs suit Aurora or RDS. DynamoDB shines for keyed lookups, counters and session or inventory data with unpredictable spikes.
Read the full page →Aurora typically completes failover to a replica in well under a minute, often around 30 seconds, because replicas share the same storage volume and do not need to replay data. Application reconnection adds time unless you use RDS Proxy or failover-aware drivers. We measure end-to-end recovery in a forced failover test before go-live.
Read the full page →Use three criteria. Data model: if queries join many tables, change over time or need SQL reporting, choose a relational engine; if every query is a known key lookup at very high concurrency, choose DynamoDB. Availability and scale: Aurora gives faster failover, up to 15 replicas and auto-growing storage, so pick it for business-critical OLTP; RDS for PostgreSQL is cheaper and simpler for smaller or less critical databases and supports some extensions and versions Aurora may not. Cost shape: RDS is usually lower for small, steady databases; Aurora becomes competitive at scale, especially with I/O-Optimized for I/O-heavy workloads; DynamoDB on-demand is cheapest when traffic is spiky and unpredictable. Many estates run all three side by side.
Read the full page →Transit Gateway charges for each attachment per hour, such as each VPC, VPN or Direct Connect gateway attachment, plus a per-GB charge for data processed. Inter-Region peering also incurs data transfer charges. For estates with many VPCs it is usually simpler and cheaper to operate than a peering mesh, but heavy east-west traffic should be modelled first.
Read the full page →AWS Direct Connect has locations in India in several major cities, served by carriers and Direct Connect partners who can provide hosted connections from your premises. NTSPL checks current locations and partner options for each site, and for critical workloads designs connections at two separate locations so a single facility failure does not cut access.
Read the full page →We bring up AWS connectivity alongside the existing MPLS, advertise AWS routes over BGP and migrate sites in waves. Traffic preference is controlled with BGP attributes, so each site can be moved and rolled back quickly. MPLS is retired only after each wave has run through a month-end or peak period.
Read the full page →Not unless you route it out. VPCs, Transit Gateways and Direct Connect gateways you deploy in Asia Pacific (Mumbai) and Asia Pacific (Hyderabad) keep traffic between your sites and those Regions within the AWS network. This supports data localization expectations from SEBI and RBI and the DPDP Act 2023, but you must avoid inter-Region peering to Regions abroad for regulated data.
Read the full page →Yes. Large branch estates usually terminate on Transit Gateway either as individual Site-to-Site VPN connections or through an SD-WAN vendor's virtual appliances attached with Transit Gateway Connect, which uses GRE and BGP for higher throughput per attachment. The right option depends on the existing SD-WAN and the per-site bandwidth needed.
Read the full page →With Bidirectional Forwarding Detection enabled on Direct Connect and tuned BGP timers, failure detection takes well under a second to a few seconds, and traffic moves to the backup path shortly after. Without BFD, default BGP hold timers can take around 90 seconds. NTSPL measures failover in a live drill as part of handover.
Read the full page →Decide on four criteria. Throughput: a standard VPN tunnel tops out around 1.25 Gbps (up to 5 Gbps with Large Bandwidth Tunnels on Transit Gateway or Cloud WAN), while Direct Connect offers 1, 10, 100 and 400 Gbps dedicated ports, or smaller hosted capacities through partners. Consistency: VPN rides the internet, so latency and jitter vary; Direct Connect is a private path with predictable performance. Lead time: VPN is configured in an hour; Direct Connect takes days to weeks to provision through a partner and carrier. Cost: VPN is cheap per hour but egress is billed at internet rates; Direct Connect has port charges but lower data transfer rates, so it pays off at high volumes. Most Indian enterprises use Direct Connect for data centres and large plants and VPN for small sites and as backup.
Read the full page →EKS charges a fixed hourly fee per cluster for the control plane during standard support, and a higher hourly fee once a cluster's Kubernetes version enters extended support. You also pay for the EC2 instances or Fargate resources your pods use, plus EKS Auto Mode's management fee if you enable it. ECS has no cluster fee; you pay only for compute.
Read the full page →AWS has discontinued App Mesh. For ECS services, the recommended path is Amazon ECS Service Connect, which provides service discovery, load balancing, retries and metrics. For EKS or mixed ECS, EKS and Lambda estates, Amazon VPC Lattice is the AWS-managed option, and Istio or Linkerd remain choices when you need full mesh features and can operate them.
Read the full page →We containerize or reuse existing images, push them to ECR, convert manifests or Compose files to Helm charts or ECS task definitions, and externalize state to managed databases. Services move in waves behind weighted routing so each can be rolled back. From self-managed Kubernetes, most manifests port directly, with changes to storage classes, ingress and IAM integration.
Read the full page →Yes. Amazon ECS, EKS and Fargate are in scope of AWS's PCI DSS attestation, and running them in Asia Pacific (Mumbai) keeps payment data in India as RBI's payment data storage directive requires. You still own controls inside the workload, such as segmentation, image scanning, logging and key management, which NTSPL builds into the platform.
Read the full page →No. EKS Auto Mode includes Karpenter-based node provisioning managed by AWS, along with core add-ons and node patching. Self-managed Karpenter gives more control over NodePool settings and avoids the Auto Mode management fee, so teams with platform engineers often keep it while smaller teams prefer Auto Mode.
Read the full page →Each Kubernetes minor version on EKS gets 14 months of standard support, followed by 12 months of extended support at extra cost, after which clusters are upgraded automatically. With upstream releasing roughly three versions a year, plan an upgrade every four to six months. NTSPL runs these as rehearsed changes with deprecated-API checks and add-on upgrades.
Read the full page →Choose on four criteria. Ecosystem: if you depend on Helm charts, Kubernetes operators or CNCF tools, or need the same platform across clouds and data centres, EKS is the answer. Operational load: ECS has no control-plane versions to upgrade, fewer add-ons and no orchestration fee, so a small team runs it with far less effort. Integration: ECS integrates natively with AWS services and IAM with less configuration; EKS needs controllers for the same results. Scale and flexibility: EKS gives finer scheduling control, custom resources and Karpenter-based node optimization for large, varied estates. In practice, ECS on Fargate fits teams with a few dozen services and no Kubernetes skills, while EKS fits platform teams supporting many squads.
Read the full page →Lambda charges per request and per GB-second of compute, calculated from the memory you configure and the execution time rounded to the millisecond. Arm64 functions cost less per GB-second than x86. There is a monthly free tier for requests and compute. Provisioned concurrency, if enabled, adds an hourly charge whether or not it is used.
Read the full page →For most APIs, no. Cold starts typically add a few hundred milliseconds for Node.js or Python and can be longer for Java and .NET without optimization. They affect a small share of requests. Where a strict latency target applies, Lambda SnapStart for supported runtimes or provisioned concurrency remove most cold-start delay. We measure before paying for either.
Read the full page →Jobs under 15 minutes usually move to Lambda triggered by EventBridge Scheduler, with retries and DLQs. Longer jobs are split into steps in Step Functions or run as ECS tasks on Fargate launched by the scheduler. We first inventory cron entries, their inputs, outputs and failure handling, which are often undocumented.
Read the full page →Yes. Lambda, API Gateway, EventBridge, SQS, SNS and Step Functions are available in Asia Pacific (Mumbai), and most are in Asia Pacific (Hyderabad), so data can be processed within India. This supports DPDP Act 2023 obligations and IRDAI expectations for insurers. Government bodies should also check MeitY empanelment requirements for their cloud service provider and integrator.
Read the full page →With SQS as the source, the message returns to the queue after the visibility timeout and is retried until it reaches the configured maximum receive count, then moves to a dead-letter queue. NTSPL alarms on DLQ depth, records the error with the correlation ID and provides a redrive procedure so messages are reprocessed once the bug or downstream issue is fixed.
Read the full page →Use Step Functions whenever a process has more than a few steps, needs retries with different rules per step, waits for people or external systems, or must show where each case is. Chaining functions hides state in logs and doubles cost because functions wait on each other. Step Functions also integrates directly with many AWS services without any Lambda code.
Read the full page →Use three criteria. Consumption model: SQS is a queue, where each message is processed by one consumer, with back-pressure and retries, so use it to protect slow systems. SNS is publish-subscribe for immediate fan-out to many subscribers, including people via SMS and email. EventBridge is an event router, filtering business events by content to many targets, with schema registry, archive and replay. Throughput and latency: SNS and SQS handle very high throughput with low latency; EventBridge adds rich routing at somewhat higher latency. Coupling: EventBridge best decouples teams because producers do not know consumers. Most production designs combine them: EventBridge for routing, SQS per consumer for buffering, SNS for notifications.
Read the full page →For an estate of 15 to 25 accounts with moderate traffic, organization-wide GuardDuty, Security Hub and Inspector typically land between INR 60,000 and 2.5 lakh per month, and WAF between INR 15,000 and 80,000 per web ACL depending on request volume and Bot Control use. GuardDuty and Security Hub include 30-day free trials per account, which we use to measure real cost before committing.
Read the full page →Migrate in waves, humans first. We connect your IdP, create permission sets that mirror current access, and move teams one at a time while CloudTrail confirms each old access key goes unused for 14 days before deactivation. Machine access keys are replaced with IAM roles for EC2, ECS and Lambda, or IAM Roles Anywhere for on-premises servers. Keys are deactivated, not deleted, for a fortnight so rollback is one click.
Read the full page →It covers the technical safeguards part, not the whole Act. The DPDP Rules, notified in November 2025, expect reasonable security safeguards such as encryption, access control, logging for detecting unauthorized access, and the ability to investigate and report breaches. Customer managed KMS keys, Identity Center access reviews, CloudTrail with retained logs and GuardDuty detections give you evidence for those safeguards. Consent, notices and data principal rights still need application and process work.
Read the full page →AWS gives you the evidence; meeting six hours is a process outcome. CERT-In's April 2022 directions require reporting specified incidents within six hours of noticing them and keeping logs for 180 days within Indian jurisdiction. We store CloudTrail and VPC Flow Logs in a Mumbai log-archive bucket with Object Lock, alert on GuardDuty high-severity findings in near real time, and rehearse an evidence-gathering runbook so the report can be filed with facts.
Read the full page →Shield Standard is free and automatic, and it handles most common network and transport layer floods. Shield Advanced costs USD 3,000 per month per organization on a one-year commitment plus data transfer, and adds application-layer DDoS mitigation with WAF, the Shield Response Team, health-based detection and cost protection for scaling charges during an attack. It is worth it for revenue or reputation-critical public applications with a history of attacks.
Read the full page →Yes. We restrict workloads to ap-south-1 and ap-south-2 using a region-deny SCP, configure Security Hub aggregation and the CloudTrail log archive in Mumbai, and create KMS keys only in Indian regions. A few global services such as IAM, CloudFront and Route 53 have control planes outside India, which we document for auditors, but your log data and encrypted content stay in-country.
Read the full page →Start AWS-native if more than 80 percent of your cloud estate is AWS. GuardDuty, Security Hub, Inspector and Access Analyzer are enabled organization-wide in a day, bill by usage, keep findings and logs inside Indian regions, and need no agents for most detections. Choose a third-party CNAPP when you run material workloads on Azure or GCP too and need one risk graph across clouds, or when you need attack-path analysis and code-to-cloud tracing beyond what Security Hub's exposure findings provide. Cost model matters: CNAPPs usually license per workload or per resource with annual commitments, while AWS-native costs scale with API and log volume. Many Indian enterprises end up hybrid: AWS-native detection as the always-on baseline, with the CNAPP or SIEM consuming Security Hub findings.
Read the full page →For 30 platinum-tier servers with about 6 TB of total disk, Elastic Disaster Recovery typically costs INR 1.5 to 2.5 lakh per month, covering the per-server fee, staging EBS, snapshots and replication servers. Moving 20 of those servers to pilot light with AWS Backup often brings the total under INR 1 lakh per month. Drill costs are extra but small because recovery instances run only for hours.
Read the full page →Yes, and this is the most common starting point. Elastic Disaster Recovery replicates physical servers, VMware and Hyper-V VMs from your data centre to Mumbai or Hyderabad over the internet or Direct Connect. You need outbound TCP 443 and 1500 from source servers, and enough bandwidth for daily change rates; we measure change rate in week one to size the link.
Read the full page →For most regional disaster scenarios, yes. The two AWS Regions are over 600 km apart, on separate power grids and in different seismic and flood zones, and each has multiple Availability Zones. Using both keeps all copies inside India, which helps with DPDP Act obligations and sector regulators' data localization expectations, such as RBI's payment data storage rules.
Read the full page →Vault Lock in compliance mode does: once the grace period ends, nobody, including the root user, can delete recovery points or shorten retention. An attacker could still try to schedule deletion of the KMS key, which is why NTSPL keeps backup keys in a separate account and adds a logically air-gapped vault copy for supported resources.
Read the full page →Quarterly for platinum systems and at least annually for the rest. Elastic Disaster Recovery drills launch recovery instances in an isolated subnet in Hyderabad while replication continues, so production is not touched. We run application smoke tests, record timings and terminate the drill instances, usually within a four-hour window.
Read the full page →Immutable, tested backups shorten the time from incident to recovery and give you evidence for reports. CERT-In's six-hour reporting rule applies to ransomware, and the DPDP Act expects reasonable safeguards including the ability to restore personal data. Restore testing reports and drill results document that capability.
Read the full page →Decide by RTO, rebuild complexity and fixed cost. Elastic Disaster Recovery gives an RPO of seconds and an RTO typically in minutes to under an hour for servers, at a per-server hourly fee plus staging storage; use it for stateful legacy servers that are slow to rebuild. AWS Backup with cross-Region copy and pre-built infrastructure code gives an RPO of an hour to a day and an RTO of several hours, at storage-only cost; use it for cloud-native or less critical systems. A secondary data centre gives full control and works for OT systems that cannot leave the plant, but carries fixed hardware, power and licence costs whether you fail over or not. Most Indian mid-size enterprises we work with retire the DR data centre and run a mix of the first two.
Read the full page →In most estates, log ingestion is 60 to 80 percent of the CloudWatch bill, followed by custom metrics. Dropping health-check and debug logs, moving audit logs to Infrequent Access and setting retention typically cuts CloudWatch cost by 30 to 50 percent. For a mid-size estate spending INR 4 lakh a month on CloudWatch, that is often INR 1.2 to 2 lakh saved monthly.
Read the full page →Run both for one or two months. We map each Nagios check to a CloudWatch alarm, an Application Signals SLO or a deliberate deletion, deploy the CloudWatch agent through Systems Manager, and compare alert timelines during the overlap. Once CloudWatch catches every incident the old tool caught, with fewer false alarms, we decommission Nagios checks group by group.
Read the full page →Yes. Systems Manager hybrid activations register on-premises Windows and Linux servers as managed nodes, so the same patch policies, maintenance windows and compliance reports apply. Servers need outbound HTTPS to Systems Manager endpoints in Mumbai, either over the internet or through Direct Connect with VPC endpoints. Advanced-tier pricing applies to some hybrid features such as Session Manager on on-premises nodes.
Read the full page →CERT-In's April 2022 directions require logs of ICT systems to be maintained for 180 days within Indian jurisdiction. We set CloudWatch log groups and CloudTrail storage in ap-south-1 or ap-south-2 to at least 180 days for in-scope systems, and archive older logs to S3 if your sector regulator, such as RBI or SEBI, expects longer retention.
Read the full page →Rarely, after the first week. Engineers use the AWS CLI with the Session Manager plugin, which supports port forwarding and SSH tunnelling through Session Manager, so tools such as database clients still work. Access becomes faster for new joiners because nobody needs to distribute keys or manage bastion hosts, and every session is logged automatically.
Read the full page →AWS Config charges per configuration item recorded and per rule evaluation, plus conformance pack evaluations. For a 15-account estate with mostly stable infrastructure, NTSPL typically sees INR 25,000 to 80,000 a month. Cost spikes come from recording ephemeral resources continuously; periodic recording for those types keeps it in check while preserving audit history.
Read the full page →Choose by estate mix, team skills and cost model. CloudWatch with Application Signals is the default for AWS-centric estates: no agents to license, data stays in your account and Indian Regions, native integration with Systems Manager and Config, and pay-per-use pricing. Choose Datadog or New Relic when you run material multi-cloud or on-premises workloads and want one polished APM and log experience, accepting per-host and per-GB licence costs that often exceed CloudWatch at scale. Choose Prometheus with Amazon Managed Service for Prometheus and Grafana when your teams run Kubernetes heavily and already use PromQL. Many NTSPL clients mix them: Prometheus metrics for EKS, CloudWatch for AWS services and logs, and Grafana as the shared view.
Read the full page →For 5 to 20 TB of data, nightly Glue pipelines, Athena for analysts and Redshift Serverless for 50 to 100 dashboard users, monthly spend typically lands between INR 1.5 and 4 lakh, plus Quick Sight user or capacity pricing. The biggest variables are Redshift working hours and how well data is partitioned for Athena.
Read the full page →Usually in two tracks. First, replicate source systems into S3 with AWS DMS change data capture so the lake fills without touching the old warehouse. Then rebuild the highest-value marts in Iceberg and Redshift, validate numbers side by side for one or two reporting cycles, and retire SSIS jobs and cubes in waves. AWS Schema Conversion Tool helps translate stored procedures.
Read the full page →Yes. All lake buckets, Glue catalogue, Redshift and Athena run in ap-south-1, with a backup or replica in ap-south-2 if needed. The DPDP Act also expects purpose limitation and erasure, so NTSPL minimizes personal data in curated zones, tags it in Lake Formation, and uses Iceberg deletes to remove records when a data principal withdraws consent.
Read the full page →No. Serverless is cheaper for workloads with idle hours, such as dashboards used mainly during business hours. For a warehouse that runs heavy loads 18 to 24 hours a day, provisioned RA3 nodes with reserved pricing often cost less. We model both using one month of query history before deciding.
Read the full page →Batch pipelines from ERP and DMS typically refresh every one to four hours, and streaming pipelines through Kinesis or MSK with Firehose reach 5 to 15 minutes. Sub-minute freshness is possible with Managed Service for Apache Flink, but we recommend it only where someone acts on the data within that minute.
Read the full page →Yes, Amazon Quick Sight includes natural-language querying over curated datasets. It works well when datasets have clear field names, synonyms and defined measures, which is why we build a semantic layer first. It does not replace governed dashboards for statutory or board reporting, where exact definitions matter.
Read the full page →Decide by concurrency, query pattern and platform strategy. Athena suits ad hoc and moderate-volume SQL directly on S3, with no capacity to manage and cost proportional to data scanned; it slows down with many concurrent heavy joins. Redshift Serverless suits repeated BI workloads with dozens to hundreds of concurrent users and complex joins, billed on RPU-hours, with zero-ETL from Aurora and native AWS integration, and data stays in Mumbai under your KMS keys. Snowflake on AWS suits organizations that want one engine across clouds, strong data sharing with partners and a credit-based model, but adds a separate vendor contract and governance plane. For most AWS-centric Indian enterprises, NTSPL recommends Iceberg on S3 with Athena plus Redshift Serverless for the hot dashboard layer.
Read the full page →For Windows Server VMs, Hybrid Benefit removes the Windows licence component, so you pay roughly the Linux rate for the same size. For SQL Server VMs the saving is larger because the SQL Server licence is also removed. The exact percentage depends on VM size and region. NTSPL produces a per-VM comparison in INR from the Azure pricing calculator before migration so finance sees the effect line by line.
Read the full page →Yes. Azure Migrate discovers Hyper-V and VMware VMs, assesses them against Azure sizes using performance data, and replicates them to Azure with agentless or agent-based replication. Cutover is a short outage while the final delta syncs. NTSPL groups servers into waves by dependency map, so the database and the application servers that call it move together over one weekend.
Read the full page →For most production workloads NTSPL uses Central India in Pune because it supports availability zones, with South India in Chennai as the paired disaster-recovery region. West India in Mumbai suits workloads that need proximity to Mumbai-based partners. Keeping both primary and DR copies in Indian regions also simplifies data-residency commitments to customers, auditors and regulators.
Read the full page →They no longer receive security updates: Extended Security Updates for Windows Server 2012 and 2012 R2, which Azure provided at no extra charge, ended on 13 October 2026, on Azure and on-premises alike. NTSPL therefore treats every 2012 workload as an upgrade-first item: each gets an upgrade or replacement date in the migration plan, it is isolated by network rules until then, and in-place OS upgrade is tested on a cloned VM first.
Read the full page →Only for work that tolerates interruption. Azure can evict a Spot VM with 30 seconds' notice, so it suits batch reports, rendering, CI agents and test environments, not a database or an interactive app server. NTSPL designs jobs to checkpoint progress to storage and spreads Spot requests across several VM sizes inside a Scale Set to reduce eviction impact.
Read the full page →It often is when the application is heavy, data-sensitive or needs a nearby SQL Server. Windows 11 Enterprise multi-session lets several users share one host, and eligible Microsoft 365 licences include the AVD access rights, so you pay mainly for host VMs and storage. Scaling plans that shut hosts down after hours typically decide whether the business case works.
Read the full page →Decide on four criteria. Flexibility: a Savings Plan applies an hourly spend commitment across VM families, sizes and regions, while a Reservation is tied to a size family and region, with instance size flexibility within that family. Discount depth: Reservations generally give a deeper discount for the same term on a VM that never changes. Change horizon: if you expect to move from D-series v4 to v5, consolidate servers or shift some load to App Service or AKS, the Savings Plan absorbs that; a Reservation has to be exchanged. Coverage of other services: a Savings Plan also applies to eligible App Service Premium plans and Container Apps dedicated compute. NTSPL's rule: Reservations for fixed SQL and infrastructure VMs, Savings Plan for everything else that runs steadily, pay-as-you-go for burst.
Read the full page →Blob Storage is billed on stored GB per month by tier and redundancy, plus per-operation transaction charges, data retrieval charges on cool, cold and archive, early-deletion charges if data leaves a tier before its minimum duration, and outbound data transfer. Lifecycle tier changes count as write operations. NTSPL models all of these in INR from a blob inventory report so the estimate reflects actual object counts, not just terabytes.
Read the full page →Standard-priority rehydration from archive can take up to 15 hours. High-priority rehydration may complete in under an hour for objects smaller than 10 GB, at a higher cost. You can rehydrate by changing the tier or by copying the blob to an online tier. NTSPL builds a self-service request flow so users know retrieval is asynchronous and pick priority based on urgency.
Read the full page →For under roughly 50 TB on a good link, AzCopy or Azure Storage Mover over the network is usually fine. Above that, Azure Data Box devices ship to your site, are filled locally and returned to the Azure data centre for upload. NTSPL indexes data before transfer and writes it directly into the target tier and prefix structure so lifecycle rules apply from day one.
Read the full page →Yes. Choose Central India, South India or West India for the storage account and LRS or ZRS to keep all copies in one Indian region, or GRS and GZRS to replicate between Central India and its pair, South India. This supports DPDP Act commitments and IRDAI or RBI expectations on where records reside. NTSPL also restricts replication and copy targets through Azure Policy.
Read the full page →Azure immutable Blob Storage has been assessed by an independent firm against SEC Rule 17a-4(f), CFTC and FINRA record-keeping requirements, which Indian regulated entities often use as a benchmark. Once a time-based retention policy is locked, the retention interval can be extended but not shortened, and blobs cannot be deleted or modified. Your compliance team still defines the retention periods.
Read the full page →Keep a small Windows Server cache with Azure File Sync where branches have limited bandwidth or applications need local SMB speed; cloud tiering keeps hot files local and the rest in Azure. Retire file servers entirely where users connect over ExpressRoute, VPN or Azure Virtual Desktop with low latency to the region. Many organizations run both models across different sites.
Read the full page →Choose on four criteria. Read latency: cool and cold are online with millisecond access; archive is offline and must be rehydrated, taking up to 15 hours at standard priority. Read frequency: cool suits data read monthly, cold data read a few times a year, archive data read once in several years or never. Minimum duration: 30 days for cool, 90 for cold, 180 for archive, with prorated charges for earlier deletion or tier change. Object size: archive favours large objects, because per-object transaction charges dominate millions of small files. In practice, NTSPL puts news clips older than a year on cold for instant producer search and raw rushes on archive, while an insurer's policy documents sit on cool for the first years and cold thereafter.
Read the full page →No direct charge applies for Azure Policy on Azure resources, management groups, Cost Management analysis and budgets, or Azure Advisor. Costs arise from what policies deploy, such as diagnostic settings sending logs to Log Analytics, and from Azure Policy guest configuration on Arc-enabled servers. NTSPL estimates the ingestion cost created by diagnostic policies before assigning them.
Read the full page →Usually because verbose diagnostic tables, such as storage, firewall, AKS container logs or SQL audit, land on the Analytics plan with no filtering. Run the workspace usage workbook to find the top tables, move those not used for alerting to Basic or Auxiliary plans, filter with DCR transformations, and adopt a commitment tier. Reductions of 30 to 50 percent are typical without losing alerting coverage.
Read the full page →Moving a subscription between management groups does not move or restart resources, but it changes inherited RBAC and policy. Before moving, compare the policy assignments at the source and target, run new policies in audit mode, and check that no pipeline service principal loses rights inherited from the old scope. NTSPL moves subscriptions in batches of 5 to 10 with a rollback plan.
Read the full page →Yes. Assign the built-in Allowed locations and Allowed locations for resource groups policies at the root or landing-zone management group, listing Central India, South India and West India plus global, for services such as Front Door and DNS that are not regional. This gives auditable evidence for data residency commitments under the DPDP Act and sector regulators such as RBI, SEBI and IRDAI.
Read the full page →Migrate to Azure Monitor Agent with data collection rules. The legacy Log Analytics agent was retired in August 2024 and no longer receives support. Use the AMA migration helper workbook to inventory agents, create DCRs that replicate your current collection, deploy AMA via Azure Policy, validate data parity for a week, then remove the old agent and workspace configuration.
Read the full page →Map every subscription or resource group to a cost centre, enforce a CostCentre tag with Azure Policy and tag inheritance, and allocate shared platform costs with Cost Management allocation rules. Then create budgets per cost owner with forecast alerts and give each owner Cost Management Reader on their scope. Monthly FOCUS exports let finance reconcile chargeback against the invoice.
Read the full page →Use four criteria. Estate mix: if 80 percent or more of workloads are on Azure, Azure Monitor and Application Insights collect platform metrics and logs natively without agents or API polling, and integrate with Azure Policy for coverage enforcement. Multi-cloud: if AWS or Google Cloud carry significant load, a cross-cloud tool such as Datadog gives one view, while Azure Monitor remains the source for activity logs and service health. Cost model: Azure Monitor bills on ingestion and retention, Datadog per host and per feature, so large VM fleets with low log volumes often cost less on Azure Monitor. Dashboards: Azure Managed Grafana can sit on top of Azure Monitor if teams prefer Grafana visuals. For most Azure-first Indian enterprises, Azure Monitor plus Managed Grafana is the sensible default.
Read the full page →Fabric is billed by capacity, purchased as F SKUs from F2 upwards, either pay-as-you-go by the hour, which can be paused, or reserved for a discount. OneLake storage is billed separately per GB. Power BI Pro or PPU licences are needed for authors, and for viewers on capacities below F64. NTSPL sizes capacity from a trial before you commit.
Read the full page →Microsoft has been transitioning Power BI Premium per-capacity customers to Fabric F SKUs. F64 is broadly equivalent to P1 in capacity and also enables Fabric workloads such as lakehouses, pipelines and Real-Time Intelligence. Existing workspaces are reassigned to the F capacity without rebuilding reports, but you should review licensing and capacity consumption once new Fabric workloads start sharing it.
Read the full page →Synapse dedicated SQL pools and SQL Server warehouses usually move to a Fabric Warehouse, keeping T-SQL logic, with schema and data moved by Fabric migration tooling or pipelines. Spark notebooks move to Fabric notebooks. Reports are repointed to new semantic models. Run old and new in parallel through one month-end close and reconcile key figures before decommissioning.
Read the full page →Yes. Fabric capacities are created in a chosen Azure region, and data in OneLake for workspaces on that capacity is stored in that region. Choose Central India or another available Indian region for capacities holding personal data covered by the DPDP Act or regulated financial data. Check the tenant's home region too, since some metadata is stored there.
Read the full page →With Real-Time Intelligence, events from IoT Hub, Event Hubs or Kafka flow through an Eventstream into an Eventhouse and are queryable within seconds, and Real-Time Dashboards refresh at intervals as short as a few seconds. Mirrored databases typically reflect source changes within minutes. Batch gold tables refresh on whatever schedule the pipelines run.
Read the full page →Not necessarily. Fabric notebooks run Spark and cover most data engineering for BI. Keep or add Databricks when you have large existing Databricks code, need advanced ML lifecycle tooling, or need fine control of cluster configuration for very large jobs. The two can share Delta tables via OneLake shortcuts, so this is not an either-or choice.
Read the full page →Choose on four criteria. Team profile: business-intelligence-heavy teams with SQL and Power BI skills move fastest on Fabric, where ingestion, warehouse and reporting share one SaaS platform and capacity. Engineering depth: teams running complex Spark pipelines, MLflow and streaming at scale get more control and tuning from Azure Databricks. Existing estate: Synapse customers should plan a move to Fabric, which Microsoft positions as the successor, rather than start new projects on Synapse. Cost model: Fabric charges for reserved capacity shared by all workloads, while Databricks bills per DBU consumed on clusters you size. Many Indian enterprises land on Fabric for BI and data engineering, keeping Databricks only where ML and big Spark workloads exist, sharing Delta tables through OneLake shortcuts.
Read the full page →Pay-as-you-go deployments bill per million input and output tokens, with rates varying by model and deployment type. Provisioned throughput bills reserved capacity per hour or through monthly and annual reservations, independent of tokens. Azure AI Search, Document Intelligence and Content Safety are billed separately. NTSPL estimates monthly INR cost from expected questions per day, average retrieved context and answer length.
Read the full page →No. Microsoft states that prompts, completions, embeddings and training data submitted to Azure OpenAI are not used to train or improve the foundation models and are not shared with OpenAI. Data may be stored temporarily for abuse monitoring, and eligible customers can apply for modified abuse monitoring. Your indexed documents remain in your own Azure AI Search and storage resources.
Read the full page →Yes, if you use Standard regional deployments in an Indian region where the required model is offered, and keep Azure AI Search and storage in Central India or South India. Global deployments may process data outside India, so avoid them for personal data you have committed to keep in-country under the DPDP Act or for RBI, SEBI and IRDAI-regulated data. Model availability by region changes, so check before design.
Read the full page →Start by turning the pilot's best questions into a golden evaluation set, then rebuild retrieval in Azure AI Search with your actual documents and access controls. Prompts usually transfer with modest changes. The main new work is extraction with Document Intelligence, security trimming, Content Safety configuration and evaluation gates, which typically take 6 to 10 weeks for one use case.
Read the full page →By constraining it to retrieved sources and measuring the result. The prompt instructs the model to answer only from provided passages and to say when information is missing, citations are mandatory, and Foundry evaluations score groundedness on a golden set before each release. Content Safety groundedness detection can flag ungrounded responses at runtime. Hallucinations rarely drop to zero, so high-stakes uses keep a human reviewer.
Read the full page →Current GPT-family models understand and generate Hindi and major Indian languages well, and handle mixed Hinglish text. Retrieval is the harder part: use multilingual embeddings, and add query rewriting so that a Hinglish question matches English policy text. Document Intelligence OCR supports Devanagari and several other Indian scripts. NTSPL includes regional-language questions in the golden set to test this explicitly.
Read the full page →Decide on four criteria. Audience and channel: if the need is everyday productivity inside Outlook, Word and Teams for all knowledge workers, Microsoft 365 Copilot is the product to license. Ownership: if business teams should build and maintain a Teams-based Q&A or workflow agent over SharePoint and a few connectors, Copilot Studio is faster and needs little code. Control: if you need custom retrieval, specific chunking, evaluation gates, multiple models, high volume or a customer-facing channel, build on Microsoft Foundry with Azure AI Search. Cost: Microsoft 365 Copilot is per user, Copilot Studio is by capacity or message consumption, and Foundry is pay per token or provisioned. Many enterprises combine them, using Copilot Studio as the front end that calls a Foundry-built agent.
Read the full page →It depends mainly on HANA memory size and whether you run HA and DR. A mid-size landscape with a 2 to 3 TiB production HANA, zonal HA, QA, development and a DR copy typically lands between INR 25 lakh and 50 lakh a month on reserved pricing, excluding SAP licences. NTSPL produces a system-by-system bill of materials before you commit.
Read the full page →Yes. Specific Azure VM sizes, including M-series, Mv2 and selected E-series VMs, are listed in SAP's Certified and Supported SAP HANA Hardware Directory for IaaS, along with supported storage configurations such as Azure NetApp Files and Premium SSD v2. NTSPL designs only from that directory and validates storage with SAP's HCMT tool before go-live.
Read the full page →Either migrate ECC to Azure first and convert later, or use SAP's Software Update Manager with Database Migration Option to convert and move in one programme. The two-step route exits hardware faster and reduces risk. The combined route saves one downtime but depends on custom-code and simplification-item readiness. Either way, plan at least two dress rehearsals.
Read the full page →Yes. Run production in Central India (Pune) with availability zones for HA, and DR in South India (Chennai), which is its paired region and geographically separate. HANA System Replication, Site Recovery and Azure Backup cross-region restore all operate between these regions, keeping SAP data in India to meet DPDP Act and auditor expectations.
Read the full page →Azure Backup integrates with HANA through SAP's Backint interface, which SAP has certified. It runs full, differential or incremental backups and log backups as frequently as every 15 minutes directly to a Recovery Services vault, without staging to local disk. You restore to a point in time from the Azure portal, including to a different VM for system copies.
Read the full page →Within a region, synchronous HSR across availability zones gives near-zero RPO and automatic failover in a few minutes with Pacemaker. Across regions, asynchronous HSR to South India typically gives RPO of seconds to minutes and RTO of 1 to 4 hours including application layer and interface checks. Backups add point-in-time recovery for corruption.
Read the full page →Judge on four criteria. Control: self-managed SAP on Azure gives you full control over sizing, HA design, patch timing, add-on products and third-party tools; RISE bundles infrastructure and technical operations under SAP's standard service definitions. Licensing: RISE converts licences to a subscription, which suits customers wanting S/4HANA Cloud Private Edition commercial terms; self-managed keeps existing perpetual licences and lets you bring support contracts and partners. Integration: if SAP is tightly coupled with plant MES, Azure data platforms and custom extensions, self-managed makes network and integration design simpler. Operations: if your basis team is thin and you want one throat to choke, RISE reduces scope. Many Indian manufacturers with in-house basis teams choose self-managed for cost and flexibility; those planning a full licence reset often choose RISE.
Read the full page →Managed Instance is billed per vCore-hour based on service tier and hardware, plus reserved storage beyond the included amount and backup storage beyond the free allocation. With Azure Hybrid Benefit, you pay only the base compute rate using your SQL Server licences with Software Assurance. Reserved capacity for one or three years lowers compute further. NTSPL builds an INR comparison against your current SQL Server licence and hardware costs.
Read the full page →With the Managed Instance link or online migration through Database Migration Service, downtime is typically limited to the final cutover, often 10-30 minutes, while connection strings are switched and the last transactions replicate. The link requires SQL Server 2016 or later. NTSPL rehearses the cutover on a copy and times it before the production weekend.
Read the full page →Yes. Azure SQL, Managed Instance, Cosmos DB and PostgreSQL Flexible Server can be deployed in Central India, South India and West India, with failover groups or read regions kept within India. Backup storage redundancy can be set to keep copies in-region. NTSPL documents data locations for RBI IT outsourcing reviews and DPDP Act data-processing records.
Read the full page →A request unit is a normalized measure of the CPU, memory and IO a database operation uses; a 1 KB point read by id and partition key costs about 1 RU, while writes and queries cost more. Estimate by running representative operations and reading the request charge header. NTSPL benchmarks real queries and indexing policy before setting autoscale maximums.
Read the full page →Choose Hyperscale when the database is large or growing fast, when backup and restore times are a problem, or when you need several read replicas for reporting. Choose Business Critical when you need the lowest write latency from local SSD storage and a single built-in readable secondary is enough. Many estates use both for different applications.
Read the full page →Yes, but the work changes. Patching, backups, HA configuration and storage management are handled by the platform, so DBA time moves to query tuning with Query Store, index design, schema changes, cost review and security reviews. Most mid-size firms find one DBA can cover two to three times as many databases after migration.
Read the full page →Decide on four criteria. Compatibility: Managed Instance supports nearly all SQL Server engine features including SQL Agent, cross-database queries and linked servers; SQL Database is scoped to one database; a VM supports everything, including OS access. Operational load: Managed Instance and SQL Database handle patching, backups and HA; on a VM you manage them. Scale: SQL Database Hyperscale reaches 128 TB per database and scales reads with named replicas. Cost: all three accept Hybrid Benefit, but PaaS removes cluster and backup infrastructure costs. NTSPL rule: packaged multi-database apps go to Managed Instance; owned single-database apps go to SQL Database or Hyperscale; only vendor-locked or OS-dependent workloads stay on VMs.
Read the full page →ExpressRoute cost has two parts: Microsoft's monthly circuit charge, which depends on bandwidth and whether you choose a metered or unlimited data plan, and the connectivity provider's charge for the last-mile link to the peering location, quoted separately in INR. Gateways in Azure are billed per hour. NTSPL compares metered and unlimited plans against your measured outbound volume before ordering.
Read the full page →Microsoft has ExpressRoute peering locations in several Indian cities, including Mumbai and Chennai, served by multiple Indian connectivity providers; check Microsoft's current location list for others. Plants and offices connect to the nearest location through their provider. For production resilience, NTSPL places two circuits at different peering locations so a single facility outage does not cut connectivity.
Read the full page →Build the new hub and IP plan alongside the current setup, connect sites to the hub one at a time, and move workloads into spokes in waves. Where address ranges overlap, re-IP the smaller side or use NAT on the VPN Gateway temporarily. NTSPL keeps the old tunnels as a fallback until each site has passed a week of monitored traffic.
Read the full page →Traffic between Azure VNets in Central India, South India and West India uses peering over the Microsoft global network rather than the public internet. Choosing Indian regions for both primary and DR, and Indian peering locations for ExpressRoute, keeps the data path within the country, which supports DPDP Act, RBI and sector data-localization commitments.
Read the full page →Almost always DNS. Office clients resolve the service's public name to its public IP because on-premises DNS does not know the privatelink zone. Fix it by deploying Azure DNS Private Resolver in the hub and adding conditional forwarders on office DNS servers for privatelink suffixes pointing to the resolver's inbound endpoint.
Read the full page →Azure Arc gives on-premises servers an Azure resource identity so you can apply Azure Policy, patch through Azure Update Manager, protect with Defender for Servers and collect logs with Azure Monitor, all from the same portal as Azure VMs. Some management capabilities are billed per server. It suits plant and terminal servers that cannot move to the cloud.
Read the full page →Decide on four criteria. Reliability: ExpressRoute uses a private provider circuit with an SLA and is not affected by internet congestion; VPN depends on the public internet. Latency consistency: ExpressRoute gives predictable latency for ERP, MES or terminal systems; VPN latency varies with ISP conditions. Bandwidth: VPN Gateway aggregate throughput is limited by SKU, while ExpressRoute circuits scale to 10 Gbps through providers and 100 Gbps with ExpressRoute Direct (400 Gbps in limited peering locations). Cost and lead time: VPN is cheaper and live in days; ExpressRoute needs a provider order that can take several weeks. NTSPL rule: ExpressRoute for any site where a network outage stops production, with VPN as its backup; VPN alone for offices and small branches.
Read the full page →No. Deployment slots run on the same App Service plan instances as the production app, so there is no separate charge for the slot itself, though a slot consumes some of the plan's CPU and memory while running. The Standard tier supports up to five slots and Premium up to 20. NTSPL usually keeps one staging slot per production app.
Read the full page →Run the App Service migration assessment against the IIS server to flag blockers such as GAC dependencies, local file writes or Windows authentication, fix those, then deploy to a staging slot and test. Static files written to local disk usually move to Blob Storage. DNS is switched through Front Door once the slot passes tests, so rollback is a routing change.
Read the full page →Yes. Both can be deployed in Central India, South India and West India, and Azure SQL and Redis caches can be placed in the same region. Front Door is a global service that caches content at edge locations, so for pages carrying personal data under the DPDP Act, NTSPL disables caching on those routes so responses are not stored at the edge.
Read the full page →It can if prepared. Reactive autoscale adds instances in minutes, which is too slow for an instant spike, so NTSPL pre-scales on a schedule before known events, caches heavily at Front Door, and moves sessions to Redis so new instances serve traffic immediately. For unannounced spikes, HTTP queue-length rules react faster than CPU rules.
Read the full page →When the site is mostly static content or a single-page app calling APIs. Static Web Apps serves files from global points of presence, provides free managed TLS for custom domains and creates a preview environment for each pull request. Anything requiring server-side rendering with heavy logic, or long-running back ends, belongs on App Service or Container Apps.
Read the full page →On the consumption profile, you pay per second for vCPU and memory while replicas run, plus a per-million request charge, with a monthly free grant. Scaling to zero stops compute charges. Dedicated workload profiles bill per node instead and suit steady, larger services. Many environments mix both: consumption for spiky APIs and dedicated profiles for always-on services.
Read the full page →Decide on four criteria. Packaging: App Service runs code directly on built-in stacks or a container; Container Apps and AKS require containers. Scaling: App Service scales instances by rules and keeps at least one running; Container Apps scales on HTTP, events or queues and can go to zero; AKS scales anything but you configure it. Release model: App Service slots give swap-based zero-downtime releases; Container Apps revisions give weighted traffic splitting; AKS needs your own rollout tooling. Operations: App Service and Container Apps hide the cluster; AKS exposes it. NTSPL rule: web front ends and monoliths on App Service, containerized APIs and event workers on Container Apps, AKS only when you need node control, service mesh or more than 20-30 services.
Read the full page →You pay for the VMs, disks, load balancers and data transfer that your node pools use, at normal Azure rates. The control plane is free on the Free tier, while the Standard tier adds an hourly cluster fee for a financially backed API server SLA, and Premium adds Long Term Support. Savings Plans, Reservations and Spot apply to node VMs. NTSPL estimates node counts from pod requests.
Read the full page →For existing Kubernetes, export manifests or Helm charts, replace cloud-specific storage classes and ingress, swap secrets for Workload Identity and Key Vault, then deploy through GitOps to a new AKS cluster and shift traffic by DNS. For Docker Compose, convert services into Kubernetes deployments with health probes and resource requests first. NTSPL runs both environments in parallel during cutover.
Read the full page →Yes. AKS and Azure Container Registry are available in Indian regions including Central India, with registry geo-replication to South India for DR. Application data stays in the regional data services you attach. NTSPL documents data flows for DPDP Act processing records and for IRDAI or RBI reviews, and restricts registry replication to Indian regions.
Read the full page →AKS Automatic is a cluster mode where Azure preconfigures node provisioning, scaling, networking, security safeguards, monitoring and upgrades according to recommended practice, so teams deploy workloads without designing node pools. AKS Standard gives full control of every setting. Automatic is faster to production; Standard suits Windows nodes, GPUs or unusual requirements.
Read the full page →Kubernetes secrets are only base64-encoded and often end up in Git or Helm values; if leaked, they grant access until manually rotated. Workload Identity issues short-lived Entra ID tokens to pods based on their service account, so there is nothing to leak or rotate. It replaces the deprecated pod-managed identity add-on.
Read the full page →Plan for a minor-version upgrade about every quarter, because new Kubernetes versions arrive roughly three times a year and AKS supports a limited window of versions. Auto-upgrade channels and planned maintenance windows automate most of it. If quarterly upgrades are impractical for a regulated workload, the Premium tier offers Long Term Support for selected versions.
Read the full page →Decide on four criteria. Control: AKS exposes the full Kubernetes API, node pools, DaemonSets, CRDs and operators; Container Apps hides Kubernetes and offers a fixed set of features. Scale of estate: AKS pays off when you run dozens of services, need service mesh or operators such as Kafka or Postgres operators; Container Apps fits up to a few dozen services with HTTP and event scaling. Operations: AKS needs upgrade planning, node management and platform engineering capacity, though AKS Automatic reduces this; Container Apps needs almost none. Cost model: AKS bills nodes whether pods use them or not; Container Apps consumption bills per second of use. NTSPL rule: start on Container Apps unless a concrete requirement needs Kubernetes APIs.
Read the full page →Flex Consumption bills on-demand executions by GB-seconds of memory used during execution plus a per-execution charge, and bills always-ready instances, if you configure them, at a lower baseline rate while idle and the normal rate while executing. There is a monthly free grant for on-demand usage. NTSPL estimates cost from expected executions, duration and memory size per function.
Read the full page →Catalogue each job's source, target, schedule and failure handling, then classify it: bulk data loads go to Data Factory, file-based partner exchanges to Logic Apps with SFTP or AS2 connectors, and event-driven transfers to Service Bus with Functions consumers. NTSPL migrates flows in order of business pain, running old and new in parallel until outputs match.
Read the full page →Yes. Functions, Logic Apps, API Management, Service Bus and Event Grid can be deployed in Indian regions such as Central India, with private endpoints so message traffic stays on private networks. Logic Apps run history and Application Insights logs should also be placed in Indian regions and masked for personal data. NTSPL documents these locations for DPDP Act processing records.
Read the full page →Yes. Logic Apps supports AS2 for secure transport and X12 and EDIFACT for encoding and decoding business documents such as purchase orders, ship notices and invoices, using an integration account to hold trading partners, agreements, schemas and maps. Acknowledgements such as MDN and functional acknowledgements are generated automatically per agreement.
Read the full page →Route HL7 v2 messages from the HIS or LIS over MLLP to a listener, typically a container or Function, then call the FHIR service's $convert-data operation with Liquid templates to produce FHIR R4 resources, and store them in Azure Health Data Services. Templates are adjusted for local fields. This supports exchange aligned with ABDM's FHIR-based profiles.
Read the full page →Through API Management. It gives each partner its own key or OAuth client, rate limits and quotas, so one partner cannot overload the ERP; it hides internal URLs; and it logs every call for dispute resolution. Policies can also transform payloads, so partner contracts stay stable even when the ERP API changes.
Read the full page →Decide on four criteria. Intent: Service Bus carries business messages that a consumer must act on, such as an order or claim; Event Grid carries notifications that something happened; Event Hubs carries high-volume telemetry streams for analysis. Delivery guarantees: Service Bus offers ordered sessions, transactions, duplicate detection and dead-lettering; Event Grid offers retries and dead-lettering with at-least-once delivery; Event Hubs keeps a retained log that consumers read at their own pace. Volume: Event Hubs handles millions of events per second; Service Bus suits thousands of business messages per second. Consumer model: Service Bus and Event Grid push or pull per message; Event Hubs uses partitioned consumer groups. NTSPL rule: business transactions on Service Bus, reactive notifications on Event Grid, telemetry on Event Hubs.
Read the full page →Conditional Access requires Microsoft Entra ID P1, and PIM, risk-based Conditional Access and access reviews require Entra ID P2 or Entra ID Governance. Microsoft 365 E3 includes P1 and E5 includes P2, so many Indian enterprises already own the entitlement. Only the users who actually activate privileged roles or are covered by risk policies need P2, which keeps incremental licence spend modest.
Read the full page →Sentinel is billed on data ingested into the workspace and on retention beyond the included period, either pay-as-you-go per GB or through daily commitment tiers. Predictability comes from measuring 30 days of real ingestion by source in a pilot, sending high-volume firewall and proxy logs to a cheaper tier, and setting a daily cap alert on the workspace. NTSPL provides a per-connector INR estimate before onboarding.
Read the full page →You do not replace AD on day one. Entra Connect cloud sync or Connect Sync synchronizes identities with password hash sync, which also enables leaked-credential detection. Users keep their existing passwords. Apps then move from AD FS or Kerberos to Entra single sign-on in waves, and AD FS is decommissioned once the last relying party is migrated. Typical mid-size migrations take 8 to 14 weeks.
Read the full page →Yes. Create the Log Analytics workspace behind Sentinel in Central India (Pune) or South India (Chennai) and its data at rest stays in that region. CERT-In's April 2022 directions require ICT system logs to be maintained for 180 days within Indian jurisdiction, and incidents to be reported within 6 hours. NTSPL configures retention and an incident-reporting playbook to meet both.
Read the full page →It covers a large share of the identity, logging and monitoring controls. PIM and access reviews evidence least privilege, Conditional Access logs prove MFA on privileged access, Defender for Cloud regulatory compliance dashboards track configuration baselines, and Sentinel provides continuous monitoring and incident records. NTSPL maps each CSCRF requirement applicable to your entity category to a specific Azure evidence source; governance and process controls remain your responsibility.
Read the full page →Most tenants gain 15 to 25 points within the first 4 weeks, because the highest-weighted recommendations are quick fixes: MFA for admins, blocking legacy authentication, enabling Defender plans and removing public network access on storage and databases. The remaining gains are slower as they require application changes, such as moving secrets to Key Vault and replacing service principal secrets with managed identities.
Read the full page →Choose on three criteria. Data gravity: if 70 percent or more of your security signal comes from Entra ID, Microsoft 365, Defender and Azure, Sentinel ingests much of it at low or no cost and correlates natively, while Splunk charges full ingestion for the same data. Existing investment: if you already run Splunk Enterprise Security with years of tuned detections and SPL-skilled analysts, keep it and forward Azure logs, because rewriting detections in KQL costs more than the licence saving for the first 2 years. Staffing: if you have fewer than 3 analysts, neither tool will help without people; buy a managed SOC that operates your Sentinel workspace so the data and detections remain yours if you change provider. For most mid-size Indian firms standardizing on Microsoft 365, Sentinel wins on total cost.
Read the full page →You pay a monthly protected-instance fee that depends on the size of data protected for each VM, plus the storage consumed by recovery points, charged per GB at LRS, ZRS or GRS rates. Incremental backups mean storage grows with change rate, not full copies. NTSPL sizes daily churn per server during assessment and gives an INR estimate per tier before you commit.
Read the full page →For Azure VM to Azure VM replication, crash-consistent recovery points are created about every 5 minutes, so RPO is typically a few minutes under normal churn. RTO depends on the recovery plan: VM boot is usually 5 to 15 minutes, and application start, DNS changes and validation add the rest. Well-engineered tier-1 plans NTSPL builds commonly finish within 30 to 60 minutes.
Read the full page →Start with the MARS agent for file and folder backup or Microsoft Azure Backup Server for Hyper-V, SQL and Exchange workloads, sending data to a Recovery Services vault in an Indian region. For large first copies, offline seeding avoids saturating the WAN. Keep tapes running in parallel for one retention cycle, then retire them once restore tests from Azure pass.
Read the full page →Yes, if you choose Indian regions. A vault in Central India with geo-redundant storage replicates to its paired region, South India, and Site Recovery can target South India or Central India. All four Azure India regions, Central India, South India, West India and India South Central (Hyderabad, live since August 2026), are in-country, which supports data-localization expectations from RBI for payment data and residency choices under the DPDP Act.
Read the full page →Not if the vault is configured correctly. Azure Backup data is not reachable as a file share from production VMs, so ransomware cannot encrypt it directly. To stop an attacker with admin credentials, lock the vault as immutable, keep enhanced soft delete always-on and protect destructive operations with Resource Guard multi-user authorization in a separate subscription.
Read the full page →Run a Site Recovery test failover at least twice a year for tier-1 systems, and after any major application change. Test failover brings VMs up in an isolated VNet from replicated data while replication continues, so production is unaffected. NTSPL times each step, has application owners sign off functionality, and cleans up the test environment the same day to avoid compute charges.
Read the full page →Judge on four criteria. Purpose: Azure Backup gives historical recovery points to undo deletion, corruption or ransomware, keeping weeks to years of history; Site Recovery keeps a near-current replica to survive losing a region or data centre. RPO: Backup typically gives 15 minutes for SQL log backups and 24 hours for VMs; Site Recovery gives minutes. RTO: restoring a large VM can take hours; Site Recovery failover typically completes in minutes plus application start time. Corruption: Site Recovery replicates encryption and bad data within minutes, so it cannot replace backup. Conclusion: every production system needs Azure Backup. Add Site Recovery only where the business RTO is under about 4 hours or RPO under 1 hour, which is usually ERP, WMS, POS back-end and citizen-facing systems.
Read the full page →Azure Migrate discovery, assessment, business case and server migration tooling are provided without a separate licence charge in most scenarios. You pay for the replication storage and snapshots used while servers replicate, the target Azure resources after cutover, and network connectivity. Agentless dependency analysis is also included. The appliance runs on your own hypervisor, so it consumes a modest amount of on-premises capacity.
Read the full page →For 150 to 400 servers, NTSPL programmes typically run 5 to 9 months: about 6 weeks for discovery and business case, 4 weeks for landing zone and pilot, then fortnightly waves of 20 to 50 servers. The critical path is usually application owner availability for UAT and vendor sign-off for packaged apps, not replication speed.
Read the full page →Yes. Azure Migrate supports agentless migration of Hyper-V VMs by installing a replication provider on the Hyper-V hosts or cluster nodes rather than inside each guest. Replication runs continuously, and you trigger test and production migrations from the portal. Physical servers and VMs on unsupported hypervisors still need the replication agent.
Read the full page →Central India (Pune) is the usual primary because it offers availability zones and a broad service catalogue, with South India (Chennai) as its paired region for DR. West India (Mumbai) is an option when latency to Mumbai users or exchanges matters, but check service availability there first. For DPDP Act and sector regulator expectations, all three keep data in India.
Read the full page →With Software Assurance or subscription licences, Azure Hybrid Benefit lets you apply existing SQL Server core licences to Azure SQL Managed Instance, Azure SQL Database (vCore) or SQL Server on Azure VMs, paying only the base compute rate. Without it, licence-included pricing applies. NTSPL reconciles your Microsoft licence statement against the target design in the business case.
Read the full page →Azure Database Migration Service in online mode restores a full backup and then continuously applies log backups to the target Azure SQL Managed Instance. On cutover night, applications are stopped, the final log backup is applied, and connection strings are switched, typically within 15 to 45 minutes. A rollback plan keeps the source database read-only but intact for 72 hours.
Read the full page →Decide on four criteria. Deadline: if the data centre must be empty within 6 months and the estate is mostly VMware, AVS with HCX is the only low-risk path at scale. Licence position: if you hold SQL Server Software Assurance, replatforming to Azure SQL Managed Instance with Hybrid Benefit usually beats rehosting SQL VMs on total cost. Application ownership: in-house .NET apps with source code can move to App Service with modest change, while vendor packaged apps should be rehosted unless the vendor certifies PaaS. Operations model: if your team is VMware-skilled and stretched, AVS preserves tooling; native VMs and PaaS reduce run cost long term. Most programmes combine all three, with rehost as the default and PaaS where the economics are clear.
Read the full page →Spot VMs are typically priced 60-91% below on-demand, depending on machine type and region, and prices can change up to once a month. The real saving depends on preemption rate: a rendering or genomics job that checkpoints every 10 minutes usually realises 55-75% net savings after retries. We blend Spot task groups with a standard-VM fallback so deadlines are met even when spare capacity tightens.
Read the full page →No. Sustained use discounts apply only to specific series including N1, N2, N2D, C2, M1 and M2, and they reach up to 30% for VMs running the whole month. Newer series such as N4 and C4 do not receive them, so the cost case for moving relies on better price-performance per core, rightsizing, committed use discounts and Spot capacity rather than automatic monthly discounts.
Read the full page →We use Migrate to Virtual Machines to replicate disks continuously from vSphere or other sources, run test clones in an isolated VPC, then cut over in a short window with final sync. Before replication we rightsize each VM using its on-premises utilization so you do not carry 16-vCPU templates that use two cores. Stateless tiers are rebuilt as MIGs rather than migrated one-to-one.
Read the full page →Yes. Google Cloud operates the Mumbai (asia-south1) and Delhi (asia-south2) regions, each with three zones. We pin VMs, disks, snapshots and images to these regions using the resource locations organization policy, so personal data processed under the DPDP Act 2023 is not stored elsewhere by accident. Snapshot and image storage locations are set explicitly, because multi-regional defaults can otherwise place copies outside India.
Read the full page →Use Batch when your jobs are independent or embarrassingly parallel tasks and nobody wants to maintain a scheduler head node. Batch provisions VMs per job, supports Spot, GPUs and container or script runnables, and deletes capacity afterwards. Keep Slurm, deployed with Google's Cluster Toolkit, when researchers depend on Slurm semantics, MPI jobs needing tight placement, or existing submission scripts that are expensive to rewrite.
Read the full page →Every MIG gets an explicit maximum replica count tied to a budget, Cloud Billing budget alerts at 50%, 90% and 100% of forecast, and a Monitoring alert when the group sits at its maximum size for more than 15 minutes. Project-level CPU and GPU quotas act as a final ceiling. We also review autoscaler logs weekly during the first month to catch scaling oscillation.
Read the full page →Choose by operational unit and scaling pattern. Compute Engine wins when you need OS-level control, licensed software tied to vCPUs, GPUs for long training runs, or legacy applications that cannot be containerized within the project timeline; you manage images and patching. GKE wins when you already ship containers, run more than a handful of services and want bin-packing, rolling deployments and policy across a fleet; Autopilot removes node management while keeping Kubernetes APIs. Cloud Run wins for stateless HTTP or event-driven services with spiky or idle traffic, because it scales to zero and needs no cluster. Many NTSPL designs mix all three: Cloud Run for APIs, GKE for platform services, and Compute Engine with Batch on Spot VMs for heavy, finite compute.
Read the full page →Cloud CDN charges cache egress per GB, cache fill per GB when the edge fetches from origin, and a per-request fee for HTTP lookups. Cache egress is priced below standard internet egress from Cloud Storage, so savings scale with hit ratio. At a 90% hit ratio, only one byte in ten is billed as origin fill, which is why NTSPL focuses first on cache key and TTL tuning.
Read the full page →Yes. Cloud Storage offers the IN configurable dual-region, which pairs Mumbai (asia-south1) and Delhi (asia-south2), so both copies stay in India. Turbo replication adds a target of replicating newly written objects within 15 minutes. This supports DPDP Act 2023 data-location commitments to customers and gives a regional-outage recovery point without maintaining copy jobs.
Read the full page →Objects managed by Autoclass are not charged early-deletion or retrieval fees when they move between classes or are read. Instead there is a monthly management fee per 1,000 eligible objects. For buckets with millions of very small objects, compare that fee with the expected class savings first; for large media objects Autoclass almost always comes out ahead.
Read the full page →Storage Transfer Service handles scheduled or one-time transfers from other clouds, HTTP sources and on-premises filesystems using transfer agents, with checksums and incremental sync. For very large one-time loads with limited bandwidth, Transfer Appliance is an option. NTSPL runs an initial bulk copy, then incremental syncs until a short read-only window for cutover, and validates object counts and checksums per prefix.
Read the full page →Yes. Filestore exports NFS shares that Compute Engine VMs mount directly and GKE mounts through the Filestore CSI driver as persistent volumes with ReadWriteMany access. We typically use it for shared CMS media folders or render scratch space. Keep the Filestore instance in the same region and VPC as its clients, since cross-region NFS adds latency and egress.
Read the full page →Combine Cloud Armor rules on the load balancer with referrer and rate-based controls, use signed URLs for high-value assets like original-resolution images, and make sure the bucket itself is not publicly readable so the only path is through the CDN. Logging to BigQuery shows which user agents and referrers consume the most egress so rules can be targeted.
Read the full page →Decide on content type, scale and integration. Cloud CDN is the default for websites and apps already behind a Google Cloud Application Load Balancer: images, scripts, downloads and cacheable API responses, configured in the same Terraform as your backends, with Cloud Armor in the same path. Media CDN is the choice when streaming video or very large downloads dominate, because segment-aware caching and origin shielding protect the origin during live events. A third-party CDN makes sense when you need multi-cloud origins under one edge, specialised edge compute you already depend on, or contractual delivery in markets where you have negotiated rates; you then pay Cloud Storage internet egress to that CDN unless an interconnect-based programme applies.
Read the full page →Start on-demand, measure, then decide. On-demand bills per TiB scanned and suits small or unpredictable workloads. Once scheduled ELT and dashboards make spend steady, Enterprise edition reservations with autoscaling are usually cheaper and capped. NTSPL analyses INFORMATION_SCHEMA.JOBS for two to four weeks and models both options; most mid-size clients end up with reservations for pipelines and BI and on-demand with quotas for exploration.
Read the full page →Migrate by subject area, not all at once. NTSPL uses the BigQuery Migration Service for SQL translation, Datastream or batch exports for data, and validates row counts and key aggregates between old and new for every table. Reports are repointed in waves, with the old warehouse kept read-only for one or two month-end closes before decommissioning. A typical 5 to 15 TB warehouse moves in 10 to 16 weeks.
Read the full page →Yes. Datasets are created in a specific location, such as asia-south1 Mumbai or asia-south2 Delhi, and data stays there; an Organization Policy location constraint prevents datasets elsewhere. NTSPL avoids the US or EU multi-regions for personal data and checks that linked services, such as Dataflow job regions and Looker instance location, also use India regions.
Read the full page →Looker Studio is enough when a few teams build reports on curated tables and occasional inconsistency is tolerable. Choose Looker when many teams share metrics, definitions must be version-controlled in LookML, or you embed analytics in a customer-facing product. A common pattern is Looker for finance and leadership metrics and Looker Studio for departmental reports on authorized views.
Read the full page →Seconds for streaming and minutes for database change capture. Pub/Sub BigQuery subscriptions and the Storage Write API make rows queryable almost immediately, and Datastream typically lands changes within minutes based on its staleness setting. NTSPL sets freshness per table, because near-real-time ingestion costs more and many finance tables only need hourly or daily updates.
Read the full page →Yes, for many cases. BigQuery ML lets analysts train ARIMA_PLUS forecasting, classification and anomaly detection models with SQL on warehouse tables. NTSPL sets up templates, evaluation queries and scheduled retraining so forecasts for demand, generation or footfall refresh automatically. Custom deep-learning models still belong on the Gemini Enterprise Agent Platform.
Read the full page →Use four criteria. Integration: BigQuery is native to Google Cloud, so GA4 exports, Google Ads transfers, Pub/Sub subscriptions, Datastream and Looker connect without connectors, while Snowflake on Google Cloud needs more plumbing. Operations: both BigQuery and Snowflake remove cluster patching; a self-managed warehouse on Compute Engine only makes sense for licensing lock-in or extreme customization. Cost model: BigQuery offers both bytes-scanned and slot pricing, so spiky exploration and steady ELT can use different models; Snowflake bills per warehouse-second. Residency: BigQuery datasets can be pinned to asia-south1 or asia-south2. If most data already lives on Google Cloud, BigQuery is the default; Snowflake fits multi-cloud data sharing needs.
Read the full page →Gemini is billed per input and output token, with rates depending on the model tier, plus charges for grounding services such as Agent Search. A typical six-turn support conversation on a Flash-tier model with retrieved context often costs a fraction of a rupee to a few rupees, depending on context size. NTSPL models cost per resolved conversation from your real transcripts before build, and uses caching and routing to keep it within the agreed target.
Read the full page →Not necessarily. NTSPL often keeps deterministic flows for transactions such as payments or cancellations and places a Gemini agent in front for free-text understanding and knowledge questions. The existing bot's logs become the starting golden set. Over two or three releases, intents that the agent handles better are migrated, and the old flows remain for actions requiring strict control.
Read the full page →Largely yes, with checks per model. Stored data such as Agent Search indexes, BigQuery tables and logs can be kept in asia-south1 or asia-south2, and NTSPL uses regional endpoints for model calls where the chosen model is served in an India region. Model availability by region changes, so we confirm it at design time and document any processing location for your DPDP Act records.
Read the full page →Well for major languages such as Hindi, Bengali, Tamil, Telugu, Marathi, Kannada, Gujarati and Malayalam, but quality varies by language and register. Code-mixed inputs and regional transliteration are where most errors appear. NTSPL measures accuracy separately per language on real user messages and sets launch thresholds per language, sometimes launching a few languages first.
Read the full page →Gemini Enterprise is a ready product for employees: search, chat and agents over company content with existing permissions. Agent Platform is the developer platform for building your own customer-facing agents, models and applications. Choose Gemini Enterprise for internal productivity, and Agent Platform when the assistant is part of your product, uses your brand, or needs custom tools and evaluation.
Read the full page →Typically 8 to 14 weeks for a first use case. About two weeks go to building the golden set and curating content, four to six weeks to building and evaluating, and two to four weeks to shadow and pilot. Vision inspection projects can take longer if new image capture hardware or lighting changes are needed at the line.
Read the full page →Decide on content type, freshness and control. Agent Search is the fastest route for documents, websites and FAQs: managed parsing, ranking and cited answers, with sync from Cloud Storage or connectors, and it suits most support and helpdesk cases. A custom RAG pipeline with your own embeddings and vector index fits when chunking must follow domain structure or retrieval must filter on live transactional data. Fine-tuning changes style, format or domain vocabulary, not knowledge; it does not keep answers current when policies change, so it complements retrieval rather than replacing it. For most Indian enterprises, start with Agent Search plus structured tool calls, measure groundedness, and add custom retrieval only for the queries that fail.
Read the full page →For a typical mid-size S/4HANA landscape with a 2 to 4 TB production database, HA, DR and three non-production systems, Google Cloud infrastructure usually costs INR 12 to 30 lakh per month depending on commitments and DR design. That replaces appliance refresh, data centre, storage and backup costs. NTSPL builds the comparison from your actual sizing and includes three-year committed use discounts and non-production scheduling.
Read the full page →Yes. SUM with Database Migration Option can migrate ECC from Oracle, SQL Server or DB2 to HANA on Google Cloud and, combined with a system conversion, land on S/4HANA in one programme. NTSPL usually rehearses twice, measuring each phase, to fit the cutover in a weekend or plant shutdown. Some customers move ECC first and convert later to separate infrastructure and functional risk.
Read the full page →Yes. Production runs in asia-south1 Mumbai across two zones for high availability, and DR runs in asia-south2 Delhi, so financial and personal data never leaves India. This satisfies most data localisation expectations under RBI rules for regulated entities and DPDP Act obligations. Organization Policy pins SAP projects to the two India regions to prevent accidental resources elsewhere.
Read the full page →Most landscapes use the Backint feature of Google Cloud's Agent for SAP, which writes HANA data and log backups directly to Cloud Storage, certified by SAP and managed from HANA Studio or Cockpit. For very large databases or frequent system copies, Backup and DR Service gives faster mount-based recovery. NTSPL measures restore time for each system and chooses accordingly.
Read the full page →With a Pacemaker cluster and synchronous HANA System Replication with table preload, takeover to the second Mumbai zone typically completes in a few minutes, and application servers reconnect through the virtual IP. NTSPL tests takeover under load before go-live and repeats tests after OS or HANA upgrades, recording timings for audit and business continuity records.
Read the full page →The common path is the BigQuery Connector for SAP running in SAP Landscape Transformation Replication Server, replicating selected tables in near real time. Cortex Framework adds reference data models and Looker dashboards for finance, sales and supply chain. Alternatively, SAP Datasphere replication flows can target BigQuery. NTSPL chooses based on your existing SAP licences and latency needs.
Read the full page →Compare on four points. Scope of responsibility: RISE bundles the S/4HANA subscription, infrastructure and technical operations under one SAP contract; self-managed means you or a partner like NTSPL run Basis, HA and backups on your own Google Cloud projects. Control: self-managed gives direct access to the infrastructure, sizing, maintenance windows and integration with other Google Cloud workloads; RISE limits that to SAP's service catalogue. Commercials: RISE is a subscription; self-managed lets you apply existing SAP licences and Google Cloud commitments. Analytics and integration: both can feed BigQuery, but self-managed allows SLT and Agent for SAP configuration on your terms. Choose RISE for simplicity and a single contract; choose self-managed for control and cost transparency.
Read the full page →Spanner can start well below one node by provisioning processing units, where 1,000 processing units equal one node, so small regional databases are no longer prohibitively expensive. However, a dual-region-india1 configuration requires Enterprise Plus edition and replicates data across regions, so it costs considerably more than a Cloud SQL HA instance. We model both on your actual TPS and storage before recommending.
Read the full page →Yes. DMS supports heterogeneous migrations from Oracle to Cloud SQL for PostgreSQL and AlloyDB, using conversion workspaces to translate schema and PL/SQL code, with Gemini-assisted conversion for objects that rules cannot handle. Data then replicates continuously until cutover. Expect most effort in stored procedures and application SQL; we size it from the conversion report before committing to a date.
Read the full page →Cloud SQL, AlloyDB, Firestore and Memorystore can all be deployed in Mumbai (asia-south1) or Delhi (asia-south2), and Spanner offers the dual-region-india1 configuration spanning both. Backups, replicas and CMEK keys must also be pinned to India locations. This matters for RBI payment data storage requirements, IRDAI record-keeping and personal data obligations under the DPDP Act 2023.
Read the full page →A homogeneous MySQL or PostgreSQL migration of a few hundred gigabytes usually takes 4-6 weeks, including profiling, a rehearsal cutover and the production cutover window of 10-30 minutes. Heterogeneous Oracle or SQL Server migrations take 10-20 weeks, driven mostly by stored-procedure conversion and application testing rather than data transfer itself.
Read the full page →Choose Firestore when mobile or web clients need real-time listeners and offline sync, data is naturally a hierarchy of documents, and queries are key or index lookups. Choose Cloud SQL when you need joins, multi-table transactions with complex constraints, or ad hoc reporting. Firestore bills per document operation, so chatty designs that read hundreds of documents per screen become expensive quickly.
Read the full page →Often, yes, for operational reporting. The columnar engine keeps frequently queried columns in memory in columnar format and accelerates scans and aggregations, and read pools isolate reporting load from the primary. It does not replace BigQuery for multi-terabyte historical analytics or joins across many source systems; for those we stream changes from AlloyDB to BigQuery with Datastream.
Read the full page →Decide on four criteria. Engine: Cloud SQL supports MySQL, PostgreSQL and SQL Server; AlloyDB is PostgreSQL only; Spanner offers GoogleSQL and a PostgreSQL interface with some differences from native PostgreSQL. Write scale: Cloud SQL and AlloyDB scale writes vertically on one primary, while Spanner shards writes horizontally with no ceiling you are likely to hit. Analytics on live data: AlloyDB's columnar engine accelerates reporting queries without a separate warehouse; Cloud SQL does not. Availability: Cloud SQL Enterprise Plus and AlloyDB offer 99.99% regional SLAs, while Spanner Enterprise Plus in dual-region-india1 offers 99.999% with synchronous replication between Mumbai and Delhi. Cost rises roughly in that order, so choose the lowest tier that meets your write and availability needs.
Read the full page →Dedicated Interconnect bills an hourly port charge per circuit plus an hourly charge per VLAN attachment, and egress over the link is billed at a lower per-GB rate than internet egress. Partner Interconnect bills per VLAN attachment based on capacity, plus the provider's own charges. Ingress is free. We model break-even against VPN using your measured monthly egress, which usually favours Interconnect above tens of terabytes.
Read the full page →Yes. The 99.99% Interconnect topology needs at least four VLAN attachments across two metropolitan areas, with two attachments in different edge availability domains in each metro, connected to Cloud Routers in two regions. In India this is typically built across Mumbai and Delhi, aligning with asia-south1 and asia-south2. HA VPN with redundant peer tunnels also carries a 99.99% SLA.
Read the full page →We build the Shared VPC host project alongside existing networks, create new subnets from the agreed IP plan, and migrate workloads project by project. Stateless tiers are redeployed into the new subnets behind load balancers; stateful VMs move during planned windows. Temporary peering or PSC keeps old and new networks connected during the transition, typically over 6-12 weeks for a mid-size estate.
Read the full page →No, it complements it. NCC lets SD-WAN appliances from supported vendors run as router appliance spokes in your VPC, so Google's backbone carries traffic between regions and sites while your SD-WAN keeps managing branch links and application policy. It removes the need for a mesh of VPN tunnels between every site and every cloud region.
Read the full page →PSC creates an endpoint IP inside your own subnet, so there is no peering, no route exchange and no risk of overlapping ranges with the producer. It also works across organizations, which matters when a bank, insurer or SaaS partner publishes a service to you. Access is controlled per endpoint, and the producer only sees connections from approved consumer projects.
Read the full page →Data residency is mainly a storage and processing decision, but networking supports it. We restrict resource locations to asia-south1 and asia-south2 by organization policy, keep load-balancer backends in India regions, and terminate Interconnect in Mumbai and Delhi. Global load balancers still route through Google's edge, so payloads in transit are TLS-encrypted end to end, which satisfies most RBI and DPDP Act reviews.
Read the full page →Choose on bandwidth, SLA, lead time and location. HA VPN runs over your existing internet links, delivers a 99.99% SLA with redundant tunnels, and can be live in a day; throughput per tunnel is limited, so it suits branches and backup paths. Partner Interconnect uses a service provider's existing connection to Google, starts at 50 Mbps, scales through VLAN attachments, and suits offices or plants that cannot reach a colocation facility; lead time is typically weeks. Dedicated Interconnect requires your router in a Google colocation facility, offers 10, 100 or 400 Gbps circuits, MACsec and the lowest per-GB egress, and suits data centres with sustained multi-gigabit traffic. Most Indian enterprises use Partner Interconnect in Mumbai and Delhi with HA VPN as backup.
Read the full page →Autopilot bills per second for the vCPU, memory and ephemeral storage your pods request, plus the cluster management fee. Standard bills for the Compute Engine nodes you provision, whether pods fill them or not, plus the same fee. Autopilot is usually cheaper when Standard node utilization is below about 60-70%, and more expensive only for very densely packed, well-tuned clusters.
Read the full page →Containers move easily; the work is in surrounding integrations. We inventory manifests, Helm charts, ingress annotations, storage classes, IAM bindings and cloud-specific controllers, then translate them to GKE equivalents such as Gateway API, Workload Identity Federation and Persistent Disk CSI. Workloads are redeployed via Config Sync into new clusters, data is migrated per stateful service, and traffic is shifted by DNS weights over two to four weeks.
Read the full page →Yes. Regional GKE clusters can run in Mumbai (asia-south1) or Delhi (asia-south2), and Artifact Registry repositories can be created in those regions so images and their scan metadata stay local. With the resource locations organization policy restricted to India, persistent volumes, backups from Backup for GKE and logs buckets are also pinned, supporting DPDP Act 2023 and sector-regulator data localization commitments.
Read the full page →Scanning in CI tells you an image is safe; Binary Authorization ensures only those images run. Without it, anyone with deploy rights can push an unscanned image directly to the cluster. With it, the admission controller checks for attestations signed by your pipeline's Cloud KMS key and rejects anything else, with a logged break-glass option for emergencies.
Read the full page →Combine three techniques: scheduled pre-scaling of HPA minimums before known events, custom-metric HPA on requests per pod so scaling starts earlier than CPU-based triggers, and spare capacity buffers using low-priority placeholder pods that real workloads preempt instantly. Image streaming and small images reduce pod start time, which matters as much as node provisioning speed.
Read the full page →Not by default. Gateway API covers weighted routing and canaries at the edge, Dataplane V2 handles network policy, and Workload Identity Federation handles service-to-Google authentication. Add Cloud Service Mesh when you need mutual TLS between all services for compliance, fine-grained service-to-service authorization, or consistent retries and circuit breaking across dozens of services.
Read the full page →Compare on control, billing and operations. Cloud Run is simplest: deploy a container, get an HTTPS endpoint, scale to zero, pay per request or instance time, with no Kubernetes objects to manage; it suits stateless services and jobs without sidecar-heavy or custom networking needs. GKE Autopilot gives full Kubernetes APIs, StatefulSets, operators, Gateway API and fleet GitOps, with Google running nodes and billing per pod request; it suits platforms with many services and shared policy. GKE Standard adds node-level control for GPUs, privileged agents and custom kernels, but you own node sizing, bin-packing and upgrade timing. Our default is Cloud Run for edge APIs, Autopilot for the core platform, and Standard only where a workload proves it needs node control.
Read the full page →Cloud Run bills per vCPU-second and GiB-second of memory used by instances, plus a per-request charge under request-based billing, after a monthly free tier. For services idle much of the day, it is typically 40-70% cheaper than an always-on VM because it scales to zero. For services busy around the clock, instance-based billing with committed use discounts narrows or reverses the difference, so we model both.
Read the full page →Cloud Functions became Cloud Run functions in 2024. Functions deployed from source are now built and run as Cloud Run services, so they share Cloud Run's scaling, concurrency, networking and revision management. Existing first-generation functions keep working, but we recommend moving to the current model to gain concurrency and longer timeouts, typically with small code changes for event signatures.
Read the full page →Start by containerizing the monolith unchanged and running it on Cloud Run behind the same load balancer, which proves statelessness and session handling. Then extract the busiest or most change-prone modules into separate services, moving background work onto Cloud Tasks and cron jobs onto Cloud Scheduler with Cloud Run jobs. File writes to local disk must move to Cloud Storage first, as instance filesystems are ephemeral.
Read the full page →Yes. Cloud Run, Cloud Tasks, Cloud Scheduler and Eventarc are available in Mumbai (asia-south1) and Delhi (asia-south2). Deploying services, queues and triggers in these regions, with databases and buckets pinned by organization policy, keeps processing and storage in India for DPDP Act 2023 commitments. A global load balancer in front still terminates TLS at Google's edge before forwarding to the India region.
Read the full page →Set maximum instances based on database connection limits and per-instance pool size, raise concurrency so fewer instances serve the same load, and use Cloud SQL Managed Connection Pooling or a pooler where needed. Writes that do not need to be synchronous should go through Cloud Tasks with a dispatch rate the database can sustain, so spikes queue instead of failing.
Read the full page →Pub/Sub is the messaging service; Eventarc is the routing layer that delivers events from many sources, including Cloud Storage, Cloud Audit Logs and Pub/Sub topics, to Cloud Run in CloudEvents format with filtering. Many Eventarc triggers use Pub/Sub as transport underneath. Use Eventarc when reacting to platform events; publish to Pub/Sub directly when your own services emit domain events.
Read the full page →Pick by how the code is invoked and packaged. Use Cloud Run services for anything answering HTTP or gRPC requests, especially multi-endpoint APIs and web apps where you control the container, framework and dependencies. Use Cloud Run functions when you want to deploy source code for a single event handler, such as a Pub/Sub message or a file upload, and let Google build the container; since functions now run on Cloud Run, they get the same networking, scaling and revision features. Use Cloud Run jobs when work has a start and an end, does not serve requests, and may need to fan out into parallel tasks, such as reconciliations or bulk messaging triggered by Cloud Scheduler. Most applications use all three.
Read the full page →Apigee offers subscription plans and a pay-as-you-go model. Pay-as-you-go charges for each deployed environment by the hour, for API calls by volume, and for proxy deployment units, with add-ons such as Advanced API Security charged separately. Subscriptions bundle capacity at committed levels. We usually start partner programmes on pay-as-you-go and switch when monthly call volume becomes predictable.
Read the full page →Apigee provides the controls auditors look for: mTLS and OAuth per partner, quotas, full API call analytics, masking of sensitive fields and audit logs of configuration changes. Apigee X runs in Mumbai (asia-south1), and Apigee hybrid keeps runtime traffic in your own data centre. Payment data storage requirements and RBI IT outsourcing directions still need your own governance, contracts and logging retention policies.
Read the full page →We inventory existing APIs and flows, import OpenAPI specifications or reverse-engineer them, and rebuild policies as Apigee proxies with shared flows. ESB mediation logic is split: routing and transformation move to Apigee or Application Integration, long-running orchestration to Workflows or Cloud Run, and batch exchanges to Pub/Sub. Partners migrate in waves with both endpoints live until traffic on the old one reaches zero.
Read the full page →Pub/Sub delivers messages with the same ordering key in publish order when ordering is enabled on the subscription and messages are published to the same region. Exactly-once delivery is available for pull subscriptions, preventing redelivery of acknowledged messages within the region. Push subscriptions remain at-least-once, so consumers should be idempotent using a unique event identifier.
Read the full page →Use Eventarc when you want Google Cloud events, such as Cloud Storage object changes or audit-logged API calls, delivered to Cloud Run, GKE or Workflows with filtering and no subscription code. Subscribe to Pub/Sub directly for your own domain events where you need control over acknowledgement deadlines, ordering, exactly-once delivery or BigQuery subscriptions.
Read the full page →Yes. Apigee's integrated developer portal, or a Drupal-based portal for more customisation, lets partners register, read documentation, try sandbox APIs and request access to API products. Approvals can stay manual for production products, which matters when contractual or KYC checks apply, while sandbox access is automatic. Credentials are issued per developer app, so revocation is clean and per partner.
Read the full page →Decide on audience, policy depth and operations. Apigee is built for external and partner API programmes: API products, developer portals, quotas, monetization, advanced security and analytics per partner, with Apigee hybrid where runtime residency matters. Google Cloud API Gateway is a lightweight managed gateway for serverless backends with API keys or JWT validation, suited to internal or simple public APIs with modest policy needs and low cost. A self-managed gateway such as an open-source proxy on GKE gives full control and no per-call fees, but your team owns scaling, patching, high availability and building analytics and portals. For regulated partner ecosystems in banking, mobility or healthcare, Apigee usually wins on governance; for internal APIs, Gateway API on GKE or API Gateway is enough.
Read the full page →Most of the platform controls, including IAM, Organization Policy, VPC Service Controls and Security Command Center Standard, carry no direct charge. Costs appear in Cloud KMS and Cloud HSM key versions and operations, Cloud Armor policies and requests, Security Command Center Premium or Enterprise, and Cloud Logging ingestion for Data Access logs. For a mid-size estate of 30 to 60 projects, NTSPL typically sees incremental run cost of roughly INR 40,000 to 1.5 lakh per month, dominated by logging and Cloud Armor.
Read the full page →Google Cloud gives you the controls, but compliance is your obligation as a Data Fiduciary. Organization Policy can restrict resources to asia-south1 and asia-south2, CMEK supports erasure by key destruction, Sensitive Data Protection discovers personal data, and audit logs evidence who accessed it. NTSPL maps each DPDP obligation, such as reasonable security safeguards and breach intimation, to a specific control and evidence source so your DPO can answer the Data Protection Board with facts.
Read the full page →Migrate caller by caller, then enforce. NTSPL uses the service account key usage insights and Policy Analyzer to find which keys are actually used and by what. CI systems move to Workload Identity Federation, GKE to Workload Identity Federation for GKE, and on-prem tools to federation through your IdP where possible. Unused keys are disabled for two weeks before deletion. Only after usage reaches zero do we enable the Organization Policy that blocks new key creation.
Read the full page →CERT-In's April 2022 directions require ICT system logs to be retained securely for a rolling 180 days within Indian jurisdiction and incidents to be reported within six hours of noticing them. NTSPL configures an organization-level aggregated sink to a log bucket in Mumbai with retention of 180 days or more and bucket lock, plus Security Command Center notifications so the six-hour clock starts from a real alert, not a customer complaint.
Read the full page →For most Indian consumer apps, Cloud Armor with reCAPTCHA bot management covers the bulk of the problem. reCAPTCHA scores each session, and Cloud Armor rules can allow, throttle, redirect to a challenge or deny based on that score at the load balancer. Dedicated bot vendors still help where attackers emulate full mobile app sessions, but we recommend proving the Cloud Armor baseline first because it removes a second CDN hop.
Read the full page →Start with Cloud HSM unless policy requires keys to sit outside Google. Cloud HSM keeps keys in FIPS 140-2 Level 3 validated hardware in India regions with the same API as Cloud KMS. Cloud EKM keeps keys in your own or a partner's key manager, which gives the strongest separation but makes every decrypt depend on that external system's availability and latency. NTSPL usually limits EKM to the most sensitive datasets.
Read the full page →They solve different layers, and only VPC Service Controls addresses API-level exfiltration. Identity: IAM decides whether a principal may call bigquery.tables.export; if an attacker steals that principal's token, IAM says yes. Network: VPC firewall rules and Cloud NGFW govern packets between VMs; they do not see calls to Google-managed APIs like BigQuery or Cloud Storage, which travel to Google endpoints. Context: VPC Service Controls checks where the request comes from and where data is going, so a valid token used from outside the perimeter, or a copy to a project outside it, is refused. Use IAM for least privilege, firewall rules for east-west traffic, and VPC Service Controls around every project that holds PII or financial data.
Read the full page →It charges on two main dimensions: the size of the protected resources and the backup storage consumed in vaults, which depends on change rate and retention. Cross-region vaults add network transfer. For a typical mid-size estate of 40 VMs and 6 TB of protected disks with 30-day retention, NTSPL usually sees INR 60,000 to 1.4 lakh per month, before database replica costs, which are billed as normal Cloud SQL or AlloyDB instances.
Read the full page →Run both until the first clean drill. NTSPL protects migrated workloads with Backup and DR Service from day one of cutover, keeps the on-prem tool's last full backup as a fallback for the agreed retention period, and only then decommissions it. For SQL Server or Oracle on Compute Engine, the Backup and DR appliance gives application-consistent backups with log capture comparable to on-prem tools.
Read the full page →Yes, by using only regional and cross-regional locations in asia-south1 Mumbai and asia-south2 Delhi and avoiding the asia multi-region, which includes locations outside India. NTSPL enforces this with an Organization Policy resource-location constraint so no vault, bucket or replica can be created elsewhere. This matters for RBI payment data localisation and for DPDP-sensitive datasets.
Read the full page →For databases with cross-region replicas, RPO is usually seconds to under a minute, driven by replication lag, and RTO of 15 to 30 minutes including promotion, DNS switch and application scale-out. For workloads recovered from vault backups, RPO equals your backup interval and RTO is typically two to eight hours depending on data size. NTSPL states these only after a timed drill.
Read the full page →Yes, if the vault is in a separate project and enforced retention is locked. The attacker can stop new backups or delete production, but cannot delete existing backups before their retention expires or change the locked minimum. NTSPL also alerts on backup plan changes so a disabled schedule is noticed within minutes, not at the next audit.
Read the full page →At least quarterly for Tier 1 systems, and after every major schema or topology change. NTSPL runs one full regional failover per year and smaller restore tests monthly, such as restoring a random VM backup into an isolated project. Regulators such as RBI and SEBI expect periodic DR drills with documented results, so each drill produces a timestamped report.
Read the full page →Each protects a different failure, so a serious design uses at least two. Logical corruption: Cloud SQL or AlloyDB point-in-time recovery and vault backups both let you rewind; replicas do not, because they copy the corruption within seconds. Ransomware and insider deletion: only vault backups with enforced retention in a separate project are reliably out of the attacker's reach; standard snapshots in the workload project can be deleted by its owner. Zone loss: regional disks and HA database configurations recover in minutes with zero data loss. Region loss: cross-region replicas give the lowest RTO; cross-region vault backups are cheaper but slower to restore. Choose replicas for Tier 1, vaults for everything.
Read the full page →Usually because everything is ingested and kept by default. Cloud Logging bills per GiB ingested beyond 50 GiB per project per month, and the biggest sources are typically GKE container stdout, load balancer request logs and Data Access audit logs. NTSPL routinely cuts ingestion by 40 to 70 percent with exclusion filters and sampling without losing incident visibility, because most excluded lines were successful health checks and repeated info messages.
Read the full page →No. Managed Service for Prometheus accepts the same scrape configurations through PodMonitoring resources and supports PromQL, so Grafana dashboards keep working by pointing the data source at the managed query endpoint. NTSPL runs both backends in parallel for two to four weeks, compares results for key dashboards, then retires the self-managed storage, typically freeing several nodes and an engineer's maintenance time.
Read the full page →Yes, with deliberate configuration. Log buckets can be created in asia-south1 or asia-south2, and an Organization Policy resource-location constraint plus the default storage location setting for Cloud Logging keeps new buckets in India. Because logs often contain personal data, NTSPL also redacts identifiers before ingestion, so even India-resident logs carry minimal DPDP exposure.
Read the full page →An error budget is the amount of unreliability your SLO allows; a 99.9 percent monthly SLO allows about 43 minutes of bad service. When the budget is healthy, teams ship faster; when it is exhausted, the agreed policy shifts effort to reliability work. NTSPL sets up the SLOs, dashboards and a monthly review so this becomes a product decision, not an argument between developers and operations.
Read the full page →For a typical 20 to 40 service platform, about four to six weeks. Week one covers the OpenTelemetry collector and SDK setup, then services are instrumented journey by journey, starting with the most critical. Auto-instrumentation for HTTP, gRPC and database clients covers most spans; NTSPL adds manual spans only where business steps such as payment authorisation need visibility.
Read the full page →Not if both run in parallel. NTSPL keeps legacy alerts active for two weeks while SLO burn-rate alerts are introduced, then compares which alerts led to real action. Typically 60 to 80 percent of threshold alerts are retired, while hard-failure alerts, such as certificate expiry or a stopped Pub/Sub subscriber, stay as direct alerts alongside the SLOs.
Read the full page →Decide on four criteria. Estate: if 80 percent or more of workloads run on Google Cloud, the native stack wins because load balancer, GKE and Cloud SQL telemetry arrive with no agents. Operations load: self-managed Prometheus, Thanos and Loki give full control but need an engineer to run storage and upgrades; Managed Service for Prometheus keeps PromQL and Grafana while removing the backend. Depth: third-party APMs still lead on code-level profiling for some languages and real-user monitoring, so add one only where those gaps hurt. Cost: native pricing is per GiB and per sample, while APMs often price per host, which is expensive on autoscaled GKE. Most of our clients standardize on the native stack plus Grafana.
Read the full page →About six weeks for estates of 150-1,500 servers: one week to deploy collectors, at least 30 days of collection and analysis overlapping the tail. The collection window sets the calendar, so a larger estate adds analysis effort rather than weeks.
Read the full page →A single-site estate of around 300 VMs typically needs 18-25 consultant days, driven mostly by site count and the share of physical hosts. Provider collectors carry no licence fee, and hyperscaler assessment funding can offset part of the effort where the estate qualifies.
Read the full page →Not measurably in our experience. Agentless collectors query vCenter or Hyper-V APIs and guests at low frequency from one VM on the management network. We still run network sweeps outside business hours with an agreed rollback. Collection can be paused per host within minutes if a performance concern is raised.
Read the full page →It is configuration metadata rather than customer personal data, but hostnames, accounts and IP plans are sensitive. We select an Indian geography for the discovery project where offered, restrict access to named staff and delete NTSPL working copies at closure, consistent with DPDP Act 2023 and CERT-In obligations.
Read the full page →No. Agentless collection covers most VMware and Hyper-V VMs, including dependency capture on Azure Migrate. Agents are mainly for physical servers and unsupported hosts, typically under 10 percent of the estate. Each agent install is raised as a standard change with the host owner's approval.
Read the full page →It becomes the programme's system of record: readiness work uses the OS data, the TCO model uses P95 specs and wave planning uses the move groups. We hand it over in native import format so nobody re-collects. A refresh of the inventory is advisable if migration starts more than six months after the readout.
Read the full page →An RVTools export is a good day-one snapshot of VM configuration, allocated resources and datastores. It cannot size or sequence a migration because it has no utilisation history and no network connections. Use it in week one to start pricing and spot obvious retirements, then run a provider collector for at least 30 days to get P95 performance and dependency edges. Under about 50 well-understood VMs, RVTools plus owner interviews can suffice. Above 150 VMs, skipping measured discovery usually costs more in oversizing and failed cutovers than discovery itself.
Read the full page →Up to about 120 with one lead consultant and one analyst, provided owners are available. Larger portfolios add a second interviewer rather than more weeks. Owner availability, not analysis, is usually the limiting factor. Portfolios spread across many business units benefit from a nominated coordinator per unit to book interviews.
Read the full page →Typical effort is 0.3-0.5 consultant days per application, so an 80-application portfolio runs to roughly 25-40 days. Pricing is fixed per tranche of applications, and portfolios already covered by our infrastructure discovery cost less because cards arrive pre-filled. ISV verification effort is included in the per-application rate.
Read the full page →About an hour each: a 45-minute interview and a short sign-off review. Owners of lower-criticality applications fill a guided form with a 15-minute follow-up call. Their IT counterparts spend roughly the same time again confirming server and interface details, mostly in writing.
Read the full page →Each card tags personal data, sensitive regulated data and logging needs. Applications holding RBI-, SEBI- or IRDAI-regulated data are flagged for Indian-region hosting and outsourcing-notification checks, and CERT-In log retention needs are recorded so the target design carries them. Those tags travel into the placement and security assessments.
Read the full page →The application moves to a late wave and we list options: negotiate support on a specific instance family, move to the vendor's SaaS edition, rehost on a dedicated host, or retain on-premises. The decision sits with the owner, with costs attached.
Read the full page →Yes. Cards are delivered in a spreadsheet or your ITSM tool's CMDB application class, with review dates, so the register becomes the portfolio record rather than a one-off report. After handover, ownership of the register usually sits with the IT portfolio or architecture lead.
Read the full page →Application assessment comes first when the goal is to migrate. It answers operational questions for every application: owner, servers, interfaces, downtime window, vendor support and migration complexity, so waves can be scheduled. A modernization assessment answers an investment question: which applications are worth re-architecting, retiring or replacing, scored on business value against effort. Many portfolios need both, but in that order: profiling 80 applications takes about five weeks and feeds the modernization screen with data it would otherwise have to collect again. If no migration is planned and the question is purely where to invest, start with modernization screening.
Read the full page →Four weeks for most mid-sized organisations: one week of evidence collection, two weeks of workshops and scoring, and a week to build the backlog and date model. A 30-day re-score follows to check remediation progress. Organisations with several legal entities may need a fifth week.
Read the full page →Typically 15-22 consultant days, depending on how many clouds and legal entities are in scope. Single-cloud, single-entity reviews sit at the lower end. The re-score is included, and the backlog can be executed by NTSPL or your own team. Most evidence is reviewed remotely, so multi-site travel is rarely needed.
Read the full page →Board-approved IT outsourcing policy covering cloud, a risk assessment of the provider, contractual audit and inspection rights, data stored and processed in line with RBI directions, and exit planning, as set out in RBI's 2023 Master Direction on Outsourcing of IT Services. We test each of these as a gate.
Read the full page →No. The assessment decides whether to adopt a reference landing zone or build a bespoke one and sizes the effort. If shadow accounts or subscriptions already exist, we review them read-only and fold findings into the scorecard. Findings from shadow tenancies often become the first critical gates.
Read the full page →Yes, if only non-critical gates are red and each has a dated owner. The 14 critical gates, covering privileged MFA, logging, backup, network path, budget ownership and regulatory approval, must be green first. Each non-critical red gate stays in the backlog with a date until it closes.
Read the full page →No. Gates are provider-neutral and mapped to AWS, Microsoft and Google adoption frameworks. Where a choice of cloud is still open, readiness scores often differ by provider because of existing identity or skills, and we report that difference. Readiness is then scored separately for each candidate provider.
Read the full page →A Well-Architected review examines a workload, or a designed architecture, against pillars such as reliability, security and cost. A readiness assessment examines the organisation's foundations before any workload moves: identity, connectivity, landing zone, operations, skills, budget ownership and regulatory approvals. Readiness comes first because a perfectly designed workload still cannot go live without MFA, a network path and an approved outsourcing policy. Once foundations pass, run Well-Architected reviews on each major workload during design. If you already have production workloads in cloud and want to know whether they are built well, a Well-Architected review is the right tool.
Read the full page →Four weeks for up to about 300 workloads, provided discovery or application data already exists. Without it, add discovery first. One full business week is reserved for latency probes so placement uses measured, not published, round-trip times. Results remain valid until a major contract, regulatory or business change.
Read the full page →Usually 14-20 consultant days. The largest variables are the number of sites to probe and how many licence agreements need analysis. Costing three providers rather than two adds two to three days. Probe devices are shipped to sites pre-configured and returned at the end.
Read the full page →Payment system data must be stored only in India under RBI's 2018 directive, and many RBI, SEBI and IRDAI-regulated workloads are expected to stay in Indian regions. Under the DPDP Act 2023, cross-border transfer is permitted except to countries the government restricts, but contracts may be stricter. We treat each as a hard constraint where it applies.
Read the full page →Yes, and often it should: latency-bound plant systems, hardware-locked applications or workloads close to retirement. Each retained workload gets a review date and, where useful, Arc or equivalent management so it is governed alongside cloud. Retained workloads stay in the matrix so nothing silently drops out of scope.
Read the full page →We model them separately. Credits usually cover year one only, so a three-year comparison shows whether they change the answer or just the first invoice. Credits that require long commitments are also tested against the full three-year horizon.
Read the full page →Yes. We publish the constraints, weights and thresholds as a short standard, so new workloads are placed in a 30-minute review rather than a new study. The review checks hard constraints first and only scores the exceptions.
Read the full page →Run on one primary cloud unless a specific workload has a measurable reason to go elsewhere. A single platform keeps one landing zone, one security baseline, one skills track and one commitment discount. Splitting is justified when licence economics differ by more than about 20 percent, when a needed service has no equivalent, or when a client or regulator demands it. In our placement studies, the typical outcome for an Indian mid-market estate is 75-90 percent on one provider, a handful of exceptions on a second, and site-bound systems at the edge. Choosing multi-cloud as a principle rather than per workload usually raises run cost.
Read the full page →About five weeks if discovery data exists, eight if utilisation must be collected first. The pace is usually set by how quickly finance can provide invoices and contracts, not by the modelling. A first indicative range is usually available by week three for early budgeting.
Read the full page →Typically 15-25 consultant days. Provider TCO tools are free, and NTSPL applies for hyperscaler assessment funding where the estate qualifies, which can offset part of the effort. The model is handed over as a live spreadsheet owned by your finance team.
Read the full page →Cloud services from Indian billing entities attract GST, usually recoverable as input tax credit for registered businesses. We model costs net of recoverable GST, and show gross figures separately where credit is restricted. Where cloud is bought through a reseller, the invoicing entity and GST terms are checked against the contract.
Read the full page →Yes. Many cloud prices track USD even when invoiced in INR, while AMC and power are rupee costs. Sensitivity shows the effect of a 5 and 10 percent rupee depreciation on five-year NPV. Exposure is shown separately for compute, storage and support so finance can judge which lines matter most.
Read the full page →Yes. Recovery tiers from the Backup and DR assessment are priced on both sides, because a DR site is often a large on-premises cost that cloud replaces with pilot-light or warm-standby patterns. In the models we build, DR typically represents 12-25 percent of cloud run cost.
Read the full page →It becomes the baseline for tracking. We hand over a version with an actuals column so finance can compare monthly cloud spend with the model and spot drift early. A quarterly re-forecast against actuals keeps the commitment purchase plan aligned with real usage.
Read the full page →Sometimes, and the honest answer depends on three numbers: how much of your allocated capacity is actually used, whether a refresh or facility contract falls inside the next five years, and how much licence value carries over. Estates with P95 CPU under 25 percent and a near-term refresh usually show cloud 20-35 percent cheaper over five years. Estates that are already consolidated, recently refreshed and run steady 24x7 loads can be cheaper on-premises on pure infrastructure cost, and the case then rests on agility, DR or exit from a facility. A good TCO shows you which side of that line you are on.
Read the full page →Five weeks for most regulated mid-sized organisations. Evidence collection takes two weeks and depends on how quickly firewall, identity and SIEM owners respond; mapping and rating take the remaining three. Where several regulated entities share infrastructure, each entity's obligations are mapped separately.
Read the full page →Typically 18-28 consultant days, driven by the number of regulators involved and workload tiers. A single-regulator NBFC sits at the lower end; a group with banking and insurance entities at the upper end. Provider attestations from official compliance portals are collected at no extra cost.
Read the full page →RBI's IT governance and IT outsourcing master directions, SEBI's Cybersecurity and Cyber Resilience Framework, IRDAI's information and cyber security guidelines, CERT-In's 2022 directions and the DPDP Act 2023, applied according to your licence category. Each applicable clause is linked to a named target control and the evidence an inspector would request.
Read the full page →Partly. Provider certifications cover physical and infrastructure controls, but identity, configuration, data protection, logging and outsourcing governance remain yours. The shared responsibility matrix shows exactly which evidence you still produce. Regulated entities also remain accountable for outsourced services under their regulators' directions.
Read the full page →All three major providers offer Indian regions and broad certifications. The assessment shows which target controls are easier to evidence on each, which can inform placement, but rarely decides it alone. In practice, residency of regulated data in Indian regions is the deciding constraint more often than certifications.
Read the full page →It becomes the control baseline for posture monitoring. Each mandatory control is written as a policy that can be checked continuously once workloads are live. Posture tooling can then report against the same controls the regulator will test.
Read the full page →If workloads have not moved yet, you need the pre-migration assessment. It looks at today's on-premises controls and regulators' expectations, and designs what must exist in the target before anything lands, so the landing zone is built compliant. A posture review examines live cloud accounts, subscriptions or projects for misconfiguration, exposed resources and IAM sprawl, usually with CSPM tooling. Organisations already partly in cloud often need both: posture review for what is live, pre-migration assessment for the next waves. Running only a posture review after migrating regulated workloads tends to find gaps once they are already inspection findings.
Read the full page →Four weeks for up to about 150 workloads, mostly spent in owner interviews. It runs well in parallel with application assessment because the same owners are involved. Owners see the cost of each tier before signing, which keeps Tier 0 requests realistic.
Read the full page →Typically 12-18 consultant days. The cost of the DR designs it produces varies far more, which is why tiering with prices shown to owners usually saves many times the assessment fee. The largest savings usually come from moving low-impact systems off warm standby.
Read the full page →Usually not for regulated or personal data. RBI, SEBI and IRDAI expectations and many customer contracts point to in-country recovery, and every major provider now offers two Indian regions. We record any cross-border recovery as an exception needing compliance approval.
Read the full page →Tier 0 and Tier 1 data gets immutable, vault-locked copies isolated from workload administrators, and the drill plan includes a clean-room restore test, not only a regional failover. Restore points are verified as clean before data is returned to production.
Read the full page →Sometimes. If your current backup product supports the target cloud and your team knows it well, it can be retained; otherwise native services reduce licence and agent overhead. We compare both per tier. Agent counts, licence terms and support for immutable cloud storage decide the comparison.
Read the full page →Within 90 days of a workload's go-live for Tier 0 and Tier 1, then on a fixed schedule per tier, with results reported to the risk committee. A failed drill reopens the tier design rather than being recorded as an exception.
Read the full page →Choose by RTO and cost. Pilot light keeps data replicated and core components ready but compute off, so recovery takes hours as servers start and scale; it suits RTOs of 4-24 hours at a fraction of production cost. Warm standby runs a scaled-down copy continuously, giving RTOs under one to two hours, at roughly 25-40 percent of production compute cost. If the business can tolerate a half-day outage, pilot light is the rational choice. If an hour of downtime costs more than a month of standby compute, warm standby pays for itself. Active-active is only for the few workloads where minutes matter.
Read the full page →About four weeks for up to 100 instances. Two weeks of performance capture across a month-end drive the timeline. Larger estates add analysts rather than weeks, as long as read-only access is granted promptly. Instances that cannot grant access are assessed from DBA-supplied metadata instead.
Read the full page →Typically 12-20 consultant days depending on instance count and engine mix. Oracle licence analysis adds effort because entitlements usually need reconciling with contracts and support renewals. The register and licence model are handed over for procurement to use in renewal negotiations.
Read the full page →Databases holding personal data are flagged so the target design includes encryption, access logging and an Indian-region location where required, and so test copies are masked before they move. The register records personal data per instance. CERT-In log retention needs are recorded for database audit logs as well.
Read the full page →Sometimes, but it raises risk. The assessment flags candidates with conversion coverage and ownership evidence; many organisations migrate first on the same engine, then change engine as a separate project. Engine change is safest when conversion coverage is high and the application is owned in-house.
Read the full page →SQL Server 2012 and 2014 instances usually need an in-place or side-by-side upgrade during migration. We estimate compatibility-level changes and test effort per instance. ISV applications may also need certification against the newer version, which the vendor must confirm in writing.
Read the full page →Yes. File-based databases behind business processes are inventoried with their owners, and each gets a target, often conversion to a managed database or retirement. Finance teams are often surprised how many month-end processes depend on these files.
Read the full page →Default to a managed service, Azure SQL Managed Instance, Amazon RDS for SQL Server or Cloud SQL for SQL Server, unless the assessment finds a reason not to. Managed services remove patching, backup and HA engineering, and in our assessments 60-80 percent of SQL Server instances qualify with little or no change. Keep a database on VMs when it relies on OS access, unsupported features such as certain CLR or file-system calls, third-party agents, or an ISV that certifies only specific OS builds. For a few very large or very latency-sensitive databases, VMs give more control over storage layout. Decide per instance, not per estate.
Read the full page →Four weeks for most organisations: one week to set up flow export and probes, two weeks of measurement, and a week for modelling and costing. Sites without flow export may need temporary collectors, which we ship pre-configured. Results also feed the placement and readiness assessments.
Read the full page →Typically 10-16 consultant days plus any temporary collector hardware. Site count drives the effort more than bandwidth, so organisations with many branches sit toward the upper end. Carrier quotes are gathered for shortlisted options so costs reflect current Indian pricing.
Read the full page →All three providers offer dedicated or partner connectivity at locations in major Indian metros, with Mumbai and Chennai most common. We confirm current locations and partner carriers per provider before recommending a link. Partner interconnects through Indian carriers suit sites far from those metros.
Read the full page →Yes, often through SD-WAN with direct cloud on-ramps, which removes hairpinning through the data centre. We test whether security inspection requirements allow it before recommending it. SD-WAN cloud on-ramps also make adding a second cloud simpler later.
Read the full page →We use 60-70 percent of link capacity, not line rate. At that utilisation, 10 TB over 1 Gbps takes over 30 hours, so large datasets are pre-seeded by replication with only deltas moved at cutover. Delta transfer windows are rehearsed before the cutover weekend.
Read the full page →Dedicated links are private but not encrypted by default. Regulated entities often require encryption, using IPsec over the link or provider MACsec options where available. We confirm the requirement with security first. Any encryption overhead is included in bandwidth sizing.
Read the full page →A VPN is enough when sustained traffic is a few hundred Mbps, applications are web-based and some latency variation is acceptable; it is quick to set up and cheap. A dedicated or partner link is worth it when sustained traffic is higher, chatty or real-time applications move, egress volumes are large, or the business needs predictable latency and an SLA-backed path. In Indian mid-market estates we often see VPN for early waves and dedicated links ordered for the ERP or plant wave. Measured traffic, not vendor preference, should decide, and the dedicated link's 6-12 week lead time must be planned.
Read the full page →Six weeks for 100-250 applications. Code scanning and owner surveys run in parallel, and the pace is mostly set by owner response rates. Portfolios near 500 applications take eight to ten weeks. Code scanning effort grows with repository count more than with lines of code.
Read the full page →Typically 0.2-0.3 consultant days per application, plus licences for any third-party scanning tool. A 150-application portfolio usually needs 30-45 days of effort in total. Retirements identified usually cover the fee within the first year of savings.
Read the full page →It improves accuracy but is not mandatory. Scans run inside your environment so code does not leave it. Where source is unavailable, we score effort from vendor information, binaries and integrations. Scan results stay with you, and only summary metrics enter the report.
Read the full page →SaaS options are checked for Indian data residency, DPDP Act 2023 obligations and sector rules such as RBI outsourcing requirements. Government bodies also check procurement routes such as GeM. Options that fail are removed before scoring. This stops non-viable SaaS options from distorting the quadrant.
Read the full page →No. It is a portfolio decision that sets direction. Refactor and replatform choices are confirmed in deep assessments, and the portfolio is re-scored annually as business priorities change. Re-scoring takes about a third of the original effort because the data model already exists.
Read the full page →Dispositions feed migration planning: retire candidates are removed before migration, rehost candidates move first, and refactor candidates may be migrated as-is then modernized, or held until rebuilt. Retire candidates are removed before wave planning so they are never migrated at all.
Read the full page →Start with portfolio screening if you have more than about 30 applications and have not yet decided where to invest. It looks at every application at moderate depth and tells you which to retire, replace, rehost, replatform or refactor. A deep assessment examines one to five chosen applications in detail: code, coupling, data model, target architecture and a backlog with effort. Screening without deep assessment leaves refactor estimates too rough to fund; a deep assessment without screening risks modernizing the wrong application. If leadership has already chosen the application, for strategic or regulatory reasons, go straight to the deep assessment.
Read the full page →About six weeks. The Readiness Check and contract gathering take the first two to three weeks; costing, scoring and the board recommendation take the rest. Multi-instance groups may need eight weeks. Running SAP Readiness Check needs a few days of Basis effort to apply notes and collect data.
Read the full page →Typically 20-30 consultant days, depending on the number of SAP instances and whether a RISE proposal needs detailed comparison. It is a fraction of the cost difference between options, which often runs into crores over five years. Normalising quotes from SAP and hyperscaler partners to the same scope is included in the fee.
Read the full page →SAP mainstream maintenance for ECC 6.0 enhancement packages 6-8 ends on 31 December 2027. Optional extended maintenance runs to the end of 2030 at an additional fee, after which customer-specific maintenance applies. Those fees belong in any stay option's five-year cost.
Read the full page →Hyperscaler IaaS options can run entirely in Indian regions. For RISE, data location depends on the hosting region in the contract, so we check it alongside DPDP Act 2023 and any sector requirements before recommending. Contract terms on data location, exit and data return are reviewed with legal.
Read the full page →We work with all three hyperscalers and the scoring is designed to be option-neutral. Every assumption is documented so your finance team can verify that the recommendation follows from the numbers. Any option-specific partner incentives are disclosed in the report.
Read the full page →A technical readiness assessment for the chosen option: SAPS and HANA memory sizing, OS and database versions, Unicode, interfaces and add-ons, leading to a migration plan. For RISE, SAP's own onboarding activities start at this point.
Read the full page →Choose RISE with SAP when you want a single subscription covering software, infrastructure and SAP technical operations, have limited Basis skills and accept less flexibility in sizing, partners and exit. Choose S/4HANA on hyperscaler IaaS when you want control over infrastructure, timing, DR design and support partners, and have or can contract Basis capability. Cost comparisons must use identical scope: RISE quotes include technical managed services, upgrades and some tooling that IaaS quotes often omit, while IaaS lets you apply existing commitments and right-size more aggressively. For many Indian mid-sized SAP customers, the decision turns on skills and control rather than headline price.
Read the full page →Five weeks for most organisations. Interviews and the skills survey take two to three weeks; scoring, design and roadmap take the rest. Large groups with several IT functions may need seven weeks. A re-score after six months is included to measure progress.
Read the full page →Typically 15-24 consultant days, depending on interview count and the number of vendors involved. Smaller organisations with one MSP and a single cloud sit at the lower end. Organisations running several clouds and MSPs sit at the upper end.
Read the full page →Yes. For regulated entities, roles required by RBI, SEBI or IRDAI governance and outsourcing directions, such as oversight of outsourced IT and incident reporting to CERT-In within 6 hours, are included in the RACI and decision rights. Reporting lines to the board or its IT committee are mapped too.
Read the full page →It recommends roles and skills, and whether to build, hire or contract them. Headcount decisions stay with management and HR, but we show the cost of each option. Contracting a role is often cheaper for niche skills such as FinOps or Basis.
Read the full page →Readiness checks whether foundations such as identity, network and landing zone are in place to start migrating. The operating model assessment designs how the organisation runs cloud long term: structure, roles, skills and processes. Many organisations run readiness first and the operating model assessment second.
Read the full page →Yes, and it should. MSP staff are interviewed, their contract is reviewed and the target RACI is agreed with them, so changes can be reflected at renewal. Their commitment to the RACI matters more than the document itself.
Read the full page →An MSP is enough for operating tasks, monitoring, patching, backup and first-response incidents, but not for decisions. Someone inside your organisation must own architecture standards, security policy, cost and vendor accountability. For small IT teams, that can be a virtual CCoE of two or three people spending part of their time, working with the MSP. Mid-sized organisations usually need a dedicated team of three to six. Relying entirely on an MSP tends to produce good operations but drift in standards and cost, because the MSP is not accountable for business outcomes.
Read the full page →Start with the question that blocks a decision. If you lack reliable estate data, begin with infrastructure discovery, because placement, TCO and DR tiering all depend on it. If a refresh or contract deadline is driving the programme, run discovery and TCO together. Regulated entities should add the security and compliance assessment before committing wave dates.
Read the full page →Yes, and they usually should. Discovery runs for 30 days in the background while application, DR and security interviews proceed, so a combined programme covering five or six assessments typically completes in eight to ten weeks rather than the sum of their individual durations.
Read the full page →No. Each assessment is provider-neutral and maps findings to AWS, Azure and Google Cloud. Where a provider has already been chosen, we use its native tooling and region pricing; where it has not, the workload placement assessment compares them with explicit criteria.
Read the full page →Each assessment applies the rules relevant to its question: data residency and DPDP Act 2023 duties in placement and database work, RBI, SEBI and IRDAI outsourcing and governance directions in security and readiness, CERT-In's 6-hour reporting and 180-day log retention in security and network design.
Read the full page →An assessment decides and produces documents, registers and models; it changes nothing in production. Migration builds landing zones and moves workloads. Keeping them separate means the decision is made on evidence before build contracts and commitments are signed.
Read the full page →Often. AWS, Microsoft and Google run programmes that fund parts of migration assessments for qualifying estates. NTSPL checks eligibility at the start and handles the application, but the scope and findings remain independent of any funding source.
Read the full page →For 100-300 servers, plan 20-30 weeks from walk-down to cage surrender. Six weeks go to inventory, contracts, landing zone and link; production waves then run fortnightly. Contract notice periods and change freezes set the length as much as server count does.
Read the full page →Migration services for a 150-server exit typically land between INR 45 lakh and 1.2 crore, depending on database complexity and weekend cutover hours. Add 3-4 months of double running and the interim link, which we report weekly so the CFO sees it shrink as racks go dark.
Read the full page →Indian regions keep data in-country, but the obligations concern controls, not just location. We set 180-day in-country log retention for CERT-In, configure alerting that supports the 6-hour reporting window, and hand over a map of personal data stores and processors that your DPDP accountability records can reference.
Read the full page →Tapes holding records you must keep, such as eight years of accounting books under the Companies Act, are restored and verified into a cloud archive tier before the tape drive leaves the cage. Tapes past retention are degaussed or shredded, with a certificate for each barcode.
Read the full page →Yes, with a clear reason such as a plant system needing sub-10 ms response or hardware that cannot be virtualised. Retained items go into a small edge cabinet with its own UPS and owner, costed separately so the business sees its real annual cost.
Read the full page →NTSPL coordinates it. Disks are wiped to NIST SP 800-88 or shredded, leased equipment is returned against serial lists, and owned hardware goes to an authorised e-waste recycler. You get a certificate pack mapping each serial to its disposal method.
Read the full page →Move colo only if most servers are under three years old, you have staff to run hardware, and load is steady all year; then a colo move is cheaper in year one. If hardware is older than four years, a storage refresh is due, or you run fewer than 300 servers, cloud usually wins within 24-30 months because you skip refresh capex, AMCs and a second DR site. A colo-to-colo move also repeats the physical move risk with no lasting change in how you operate.
Read the full page →For 100-250 VMs across three or four clusters, expect 12-16 weeks: two weeks of inventory and pre-flight, two of remediation, a pilot cluster, then one production cluster every one to two weeks. Guest remediation, not replication, is usually what decides the pace.
Read the full page →Native conversion services typically run INR 8,000-20,000 per VM depending on remediation needs, application testing and weekend cutovers. Hosted VMware has lower migration effort per VM but higher monthly cost because you pay for dedicated hosts. We price both tracks per cluster so you can compare.
Read the full page →Yes, through Azure VMware Solution, Google Cloud VMware Engine or a VMware service on AWS, which run vSphere on dedicated cloud hosts. You keep vCenter workflows, but you still carry VMware licensing in some form, so we treat it as a bridge rather than a permanent home.
Read the full page →Extended Security Updates for Windows Server 2012 and 2012 R2 ended on 13 October 2026, so those guests should be upgraded or rebuilt on Windows Server 2022 or 2025 before or during migration. We test the application on the new OS in a clone before the production wave.
Read the full page →Yes. AWS Application Migration Service works into Mumbai and Hyderabad, Azure Migrate into Central India, South India and West India, and Migrate to Virtual Machines into Mumbai and Delhi. Replication traffic stays in India when the source is in India, which simplifies DPDP Act 2023 data mapping.
Read the full page →Once a cluster is empty and the 7-day rollback window passes, hosts are removed, licences are reclaimed and support renewals are stopped. Hosts in good condition can be reused for edge or test, otherwise they go through wipe and disposal with certificates.
Read the full page →Choose native VMs for most estates under 300 VMs. You drop VMware licensing entirely, pay per instance, and can right-size each VM, which usually brings 25-40% lower run cost than hosted VMware. Choose a hosted VMware service only when NSX-dependent apps, vSphere-only appliances or a deadline under three months make conversion too risky, and treat it as a 12-24 month bridge with a conversion plan. Hosted VMware is billed per dedicated host, so small clusters pay for unused capacity, and you still need VMware skills on staff.
Read the full page →Physical servers can be migrated. Agent-based tools on AWS and Azure replicate physical Windows and Linux servers at block level, and on Google Cloud they usually go through image import or a staging VM. We check each OS against the tool's support list first.
Read the full page →Usually 15-60 minutes per workload: the time for a final sync, a DNS or IP switch and the owner's functional check. Large databases or apps with long shutdown routines take longer, and the window is recorded on each workload card.
Read the full page →Services typically run INR 10,000-25,000 per server, depending on testing depth, weekend work and how many licences need vendor rehosting. Rebuilds cost more per server but are often cheaper over three years because they avoid carrying drift. Native rehost tools add little or no licence cost.
Read the full page →For most firms, AWS Mumbai or Hyderabad, Azure Central India or South India, or Google Cloud Mumbai or Delhi. For DPDP Act 2023 obligations, we record which servers hold personal data, and we enable logging with 180-day retention for CERT-In from launch.
Read the full page →Usually yes, and that is fine for apps using DNS names. For apps with hard-coded IPs, we either change the config during cutover or move a whole subnet at once. We scan configs for IPs while building each workload card.
Read the full page →They stay powered off for 7-14 days as a rollback option. After the workload owner confirms in writing that nothing is missing, disks are wiped with certificates and the hardware is reused for test, sold, or sent for authorised e-waste disposal.
Read the full page →Rehost when the server is stateful, poorly documented or tied to vendor software you cannot reinstall easily; it is faster and lower risk. Rebuild when the server is stateless, runs an out-of-support OS, or you already have install scripts, because a rebuild gives you a clean, patchable image and removes years of drift. A practical split in mid-size estates is 70-80% rehost and 20-30% rebuild. Do not rebuild a server just because rebuilding feels cleaner if nobody can explain how it was configured in the first place.
Read the full page →With CDC or log-based replication, cutover is usually 5-30 minutes: stop writes, let replication drain, validate, and repoint the app. Without continuous replication, downtime equals backup, copy and restore time, which for a 1 TB database can be several hours.
Read the full page →A single 500 GB to 2 TB database with standard features typically costs INR 3-8 lakh in services, including rehearsal and two weeks of tuning. Databases with many jobs, links or custom objects cost more. Native migration services are free or low cost; the target database is the main run cost.
Read the full page →Yes, when the target runs in Indian regions and you meet the regulator's controls on encryption, access, audit logs and outsourcing. For SEBI-regulated entities, map the move to the Cybersecurity and Cyber Resilience Framework. We set audit logging with 180-day retention for CERT-In.
Read the full page →No, as long as the engine stays the same. Procedures, functions and triggers move as-is. You may need to adjust features the managed service does not support, such as some CLR assemblies or OS file access, which the feature scan finds early.
Read the full page →We compare row counts and table-level checksums between source and target before switching, then the application owner runs 20-50 business queries such as month-to-date totals, open orders and ledger balances. The validation report is signed by both the DBA and the owner before cutover is approved.
Read the full page →Usually yes, one major version at a time. We keep the old compatibility level at first and raise it after two weeks of stable running. MySQL 5.7 to 8.x needs a scan for collation and reserved-word issues before the move.
Read the full page →Choose Managed Instance when the database uses SQL Agent, cross-database queries or linked servers but nothing that needs OS access; you get near-full SQL Server compatibility with patching, backups and HA handled. Choose SQL Server on a VM when the vendor requires sysadmin, a specific build, SSRS or SSIS on the same box, or file-system access. Managed Instance usually costs more per vCore but less in DBA effort. For most mid-size ERPs and line-of-business apps, Managed Instance is the default unless the vendor's support statement says otherwise.
Read the full page →Not to business logic. We change configuration, swap session and storage providers through framework settings, and package the existing build. If a fix needs code changes, such as removing file locking across instances, we flag it and move the app to refactoring instead.
Read the full page →Typically 4-6 weeks for a standard Java, .NET or PHP web app, including load testing and cutover. Apps with many scheduled jobs or native libraries take longer. Several apps can run in parallel once the first has set the pattern.
Read the full page →For a single web app with a database, services usually range from INR 4-10 lakh. Run cost is often lower than VMs because instances scale down off-peak and OS licences are included in the platform price. We compare against the rehost run cost in the plan.
Read the full page →Yes. .NET Framework 4.x apps on IIS can run on Azure App Service for Windows or in Windows containers. Moving to modern .NET is a code change and belongs in refactoring or modernization. We check COM components, GAC assemblies and registry use first, since those decide between App Service and Windows containers.
Read the full page →Yes. App Service and Container Apps run in Central India, Elastic Beanstalk and ECS run in Mumbai and Hyderabad, and Cloud Run runs in Mumbai and Delhi. Keeping the runtime, cache and database in the same Indian region keeps latency low and simplifies DPDP Act 2023 records.
Read the full page →Your team keeps ownership of the code. The platform handles OS and runtime patching for app-service targets; for containers, base images still need updating, which the pipeline can automate. We hand over the pipeline, runbooks and alerts. Your team can run the first two releases with us before taking over alone.
Read the full page →Rehost when you have hundreds of servers to move by a deadline, the app is due for retirement within two years, or the vendor supports it only on a VM. Replatform when the app is in-house or open-stack, will live five years or more, and passes the blocker scan with config-only fixes. Replatforming typically adds 3-5 weeks per app but removes OS patching, enables autoscaling and gives a deployment pipeline. For a mid-size estate, replatforming the 10-20% of apps with the highest change rate is usually the best use of the effort.
Read the full page →Refactoring changes specific code paths so the app works in cloud while keeping its behaviour and structure. Rewriting rebuilds the app, often in a new design. Our refactors are bounded by a signed change list of 5-15 items, usually under 15% of the codebase.
Read the full page →Usually 8-12 weeks for one application, including test creation, two or three sprints and cutover. Runtime upgrades such as Java 8 to 17 add 2-4 weeks. We estimate per change item and report weekly against the list. Most clients see the first refactored module running in cloud by week five.
Read the full page →For a mid-size line-of-business app, expect INR 10-30 lakh depending on the number of change items and whether a runtime upgrade is included. The change list gives a fixed scope, so most engagements are priced per item rather than open-ended time and materials.
Read the full page →We need the source and build scripts, and ideally one of your developers for reviews and knowledge transfer. Refactored code is committed to your repository, and your lead developer approves each merge so the team can maintain it afterwards. We also leave a short design note per change item.
Read the full page →It can. Moving documents from shared folders to object storage with access policies, and replacing stored credentials with workload identities, makes it easier to show who can access personal data. We add structured audit logs in Indian regions with 180-day retention for CERT-In.
Read the full page →We log them with an estimate and impact. Items that block migration are raised to the steering group for a scope decision; everything else goes into a modernization backlog so the migration date is protected. You see the backlog grow each week, so nothing is hidden.
Read the full page →Refactor during migration when the app cannot run reliably on cloud without the change, such as shared file locks, local queues or an out-of-support runtime. Doing it later means paying to host a fragile app on VMs and moving it twice. Migrate first and modernize later when the app runs acceptably on a VM, the deadline is tight, or the needed changes are design-level rather than a bounded list. A good test: if the change list fits in 10 weeks with two developers, do it now; if not, rehost and plan a proper modernization.
Read the full page →For an estate of 50-150 workloads, expect 16-20 weeks. The first seven weeks build the service map and target foundation, then groups move with short dual-run windows. Estates heavy in serverless or NoSQL take longer because those parts are rebuilt rather than copied.
Read the full page →Possibly not. AWS, Azure and Google Cloud each offer egress waivers for customers moving data out, subject to conditions and a request to the provider. We check eligibility early and request the waiver before bulk transfer starts, then track any residual charges.
Read the full page →Services usually range from INR 25 lakh to 1.5 crore depending on workload count and how much must be rebuilt. Add the dual-run period and inter-cloud link. We show the payback period against the target provider's commercial offer before you commit.
Read the full page →Partly. The structure, naming and tagging scheme can be kept, but provider resources and modules must be rewritten. Expect 60-80% of module code to change. Pipelines and policy-as-code rules also need target versions. Existing tests and module boundaries speed up the rewrite.
Read the full page →Data must stay in Indian regions throughout, including during transfer and dual run. We map source regions to target regions, such as AWS Mumbai to Azure Central India, keep 180-day logs for CERT-In on both sides, and update DPDP Act 2023 processor records to name the new provider.
Read the full page →Backups you must keep for legal or regulatory reasons are either copied to the target with their retention settings or kept in a locked, minimal source account until retention expires. Everything else is deleted when the account is closed, with a record of what was removed.
Read the full page →Switch fully when the commercial case is strong, the estate is mostly VMs, containers and standard databases, and you want one set of tools and skills. Run multi-cloud only when there is a lasting reason, such as a specific AI or analytics service, a regulator or customer requirement, or an acquired business that will stay separate. Multi-cloud by accident, with two half-used landing zones, is the most expensive outcome. If you go multi-cloud, assign each workload a home cloud and avoid cross-cloud calls in transaction paths.
Read the full page →Not if you use a DFS namespace, because only the target behind the namespace changes. Without DFS, we update drive mappings through group policy at cutover. Users usually see the same letter and folder structure on the next login. We test this with a pilot group first.
Read the full page →For 20-100 TB, plan 6-9 weeks: two weeks of profiling and setup, three to four weeks of initial copy, then delta passes and cutover. A 1 Gbps link moves about 8-9 TB a day at full use, but business-hour throttling usually halves that.
Read the full page →Services for a 50 TB estate typically run INR 6-15 lakh, depending on permission clean-up and branch caching. Transfer services are low cost or free. Moving cold data to archive tiers often cuts monthly storage cost by half compared with keeping everything on primary storage.
Read the full page →Transfer tools copy NTFS ACLs, owners and timestamps when the target is joined to the same identity source. We review permissions first, fix broken SIDs, and test access with a pilot group a week before cutover so issues are found early.
Read the full page →Records such as GST invoices or customs documents go to object storage with retention locks matching your legal retention period. They cannot be deleted early, even by admins. Data stays in Indian regions, and access logs are kept 180 days for CERT-In.
Read the full page →It stays read-only for two to four weeks after cutover as a fallback. Once owners confirm nothing is missing, it is wiped to NIST SP 800-88 or physically destroyed, with a certificate, and its support contract is ended. Its rack space and power are freed.
Read the full page →Choose Azure Files with File Sync for Windows-centric estates with branches on slow links, standard SMB use and moderate performance needs; it is simple and cloud tiering keeps local caches small. Choose a NetApp-based service, such as Azure NetApp Files, FSx for NetApp ONTAP or Google Cloud NetApp Volumes, when the source is already NetApp, when you need NFS and SMB on the same data, or when workloads need sub-millisecond latency and high throughput, such as CAD rendering. NetApp services cost more per TB but migrate NetApp sources with SnapMirror and preserve snapshots.
Read the full page →A trained squad of six to eight people typically moves 25-40 standard servers a week once templates are tuned. Programmes with two or three squads reach 60-120 a week. Velocity is usually limited by app owner readiness and testing, not by tools.
Read the full page →Three to four weeks to load the backlog, agree the intake gate, build templates and staff squads, followed by two or three pilot waves. Full velocity is usually reached between weeks 8 and 12. Existing programmes can switch to the factory model mid-flight.
Read the full page →Factories are usually priced per server or per squad-month. Per-server rates for standard rehost work often fall to INR 8,000-15,000 at volume, lower than one-off projects. Complex workloads are priced separately. We show the cost-per-server trend in the weekly report.
Read the full page →Yes. Squads can mix internal staff and partner engineers, using one backlog, one intake gate and one calendar. We recommend the wave lead role sits with one accountable party, and that all squads use the same templates and reporting. Shared metrics make each party's throughput visible.
Read the full page →The wave calendar marks quarter-end and year-end closes, GST return dates, festive peaks such as Diwali, and plant shutdowns. Regulated entities also block periods around RBI, SEBI or IRDAI submissions. Waves are not scheduled in frozen windows. Plant shutdowns can also become migration windows.
Read the full page →The tail is the 10-20% of workloads that are hard to move, such as unsupported OS versions, vendor-locked apps or large databases. We start a separate tail plan by month three with specialists, so it runs alongside the factory instead of after it.
Read the full page →Use a factory when you have more than about 150 servers or 40 applications and a target date within 18 months. The upfront effort of intake gates, templates and squads, usually three to four weeks, pays back once waves run on cadence, cutting per-server effort by 30-50%. Use project-by-project migration for smaller estates or when applications are so different that templates cannot be reused, such as a few large ERP and mainframe moves. Many programmes combine both: a factory for standard rehost workloads, and separate projects for the five or six complex systems.
Read the full page →Six to seven weeks for a typical enterprise, from design workshop to handover. A minimal migration-ready zone can be ready in three to four weeks if the design is simple and on-prem connectivity is already ordered. Link provisioning lead times are often the longest item.
Read the full page →Usually INR 12-35 lakh in services, depending on the number of business units, network complexity and compliance needs. Running cost for shared services such as firewalls, logging and connectivity is often INR 1.5-5 lakh a month and should be planned in the migration business case.
Read the full page →Central logging keeps audit and security logs for 180 days or more in Indian regions, as CERT-In requires. Region guardrails keep resources in India, and data classification tags help identify where personal data sits for DPDP accountability and breach response.
Read the full page →Yes. We build the new structure, then move existing resources into the right accounts or subscriptions in planned steps. Some resources can be moved directly; others need recreating. We plan these as small migration waves. Downtime, where needed, is booked like any wave.
Read the full page →Your platform team or a managed service provider. We hand over the code repository, pipelines, runbooks and an exception process, and train the team to vend accounts and change policies through pull requests. Optional managed support is available for the first quarter.
Read the full page →Plan for it even if you do not build it on day one. Reserve IP space and design the hub so a second Indian region, such as Hyderabad, South India or Delhi, can be added for DR without redesign. It costs little to plan early.
Read the full page →Start from the provider's accelerator in almost every case: AWS Control Tower with Landing Zone Accelerator, Azure Landing Zones, or Google's foundation blueprint. They encode tested patterns, are updated by the provider, and auditors recognise them. Customise on top for your IP plan, guardrails and naming. Build fully custom only when you have strict requirements the accelerator cannot meet and a platform team to maintain it. A custom build without a team to own it ends up as a one-time setup that drifts within a year.
Read the full page →It is a timed, step-by-step plan for go-live: each step with an owner, start time, expected duration from rehearsal, a check, and what to do if it fails. A typical runbook for a business-critical system has 80-200 steps from change freeze to business sign-off.
Read the full page →At least one full dress rehearsal on production-sized data. For systems with external partners or more than two hours of planned downtime, two rehearsals are better. The second usually cuts actual timing by 20-30% because steps are refined. Rehearse at the real time of day.
Read the full page →For one business-critical system, planning, rehearsals, the cutover event and two weeks of hypercare typically cost INR 4-12 lakh, depending on team size and hours. Night and weekend cutovers and 24x7 war rooms increase the cost. Rehearsals are usually the best-value line.
Read the full page →When a go/no-go criterion fails and the fix will not fit in the remaining buffer before the point of no return. Rollback should be a calm, planned decision, which is why the criteria and approvers are written in advance. Nobody improvises at 4 a.m.
Read the full page →The war room includes the security contact, and the incident path is set up so cyber incidents can be assessed and reported to CERT-In within six hours if required. Logs are retained in India for 180 days from the first day in cloud.
Read the full page →Yes. We avoid festive peaks, month and quarter closes, GST filing dates and sector-specific busy periods, such as wedding season for hotels or festival travel for bus operators. The cutover date is set from the business calendar first. Partners' freeze dates are added too.
Read the full page →Two weeks suits most systems, and four weeks suits those with month-end or billing cycles, so one full cycle runs under close watch. But the length should follow exit criteria, not the calendar: no open severity 1 or 2 defects, performance at or above baseline for seven days, and business sign-off. Ending hypercare early to free the team usually means the first month-end becomes an incident. Extending it indefinitely is also a warning sign that defects are not being fixed, so set a review point at the planned end date.
Read the full page →For lift-and-shift estates, 20-40% of the first full monthly bill is common. Typical sources are oversized VMs, premium disks without need, licence-included charges where Software Assurance exists, and leftover migration resources. The exact figure depends on how conservatively the migration was sized.
Read the full page →Right-sizing during migration adds risk to cutover and uses on-prem metrics that may not reflect cloud behaviour. Launching one size up and correcting with cloud metrics afterwards is safer. We still remove obvious waste, such as idle test servers, during intake.
Read the full page →A 60-90 day engagement for 100-300 servers typically costs INR 6-18 lakh. It is often priced partly on savings. In most cases, the reduction in the monthly bill covers the fee within two or three months. Fees are fixed per phase.
Read the full page →They should not if done properly. We size against peak, including month-end, keep headroom, change one size at a time and check app response after each batch. Any slowdown is reversed in the next window. Owners approve every change first.
Read the full page →No. Resizing and tier changes keep resources in the same Indian regions, with the same encryption and logging. Log retention for CERT-In and data location for DPDP Act 2023 are checked as part of the residue sweep, since temporary resources sometimes miss policies.
Read the full page →We hand over a baseline: cost per application, sizing rationale, commitment plan and remaining recommendations. Your operations team or a managed cost service uses it for monthly reviews. It becomes the reference point for every later review and commitment decision.
Read the full page →Post-migration optimization is a one-time correction of choices made to move fast, done in the first 90 days: residue, oversized VMs, wrong disk tiers, missed licence benefits. FinOps is the ongoing practice that follows: allocation, budgets, anomaly response and commitment management every month. Do the post-migration phase first; starting FinOps on an uncorrected estate means the first quarter of reports is dominated by migration leftovers. Once the estate matches the business case, hand the baseline to the FinOps or cost operations team.
Read the full page →A mid-size programme of 150-400 servers usually combines a landing zone, server or VMware migration, database migration, a migration factory for wave cadence, cutover planning for the five or six critical systems, and post-migration optimization. Replatforming or refactoring is added for the 10-20% of apps that justify it.
Read the full page →Assessment decides what should move, where and why, and produces reports, scores and a roadmap. Migration builds and executes: it creates the landing zone, replicates servers and data, runs cutovers and decommissions sources. If you do not yet know your target cloud or 6R treatment per app, start with assessment.
Read the full page →Most clients migrate to one primary cloud, chosen on commercial and skills grounds. We also run cloud-to-cloud moves and support deliberate multi-cloud setups where each workload has a home cloud. We avoid accidental multi-cloud, where two half-used landing zones double the operating effort.
Read the full page →For 100-300 servers, 5-8 months from landing zone to last wave is typical, followed by a 90-day optimization phase. Larger estates run longer, but velocity, not size, sets the end date, which is why we track throughput weekly once the factory is running.
Read the full page →Workloads land in Indian regions, logs are kept 180 days in India for CERT-In, and incident paths support its 6-hour reporting rule. We map personal data for DPDP Act 2023 accountability, and for RBI, SEBI or IRDAI regulated entities we align controls and outsourcing records to the relevant framework.
Read the full page →We hand over a clean estate: IaC repositories, runbooks, a cost baseline per application and remaining recommendations. Ongoing operations, such as monitoring, patching, backup and cost management, move to your team or to a managed cloud service, which NTSPL also offers.
Read the full page →For one application of 300,000-800,000 lines of code, an assessment typically runs 4-6 weeks with two architects and a data engineer, usually in the INR 12-25 lakh range. Each additional application sharing the same database or team adds 30-50% rather than a full repeat. We offer a fixed price once we have seen the repository size.
Read the full page →Yes. A code-level assessment cannot be done from interviews and diagrams. We work read-only inside your environment, through your VDI, your Git server or a workspace in your cloud tenancy, so code never leaves your control. NDA and IP clauses are signed before any access is granted.
Read the full page →We trace in a performance or staging environment with masked data wherever possible. When production traces are needed, OpenTelemetry collectors drop request bodies and redact identifiers such as PAN, Aadhaar and mobile numbers at source, and traces are stored in your own account in an Indian region such as AWS Mumbai or Azure Central India.
Read the full page →Java (Struts, Spring, EJB), .NET Framework and modern .NET, PHP, Node.js and Python, plus Oracle Forms, PowerBuilder and VB6 front ends. Mainframe COBOL is scoped separately because the tooling and skills differ, though we assess the distributed tiers around it in the same engagement.
Read the full page →You receive a backlog your own team or any vendor can execute. Many clients start NTSPL on the first extraction because the spike is already built, but deliverables are vendor-neutral, with estimates and assumptions transparent enough to support competitive bidding.
Read the full page →No, but they shorten it. AWS Transform, GitHub Copilot app modernization and Gemini Code Assist speed up code reading and upgrade sizing. They cannot see runtime call paths, batch jobs writing to shared tables, or which modules cause incidents, and those facts decide the extraction order.
Read the full page →If you have not decided which applications to modernize, do portfolio screening first. It sorts 50-500 applications into 6R buckets in a few weeks using questionnaires, inventory and cost data, and its output is a shortlist. A modernization assessment starts where that ends: it takes one to five named applications and reads their code, schemas, traces and change history to decide target patterns, extraction order and cost. Running deep assessments across a whole portfolio wastes money. Skipping one for a high-value system means the programme discovers its real complexity during delivery, when every change costs five to ten times more.
Read the full page →A first release of 20-30 operations with gateway, portal and two pilot partners typically takes 8-10 weeks and INR 25-45 lakh in services. Gateway run cost ranges from about INR 15,000 a month on usage-priced gateways to several lakh a month for enterprise tiers, so we size the gateway to expected partner volume.
Read the full page →For RBI-regulated entities we apply mTLS and scoped OAuth for partner access, per-partner audit logs and data minimisation in responses, in line with RBI's 2023 Master Direction on IT governance, risk, controls and assurance. Gateway logs stay in India for 180 days to meet CERT-In's April 2022 directions, and API incidents feed your 6-hour reporting process.
Read the full page →Yes, through interfaces it already has: CICS transactions, MQ queues, Db2 stored procedures or RPG programs behind connectors. The facade runs off-platform, so the mainframe sees the same transaction types as today, and cached reference data reduces MIPS consumption and batch-window pressure.
Read the full page →Use REST for partner APIs: it is easier to secure, cache and rate-limit per operation, and partners expect OpenAPI documents. GraphQL works well as a backend-for-frontend for your own mobile app, where screens combine several resources, sitting behind the same gateway.
Read the full page →The anti-corruption layer absorbs core changes. When core fields or codes change, only the adapter changes and the contract stays fixed. Consumer contract tests run in the facade pipeline, so a core upgrade that would break a partner fails the build before it reaches production.
Read the full page →Each operation returns only the fields its purpose needs. Identifiers such as Aadhaar and account numbers are masked by default, and consent or purpose references are logged where the business process requires them, keeping the API layer consistent with DPDP purpose limitation.
Read the full page →Choose by where your consumers and core sit, not by feature lists. Azure API Management fits when the core stays on-premises for a while: its self-hosted gateway runs next to the legacy system and the built-in developer portal manages partner subscriptions. Apigee is strongest for large partner ecosystems that need analytics, monetisation and complex policy chains, at a higher base cost. Amazon API Gateway is the cheapest for usage-priced, AWS-hosted facades, but needs extra work for a branded partner portal. For most Indian mid-market programmes with under 30 partners, API Management or API Gateway is enough.
Read the full page →Expect 10-12 weeks for the first bounded context, including the template and event backbone, then 6-8 weeks per later context. A 500,000-line monolith usually reaches a stable state, with core contexts extracted and the residue rarely changed, in 12-18 months. Services cost runs roughly INR 18-30 lakh per context after the first.
Read the full page →No. Up to about 15-20 services, Cloud Run, Azure Container Apps or ECS on Fargate give independent deployment and scaling with far less platform work. Kubernetes becomes worthwhile when you need custom scheduling, mesh features or consistent operation across clouds.
Read the full page →We replace distributed transactions with sagas. Each step commits locally and publishes an event; a failure triggers compensating actions, such as releasing a seat or reversing a payment hold. A transactional outbox guarantees the event is published whenever the local commit succeeds, so no step is silently skipped.
Read the full page →Yes. The strangler router sends only migrated routes to new services; everything else reaches the monolith unchanged, and each route can be switched back in seconds if metrics degrade. Users should notice nothing beyond faster pages on the migrated paths and fewer outages spreading between features.
Read the full page →It usually helps. Concentrating personal data in one owning service, such as profile or customer, lets you apply consent checks, erasure requests and access logging in one place rather than across a shared schema. We map every event that carries personal data and pass only identifiers elsewhere.
Read the full page →They help with analysis and code movement, not boundary decisions. We use assistants to generate adapters, tests and boilerplate, which shortens each extraction, but bounded contexts come from domain workshops and data-coupling analysis that tools cannot do alone. Every generated change still passes the same contract tests.
Read the full page →Choose a modular monolith if one team of under 15-20 engineers owns the product, load is uniform and weekly releases are acceptable. Enforce module boundaries with tooling such as ArchUnit, Deptrac or NDepend rules and keep one deployable. Choose microservices when several teams must release independently, parts of the system scale very differently, or capabilities need different data stores. The decision is organisational as much as technical, because services should map to teams. A practical middle path is to modularise first, then extract only the two or three modules that genuinely need independent scale or release.
Read the full page →A Spring Boot or .NET 10 web app with clean configuration takes 2-3 weeks including pipeline and tests. Apps with local file state, sticky sessions or Windows dependencies take 4-6 weeks. In a wave of 8-10 similar apps, shared base images and templates bring the average down to about 1.5 weeks each, typically INR 4-8 lakh per app.
Read the full page →Keep the registry and runtime in an Indian region, such as AWS Mumbai or Hyderabad, Azure Central India or Google Cloud Mumbai or Delhi, when images bundle configuration or the app processes personal data under the DPDP Act 2023. Ship container logs to central storage with 180-day retention to meet CERT-In directions.
Read the full page →Yes, but we first check whether the app really needs a full Java EE server. Most use servlets, JPA and JMS, which run on Tomcat, Open Liberty or Spring Boot with modest changes. Where EJB remoting or vendor APIs remain, vendor container images are an option after a licensing review.
Read the full page →No. ECS with Fargate, Azure Container Apps and Cloud Run run containers without you managing any cluster, and they suit most business applications. Kubernetes becomes worthwhile for platforms with dozens of services, special workloads such as GPUs, or a need for consistency across clouds.
Read the full page →An automated job rebuilds images whenever base images publish fixes, runs the test suite and raises a pull request; critical CVEs trigger a same-week rebuild. Because deployments promote by digest, rollback is a one-line change back to the previous digest.
Read the full page →Generally not. We keep databases on managed services, which handle backups, patching and failover. For stateful middleware such as brokers or search engines we prefer managed equivalents, and reserve stateful containers for the few cases where no managed option fits the requirement.
Read the full page →Containerise first. A legacy web application is a long-lived HTTP process with frameworks, startup work and shared code. Containers keep that model while adding immutable builds and autoscaling, often without changing request handling at all. Functions require rewriting the application into small event handlers and suit new event-driven pieces such as file processing, webhooks and scheduled tasks, not a whole application. The practical pattern is to run the core application as a container on Cloud Run, Container Apps or Fargate, then peel specific background jobs off into functions where they are spiky or idle most of the day.
Read the full page →For one environment set (dev, UAT and production) with 40-120 workloads, expect 10-12 weeks and roughly INR 35-70 lakh in services, depending on how many charts use removed APIs and how much stateful data moves. Running old and new clusters in parallel adds 4-6 weeks of overlap cost, which we budget explicitly.
Read the full page →Plan a Gateway API migration now. Kubernetes SIG Network retired the ingress-nginx project in March 2026, so it no longer receives releases or security fixes. We inventory annotations, choose a Gateway API implementation native to your cloud or an open-source one, and shift traffic gradually using parallel edges.
Read the full page →Yes, usually through a new cluster rather than sequential in-place upgrades. We build the target cluster at a current version, fix manifests for removed APIs, then move namespaces with weighted DNS. Users see no downtime; stateful workloads get a short planned window only where replication is not possible.
Read the full page →Send control-plane audit logs and node logs to central storage retained for 180 days in India, run regulated workloads in Indian regions such as AWS Mumbai, Azure Central India or Google Cloud Mumbai, and restrict API servers to private endpoints. Admission policy reports give auditors evidence that controls are enforced, not just documented.
Read the full page →Only if OpenShift's integrated features are lightly used and its subscription is a major cost. Teams relying on Routes, BuildConfigs and the developer console face rework. We compare the subscription against managed-service cost plus the effort to replace those features before recommending any move.
Read the full page →Your platform team or a managed service. We hand over the Terraform, GitOps repositories and runbooks, and run the first upgrade with your team as a drill. Day-to-day patching and incident response can then move to NTSPL's managed Kubernetes service if you prefer not to staff it.
Read the full page →Pick the managed Kubernetes service on the cloud where your data and identity already live; switching clouds for Kubernetes alone rarely pays back. On features, GKE Autopilot offers the most hands-off node operations and mature release channels. AKS Automatic and Fleet Manager suit Microsoft-centric enterprises that run on Entra ID. EKS with Karpenter or Auto Mode gives the widest instance choice and strong Spot economics. All three now support Gateway API and workload identity. For multi-cloud estates, standardise the GitOps tool, policy engine and telemetry agents across clusters rather than trying to standardise on one provider.
Read the full page →For workloads idle most of the time, usually yes: batch and document jobs moved off always-on VMs commonly cost 50-80% less to run. For steady high-utilisation services it can cost more. We model cost per million events for each workload before migrating and set budget alarms at 120% of the model.
Read the full page →Yes. Lambda, Step Functions, Azure Functions, Cloud Run and Workflows all run in Indian regions such as AWS Mumbai, Azure Central India and Google Cloud Mumbai. We pin functions, queues and storage to those regions, honour DPDP Act 2023 retention limits, and send logs to 180-day storage for CERT-In.
Read the full page →Split them. Most long jobs are loops over files or records, so we fan them out into parallel short tasks with a state machine tracking progress. Steps that cannot be split run as serverless container jobs or Fargate tasks, which allow much longer execution than functions.
Read the full page →Measure first: many Node and Python functions cold-start in a few hundred milliseconds. For Java, SnapStart on Lambda or minimum instances on Cloud Run and Azure Functions remove most of the delay. We buy warm capacity only for user-facing endpoints with strict p99 targets.
Read the full page →Unit-test handlers as plain functions, use emulators such as SAM local, Azure Functions Core Tools or the Functions Framework for integration, and run contract tests against real queues in an ephemeral stack per pull request. Ephemeral stacks cost little because everything scales to zero when idle.
Read the full page →Triggers and workflow definitions are provider-specific; business logic need not be. We keep handlers thin over plain-code business modules and use CloudEvents where supported, so changing provider means rewriting adapters and workflow definitions rather than the core logic, typically a few weeks of work per domain.
Read the full page →All three replace hand-written job controllers, so pick the one native to where your functions run. Step Functions defines workflows in Amazon States Language or a visual designer, has the widest direct service integrations, and offers Distributed Map for very large file fan-out. Durable Functions expresses orchestration as code in C#, JavaScript, Python or Java, which developers prefer for complex branching and long human-approval waits. Google Workflows uses YAML or JSON with connectors to Google Cloud APIs and suits HTTP-heavy orchestration around Cloud Run. Choose on team language preference and integrations, then standardise on one per cloud.
Read the full page →It scales with stored code, not data volume. A database with about 1,000 procedures and packages and 2-5 TB of data typically takes 16-20 weeks and INR 60 lakh to 1.2 crore in services. For Enterprise Edition estates, licence and support savings usually repay this within 12-24 months.
Read the full page →Yes. Targets run in Indian regions such as AWS Mumbai or Hyderabad, Azure Central India and Google Cloud Mumbai or Delhi, with DR replicas inside India. For SEBI- or RBI-regulated entities we encrypt migration copies, mask non-production data and document lineage for audit, consistent with the DPDP Act 2023.
Read the full page →Packages become schemas of functions, and package variables are replaced by session settings or application state. Scheduled jobs move to pg_cron where the service supports it, or to cloud schedulers calling functions, which give better visibility and retries than in-database scheduling.
Read the full page →Most OLTP workloads perform the same or better after tuning, but a few queries usually regress because the optimiser differs. That is why we replay the top queries before cutover and tune indexes, statistics and SQL. We never go live on untested query plans for critical transactions.
Read the full page →They speed up the manual portion. We use generative assistants to propose conversions for complex procedures, but every output passes the same unit tests and dual-engine replay as hand-written code, because subtle semantic errors in generated conversions are common, especially around NULL handling and implicit type casts.
Read the full page →Usually some: drivers, ORM dialect settings, Oracle-specific SQL and hints. With Hibernate or Entity Framework the changes are often small; with hand-written SQL embedded in code, application remediation can be a third of total effort, which the assessment sizes up front.
Read the full page →Move same-engine if the application is packaged and certified only on Oracle or SQL Server, if it retires within two years, or if your team cannot change and retest its SQL. Change engines when licence and support costs are material, the code is yours, and the assessment shows that under roughly 15-20% of objects need manual conversion. Many programmes do both: a same-engine move first to exit hardware quickly, then an engine change once teams and test suites are ready. That spreads risk at the cost of paying the commercial licence for a few more quarters.
Read the full page →A pilot with templates, preview environments and progressive delivery for 2-3 services typically takes 8-9 weeks and INR 25-40 lakh; scaling to 20-40 services adds 6-8 weeks. Tooling is usually modest, with hosted runners and pipeline minutes costing from a few thousand to a few lakh rupees a month.
Read the full page →Auditors look for segregation of duties, approval evidence and traceability. Protected branches and environment approvers enforce separation, each deployment links to a ticket and commit range, and records are retained. RBI's IT governance directions and SEBI's CSCRF both expect documented change control, which automated records evidence better than email.
Read the full page →Yes. Most gains, including reproducible builds, automated tests, blue-green deployment and quick rollback, apply fully to monoliths. A blue-green switch at the load balancer is often the first step, cutting release windows from hours to minutes without any decomposition work.
Read the full page →They are software delivery measures from Google's DevOps Research and Assessment programme, including deployment frequency, lead time for changes, change failure rate and failed deployment recovery time. We baseline them in week one and report monthly, so you can see whether the pipeline work is paying off.
Read the full page →With versioned migrations run by Flyway, Liquibase or the framework's own tool, applied by the pipeline using expand-and-contract. Destructive changes ship as a later release once no code uses the old structure, so a rollback never needs a schema restore.
Read the full page →Rarely. If teams use Jenkins, GitLab or Azure DevOps, we usually modernise pipelines in place with templates, OIDC and artefact promotion. We recommend a tool change only when the current one blocks a capability such as ephemeral environments or reliable audit trails.
Read the full page →If your code is on GitHub, use GitHub Actions for build and test and deploy to any cloud through OIDC; it has the largest action ecosystem and keeps developers in one tool. Azure DevOps Pipelines remains strong for enterprises already using Boards that need classic approvals and environment audit trails, especially on Azure. Cloud-native services such as CodePipeline and Cloud Build with Cloud Deploy are best on the deploy side, where provider-managed promotion and canary logic sit close to the runtime. A common, sensible pattern is GitHub Actions for CI and Cloud Deploy or CodeDeploy for progressive release.
Read the full page →Effort follows journeys, not screen counts. Redesigning a core journey of 8-15 screens with BFF APIs typically takes 6-10 weeks and INR 18-35 lakh, and the design system and shell add 3-4 weeks once. Long-tail screens ported with minimal change cost far less each.
Read the full page →We build internationalisation in from the start, with Unicode fonts for Devanagari, Tamil, Telugu, Gujarati and other scripts and locale-aware lakh and crore formatting. We target WCAG 2.2 AA, which also aligns closely with the Government of India's GIGW guidelines for public-facing portals.
Read the full page →Conversion tools can generate web code from Forms, but the output usually mirrors old screens and inherits their navigation problems. We use automated extraction for rules and the data model, redesign the busiest journeys, and reserve tool-based conversion for the low-use long tail.
Read the full page →No. The coexistence shell lets one team, branch or airport use new screens while others stay on legacy screens, controlled by feature flags. We widen the rollout group by group once task times and error rates beat the baseline, and keep a fallback flag for each group.
Read the full page →Once the last legacy client screens retire, yes, and that is often a major saving. During transition, new web screens open in a normal browser while the remaining legacy screens stay published on Citrix or VDI for those who still need them.
Read the full page →A PWA covers most field and partner needs: offline caching, camera access, an installable icon and one codebase to maintain. Choose native apps when you need deep device integration, such as Bluetooth printers or background location, or app-store distribution to consumers.
Read the full page →Use low-code platforms such as Power Apps, OutSystems, Mendix or AppSheet for internal admin screens, approval forms and long-tail screens used by a few dozen people, where speed matters more than control. Choose a custom React or Angular front end for high-volume operational screens, customer- or partner-facing journeys, offline field use, or anything needing fine control of performance and keyboard behaviour. Many programmes combine both: custom UI for the 20 screens that carry most of the work, and low-code for the remaining hundred-plus. Watch per-user licensing, which can exceed custom build cost for large external user bases.
Read the full page →Plan a five-week foundation, then roughly 3-5 weeks per integration domain such as orders, inventory or customer, typically INR 15-30 lakh per domain. Managed messaging usually costs far less than ESB licences and support; a mid-size estate often runs INR 30,000-1.5 lakh a month in messaging and iPaaS charges.
Read the full page →Run brokers and flows in Indian regions, encrypt messages at rest, and keep message-tracking logs for 180 days to meet CERT-In directions. Under the DPDP Act 2023, minimise personal fields in events and set retention per event type so archives do not keep data longer than the purpose requires.
Read the full page →Partially. Logic Apps Standard can reuse BizTalk XSLT maps and schemas, and Microsoft publishes migration guidance, but orchestrations usually need redesign. For Oracle SOA and TIBCO we re-implement flows, using automated extraction of XSLT and endpoint lists to speed up the work.
Read the full page →Use Kafka, as Amazon MSK, Event Hubs' Kafka endpoint or Google Cloud Managed Service for Apache Kafka, for high-volume streams, long retention and stream processing. Use EventBridge, Service Bus or Pub/Sub for business events at moderate volume with routing rules and lower operating effort. Many estates run both.
Read the full page →They keep SFTP if they need it, but on managed endpoints such as AWS Transfer Family or Azure Blob Storage SFTP, where a file's arrival triggers an event and a processing flow. Partners able to move to APIs or AS2 are migrated over time, starting with the highest-volume ones.
Read the full page →Every message carries a correlation ID from the source transaction. The tracking dashboard shows its path across bus, queues and flows. Failures sit in dead-letter queues with the error reason attached, and can be replayed individually or in bulk once the fault is fixed.
Read the full page →No, and treating it as one repeats the original problem. An ESB centralises routing, transformation and orchestration in one hub run by one team. Cloud native integration splits those concerns: a managed bus or queue for routing, transformation close to consumers, and workflow orchestration only where a business process needs it. An iPaaS such as Logic Apps or Application Integration is the right tool for SaaS connectors, EDI and partner mappings, but high-volume domain events belong on EventBridge, Service Bus, Pub/Sub or Kafka. Plan the ESB exit by domain and decommission each flow as it moves.
Read the full page →A collector foundation plus instrumentation of 5-8 critical journeys typically takes 10-12 weeks and INR 30-55 lakh. Most clients recover part of that through lower log and APM spend, because trimming noise and tiering logs commonly cuts ingestion cost by a third or more.
Read the full page →Keep a small hot tier for search and alerting, and send everything needed for compliance to low-cost archive storage in an Indian region, such as S3, Azure Storage or Cloud Storage with lifecycle rules. Archived logs stay retrievable for investigations and support CERT-In's 6-hour incident reporting.
Read the full page →Very little at first. Auto-instrumentation for Java, .NET, Node and Python captures HTTP, database and messaging spans without code changes. On critical journeys we then add manual spans and business attributes, such as order ID or scheme code, where they speed up diagnosis.
Read the full page →Yes. Grafana works with Prometheus, cloud monitoring APIs and common log backends. On AWS in Indian regions we run self-hosted Grafana on EKS or ECS, because Amazon Managed Grafana is not offered there; on Azure and Google Cloud we use managed or self-hosted Grafana depending on regional availability.
Read the full page →It is the amount of unreliability an SLO allows. A 99.9% monthly availability target leaves 0.1%, about 43 minutes in a 30-day month. When a team burns budget fast, alerts fire; when it is spent, the team prioritises reliability work over new features until it recovers.
Read the full page →They share collection but serve different purposes. Our collectors can forward security-relevant logs to the SIEM while application telemetry goes to observability backends, avoiding duplicate agents on every host. Detection rules and SOC workflows are designed by our security practice.
Read the full page →Use OpenTelemetry for instrumentation in any new or modernised application. It is the CNCF standard supported by every major cloud and APM vendor, so you can change backends later without re-instrumenting code. Proprietary agents still offer deeper automatic coverage for some runtimes and faster setup, and remain reasonable for a stable monolith that is already well covered. A practical path: keep existing agents where they work, introduce OpenTelemetry for new services and the collector pipeline, route both to the same backend, and retire the old agents at licence renewal.
Read the full page →A first feature with gateway, evaluation set and pilot typically takes 8-10 weeks and INR 25-45 lakh. Run cost depends on volume and model choice: extraction and classification often cost under a rupee or two per document, while long summaries cost more. We set a per-task budget and route to smaller models to stay inside it.
Read the full page →Classify what each feature sends, redact identifiers it does not need, and prefer Indian-region endpoints for personal data. Record consent and purpose under the DPDP Act 2023, keep humans approving regulated decisions, and log AI-assisted actions so RBI, SEBI or IRDAI audits can see who decided what.
Read the full page →Whichever passes your evaluation set at the lowest cost and latency. We usually compare two or three models available on your cloud's managed platform and revisit the choice every quarter. The production model version is pinned, and upgrades go through the same release gate as code.
Read the full page →Yes, if the application exposes permissioned APIs. We design narrow, audited tools, such as get claim summary or create follow-up task, that agents call through the gateway with the user's identity, and keep write actions behind confirmation steps. Protocols such as the Model Context Protocol make those tools discoverable.
Read the full page →Measure against the baseline: handling time, error rates and acceptance of suggestions. We also track how often and why users edit outputs, which feeds the evaluation set. A feature that saves time but shows rising edits is investigated before it is expanded.
Read the full page →Usually not at first. Prompt templates, good context from your APIs and structured output schemas solve most extraction and drafting tasks. Tuning a smaller model makes sense later, when volumes are high and a cheaper model can match quality on your evaluation set.
Read the full page →Buy when the task lives in a tool that already has a capable copilot, such as email, documents, CRM or ITSM suites, and the vendor's data handling meets your requirements. Embed when the work happens in your own applications, such as claims, loans, orders or dispatch, when outputs must write back into your records with an audit trail, or when regulated data needs your own redaction and residency controls. Embedding costs more upfront but places AI where the time is spent; standalone copilots often see low use because staff must copy context between windows.
Read the full page →Migration changes where an application runs, through rehosting or light replatforming, usually under a data-centre deadline. Modernization changes how the application is built: its architecture, data engine, interfaces, delivery pipeline and telemetry. Many clients migrate first to exit hardware, then modernize the few systems where release speed, licence cost or scale actually limit the business.
Read the full page →With one to three applications where a measurable business constraint exists, such as a licence renewal, a release bottleneck or a partner backlog, and a code-level assessment of those applications. Starting with a platform build or a company-wide microservices mandate, without a first application to prove value, is the most common way programmes lose momentum.
Read the full page →Individual steps take 6-20 weeks: an API facade, a container wave, a database conversion or a pipeline rollout. Programmes for a core application usually run 9-18 months as a sequence of such steps. We recommend funding per step against agreed metrics rather than one large upfront budget, so each tranche is released on evidence.
Read the full page →No. Most portfolios have a handful of systems where modernization pays back and many where rehosting, retiring or leaving them alone is cheaper. Modernizing stable, rarely changed applications adds cost and risk without benefit, so we recommend stopping once the remaining legacy components are stable and seldom touched.
Read the full page →Every change is incremental and reversible: strangler routing with per-route rollback, dual reads before data cutovers, reverse replication during database fallback windows, canary releases with automatic aborts, and feature flags for new screens. Nothing switches over in one weekend unless it has been rehearsed with production-sized data at least twice.
Read the full page →We design them in. Personal data is concentrated in owning services, minimised in APIs and events, masked in test environments and redacted from telemetry. Logs are retained for 180 days in India to meet CERT-In directions, and workloads run in Indian regions, with RBI, SEBI or IRDAI controls mapped where the client is regulated.
Read the full page →For a landscape of 3 to 5 production systems with their non-production tiers, the effort is typically 25 to 45 consultant-days over four to six weeks. The main variables are the number of production systems, whether BW and PI/PO are in scope and how much custom code needs ATC analysis. NTSPL quotes a fixed fee after a one-hour scoping call.
Read the full page →Yes, but read-only. We request a technical user with a time-bound role covering the sizing report, workload monitors, interface configuration displays and Readiness Check collectors. No transactional data is extracted; we take metadata, table sizes and counts. Collection jobs run during low-load hours agreed with your Basis team.
Read the full page →Yes. For a lift of ECC, we focus on sizing, OS and database support on the target cloud, Unicode status and interfaces. We still run Readiness Check so the later conversion inherits a known simplification and custom-code backlog, rather than discovering it two years later.
Read the full page →We list e-invoicing IRP, e-way bill, GST return and TDS interfaces separately, including whether they use SAP's own solutions, a GSP or a custom adapter. These carry legal deadlines, so their connectivity, certificates and cutover sequence get flagged early for the migration planners and for the DPDP Act 2023 data-flow inventory.
Read the full page →The sizing sheet includes growth scenarios, usually 15 and 30 percent annual data growth, and shows when each would force a larger certified instance. That lets you plan reservations and archiving together instead of being surprised by a memory limit in year two.
Read the full page →We present the options with dates: delay the move, migrate with the blocker isolated, for example keeping one add-on on a separate system, or replace the function with standard S/4HANA capability. The steering committee decides with the cost and risk of each written down.
Read the full page →SAP Readiness Check is a free SAP tool that analyses one system for S/4HANA conversion: simplification items, add-ons, custom code and some sizing. It is necessary but narrow. It does not tell you which certified cloud instance to buy, whether your OS and database releases are supported on the target image, how many interfaces cross plant networks, or how much cleanup would shrink HANA memory. A full readiness assessment uses Readiness Check as one input and adds landscape-wide sizing, platform compatibility, interface mapping and a prioritized fix list. If you are moving more than two production systems, the full assessment pays for itself in avoided rework.
Read the full page →For a five-tier landscape of one S/4HANA production system with sandbox, development, quality and pre-production, build effort is typically 30 to 50 consultant-days over five to six weeks. Cloud consumption during build is separate and is minimized by building production last and scheduling non-production shutdowns from week one.
Read the full page →Yes. AWS Mumbai, Azure Central India and Google Cloud Mumbai all have multiple availability zones, so HA can stay within one region. A second region such as Hyderabad, Chennai or Delhi is then used for disaster recovery, keeping data in India for DPDP Act 2023 and sectoral regulator expectations.
Read the full page →Both options exist. NTSPL can hand over hosts at OS level to your Basis team or an SAP partner, or install HANA, ASCS, ERS and application servers with Software Provisioning Manager. The handover point is fixed in the RACI before work starts so acceptance criteria are clear.
Read the full page →We start from SAPS derived from current workload data in the readiness assessment and add headroom for S/4HANA's different load profile, especially for Fiori traffic. Production gets at least two servers so one can be patched while the other carries load.
Read the full page →SLES for SAP and RHEL for SAP are both supported on all three clouds. Choose based on existing skills and support contracts. Standardizing one distribution matters more than which one, because cluster agents, tuning tools and patch processes differ between them.
Read the full page →Refreshes use HANA backup and restore or storage snapshots onto hosts built from the same Terraform module. Because the target host is code, a quality refresh no longer waits on infrastructure tickets; Basis runs post-copy steps and the system is back in a day.
Read the full page →Provider tools such as Azure Center for SAP solutions and AWS Launch Wizard for SAP are the fastest way to a correct first deployment: they encode the provider's reference layout and can install SAP software too. Their limits appear later, when you need identical rebuilds across regions, custom tagging, or integration with an existing landing zone pipeline. Terraform modules take two to three weeks longer to build but give full control and drift detection. NTSPL's usual answer is to use the provider tool to generate a validated reference, then codify that layout in Terraform for every environment after sandbox.
Read the full page →For one S/4HANA and one BW database, effort is usually 20 to 35 consultant-days over five to six weeks. Validation on a production-sized copy adds cloud cost for a few days, which NTSPL schedules to minimize run time.
Read the full page →Usually not for S/4HANA. Cloud providers offer certified scale-up shapes far larger than most Indian S/4 databases, so scale-up is simpler. Scale-out stays relevant for large BW/4HANA systems or databases that exceed the largest shape in your chosen region.
Read the full page →Yes. Primary, zonal secondary and DR tier three can all sit in Indian regions, and archives go to object storage in the same regions. That supports DPDP Act 2023 data mapping and keeps evidence simple for RBI, SEBI or IRDAI regulated entities.
Read the full page →For correctly chosen warm data, users rarely notice. Queries on old periods may take slightly longer because pages load from disk. NTSPL tests response times on representative reports before and after the change and only moves tables where impact stays inside agreed limits.
Read the full page →Technically yes, as separate tenants, but NTSPL does not recommend it for production. BW loads and S/4 transactions peak at different times and compete for memory and CPU. Separate hosts make sizing, patching and replication simpler.
Read the full page →Review memory profile and tiering quarterly and topology yearly, or after any acquisition, new plant or company-code rollout. Growth that is not reviewed usually appears as a sudden instance upgrade request.
Read the full page →Archiving reduces cost more, because archived data leaves HANA entirely and no longer counts toward memory or backup size. But archiving needs functional sign-off, archive objects per process and a way for users to read archived documents, which takes months to agree. NSE is faster to implement and keeps data queryable in HANA, but it still occupies disk and some buffer memory. NTSPL's guidance is to apply NSE first for quick memory relief on old partitions in large tables, then run archiving as a programme for closed fiscal years once retention rules are agreed with finance and auditors.
Read the full page →Planning effort for one production S/4HANA conversion with its tiers is usually 30 to 45 consultant-days spread over the programme, with most effort in the first four weeks and after each mock. Mock runs themselves need cloud capacity for a few days each, which is budgeted separately.
Read the full page →We mark GSTR-1 and GSTR-3B due dates, e-invoicing dependencies and month-end close on the programme calendar and exclude them from cutover candidates. E-invoice and e-way bill interfaces are tested in the dress rehearsal so invoicing works on the first business day after go-live.
Read the full page →Usually yes, with a planned freeze. Plants record dispatches, receipts and production in MES or offline templates during the outage, and the runbook includes a timed backlog re-entry step after go-live with named owners per plant.
Read the full page →For databases between 2 and 6 TB, most Indian programmes fit a 36 to 48 hour window including business validation, using DMO with system move and tuned parallelism. Larger databases or tighter windows usually need downtime-optimized techniques.
Read the full page →Yes. Sandbox and development move first so custom-code remediation runs on cloud, then quality for testing. Production moves last after mocks. This also proves network and operations processes before they matter.
Read the full page →Yes. Export files, staging buckets and target systems are kept in Indian regions, transfer encryption is specified, and staging copies are deleted after cutover with evidence, which supports DPDP Act 2023 obligations for employee and customer personal data.
Read the full page →Brownfield conversion is faster and keeps history, configuration and custom code, so most Indian manufacturers with a stable ECC choose it. It typically takes 6 to 9 months and the downtime is one weekend. Greenfield is right when the ECC no longer reflects how the business works, for example after mergers or when more than half of processes will be redesigned; expect 12 to 18 months and a data-migration project for open items and masters. If you cannot decide, the custom-code usage profile is the best tiebreaker: if fewer than 40 percent of custom objects are still used, greenfield becomes much easier to justify.
Read the full page →The main cost is the secondary HANA host, which roughly doubles database compute, plus an ERS host and zone-redundant storage. Build and testing effort is typically 20 to 30 consultant-days per production SID. Some teams use a smaller secondary with the cost-optimized pattern, but takeover then takes longer.
Read the full page →Yes. AWS Mumbai and Hyderabad, Azure Central India and Google Cloud Mumbai and Delhi all offer multiple zones, so zonal HA stays in-region. A second region is added only for disaster recovery.
Read the full page →Yes. SUSE and Red Hat publish cluster setup guides for SAP HANA and NetWeaver on each major cloud, and the cloud providers publish matching reference designs. NTSPL builds to those guides so support cases are not rejected for unsupported configuration.
Read the full page →Run the full catalogue before go-live, after major OS, cluster or HANA upgrades, and at least once a year. A planned takeover during a quarterly maintenance window is a simple way to keep the team practised.
Read the full page →Users on the affected application server or in the middle of a transaction may see an error and need to log on again. With ENSA2, enqueue locks are preserved, so open locks do not have to be reset. Most users see a short pause.
Read the full page →Cluster events and takeovers are logged and forwarded to the central log store, which is kept for at least 180 days as CERT-In directs. If an outage is caused by a cyber incident, the timeline helps meet the 6-hour reporting requirement.
Read the full page →On cloud, HSR with Pacemaker is the standard for scale-up HANA. The secondary has its own storage, already has data loaded with preload, and sits in another zone, so takeover is fast and survives a zone loss. Host auto-failover uses a standby node sharing storage with the active nodes; it is mainly relevant to scale-out systems and does not protect against storage or zone failure by itself. NTSPL uses host auto-failover only where scale-out BW is unavoidable, and even then usually combines it with HSR to a second zone.
Read the full page →Standby cost depends on the DR HANA size and whether app servers run continuously. A typical warm design with a smaller DR HANA host and app servers off adds 30 to 50 percent to production infrastructure cost. Build and first drill effort is usually 25 to 40 consultant-days.
Read the full page →Usually AWS Mumbai with Hyderabad, Azure Central India with South India, and Google Cloud Mumbai with Delhi. These keep SAP data inside India for DPDP Act 2023 data mapping and for RBI, SEBI or IRDAI regulated group entities.
Read the full page →At least twice a year, plus after any major upgrade such as an S/4HANA release change. One drill a year should include a full business test with key users. Drills are scheduled outside close and GST filing weeks.
Read the full page →A named executive, usually the CIO with the CFO or COO, based on criteria in the runbook such as expected primary outage over two hours. Writing this down prevents an hour of debate while plants wait.
Read the full page →DR itself is not a CERT-In requirement, but drills produce event logs and incident timelines. NTSPL keeps those logs in India for at least 180 days and uses the same timeline format needed for a 6-hour CERT-In report if a cyber incident triggers DR.
Read the full page →No. Replication copies encryption or deletion to DR within minutes. Ransomware recovery depends on immutable backups and clean restore points, so NTSPL designs SAP DR and SAP backup together.
Read the full page →HSR to a DR region gives RPO in minutes and RTO in one to two hours, because the DR database is already current and only needs takeover. It costs a running DR host and replication bandwidth. Backup restore in the DR region costs far less on standby, but RTO grows with database size, often 6 to 12 hours for a 3 TB HANA, and RPO equals your log backup interval plus copy delay. For S/4HANA production supporting plants and dispatch, NTSPL recommends HSR. Backup restore is acceptable for BW, development and systems where the business can tolerate a day's outage.
Read the full page →Cost is driven by protected data size, retention and immutability. A 3 TB HANA with 35 days of daily copies and 12 monthly copies usually costs a few lakh rupees a month in backup storage. Setup effort is typically 12 to 20 consultant-days per landscape.
Read the full page →Backups stay in Indian regions, backup access is logged and retained for at least 180 days per CERT-In directions, and restore evidence helps show reasonable security safeguards under the DPDP Act 2023 for personal data such as employee payroll records.
Read the full page →Monthly for production HANA, recovering to a random point in time. Quarterly, the test should start the full SAP instance and let a key user check a few transactions.
Read the full page →Yes. Quality and pre-production refreshes from production backups or snapshots also act as restore tests. NTSPL scripts post-copy steps so refreshes take hours instead of days.
Read the full page →If DR HANA runs continuously, backups usually stay in the primary region with copies sent to DR. After a real failover, backups must start on the DR side immediately, so the DR runbook includes enabling Backint there.
Read the full page →Yes. Backups protect against loss; they are not a way to retrieve individual old documents. Archiving keeps HANA smaller and old documents readable, while backups protect whatever remains in the database.
Read the full page →You need both, for different jobs. Backint backups are HANA-aware, appear in the backup catalog, can be encrypted, sent to another account and locked, and support point-in-time recovery with log backups. They are slower to restore for large databases. Snapshots restore a multi-terabyte database in minutes and make system copies easy, but they live with the storage they protect and can be deleted with it. NTSPL designs Backint as the system of record and adds snapshots for speed when HANA exceeds about 2 TB or restore targets are under an hour.
Read the full page →Design and build effort is typically 20 to 35 consultant-days for a landscape with 10 to 30 sites. Private links and carrier circuits are the main recurring costs and vary by provider, location and bandwidth; NTSPL helps compare carrier quotes.
Read the full page →SAP GUI is efficient, typically needing only a few kilobits per second per active user, but bursts happen with large reports and attachments. Fiori uses more. NTSPL sizes from measured traffic at existing sites rather than per-user rules of thumb.
Read the full page →Critical plants get two diverse links, and shop-floor systems that post to SAP are configured to buffer and post later. The cutover runbook and business continuity plan include an offline template for dispatches and receipts.
Read the full page →Flow logs, firewall logs and DNS logs are sent to a log store in an Indian region and retained for at least 180 days, in line with CERT-In directions, so incidents can be traced and reported within 6 hours.
Read the full page →In the cloud landing zone, in its own subnet close to SAP, with a high availability pair for production. It only opens outbound connections to SAP BTP and exposes listed back-end resources.
Read the full page →Yes, through a zero-trust access service or a VPN, never by exposing SAP GUI ports. Fiori can be published through a web application firewall with SSO. NTSPL designs this together with SAP security and identity controls.
Read the full page →For plants that run shop-floor interfaces into SAP or have more than 100 SAP users, terminate SD-WAN into a dedicated private link at the cloud region rather than relying on internet breakout. Internet paths in India vary across ISPs and times of day, and RFC-heavy integrations suffer most from jitter. SD-WAN still adds value for path selection, QoS and failover between MPLS, broadband and 4G. For small depots and sales offices using Fiori or SAP GUI lightly, SD-WAN over internet with a cloud VPN gateway is sufficient and much cheaper.
Read the full page →For a landscape of three to five production SIDs, effort is typically 30 to 45 consultant-days over six weeks. Licence costs for PAM, SIEM ingestion or SSO tools depend on what you already own; NTSPL designs around existing Entra ID or SIEM investments where possible.
Read the full page →We map personal data in SAP HR, payroll, customer and vendor masters, restrict access by role, encrypt data at rest and in transit, and log access to sensitive tables. These are evidence of reasonable security safeguards and support breach notification if an incident occurs.
Read the full page →Yes, if they reach the SIEM in minutes. NTSPL forwards SAP audit log, HANA audit and OS logs to an Indian-region store retained for at least 180 days, with detections that raise incidents fast enough for the 6-hour reporting window.
Read the full page →SAP has announced the end of mainstream maintenance for SAP Identity Management at the end of 2027 and points customers to Microsoft Entra ID and SAP Cloud Identity Services. NTSPL plans the move of provisioning rules and approval workflows as part of SAP identity work.
Read the full page →Yes, but through the same just-in-time path as staff, with named accounts, ticket references, time limits and recorded sessions. Shared vendor accounts and permanent VPN tunnels are removed.
Read the full page →Data volume and log encryption have little measurable impact on modern cloud instances for most S/4HANA workloads. NTSPL enables it on quality first and compares batch and dialog timings before production.
Read the full page →They usually work together rather than compete. Entra ID, or your corporate identity provider, should stay the authoritative source for who users are and how they authenticate, including MFA and conditional access. SAP Cloud Identity Services act as a proxy and provisioning hub for SAP BTP, SuccessFactors, Ariba and S/4HANA cloud scenarios, translating identities into what SAP applications expect. For S/4HANA on IaaS, Fiori can trust Entra ID directly through SAML, and SAP GUI uses Kerberos SNC with Active Directory. Add SAP Cloud Identity Services when SAP SaaS or BTP apps are in scope.
Read the full page →Pricing depends on the number of SIDs, production criticality and coverage hours. A landscape of 3 production systems with their tiers under 24x7 coverage is usually priced as a monthly fee per SID, with patch cycles included. NTSPL quotes after a two-week discovery.
Read the full page →Not necessarily. Some clients hand over full Basis and cloud operations; others keep an internal Basis lead for design decisions and use NTSPL for 24x7 monitoring, patching and night shifts. The RACI is written before takeover.
Read the full page →We agree a freeze calendar with business owners covering month-end, quarter-close, GST filing weeks and seasonal peaks. Emergency security patches can still be applied with change approval, but planned cycles avoid those windows.
Read the full page →Yes. Monitoring data, alerts and operations logs are stored in Indian regions and retained for at least 180 days, supporting CERT-In directions and providing evidence for incident reporting within 6 hours.
Read the full page →If you use Solution Manager today, we integrate with it. For new monitoring scope, SAP Cloud ALM is SAP's direction, so NTSPL plans a staged move of job, integration and business process monitoring into Cloud ALM.
Read the full page →Yes for monitoring and first response. Cloud ALM integration monitoring covers Cloud Integration flows and interfaces, and our runbooks route failures to the integration owner with context.
Read the full page →SAP Focused Run is built for service providers and very large customers running hundreds of SAP systems, with deep SAP-side analytics, but it needs its own infrastructure and specialist skills. For most Indian enterprises with 5 to 30 SAP systems, cloud-native SAP monitoring combined with SAP Cloud ALM gives the right coverage: infrastructure, HANA and cluster signals from the cloud tool, business process and job monitoring from Cloud ALM, and no extra platform to run. NTSPL recommends Focused Run only when the SAP estate is large enough to justify a dedicated monitoring team.
Read the full page →For landscapes that have run on cloud for six months or more without SAP-specific cost work, 25 to 40 percent of SAP infrastructure cost is a common outcome, mostly from commitments and non-production schedules. Savings are reported as realized in the bill, not projected.
Read the full page →The initial rollout usually takes 20 to 30 consultant-days over eight weeks, followed by a monthly review as a managed service. Some clients prefer a fee linked partly to realized savings; NTSPL can structure either.
Read the full page →Usually yes for development and quality, with agreed calendars. Some systems must stay up for overnight jobs, interface tests or offshore teams. Basis confirms each SID's dependencies before scheduling.
Read the full page →We present cost per SID and environment in INR, mapped to cost centres and profit centres used in SAP controlling, so the CFO can see SAP IT cost by business unit. GST on cloud invoices is handled in the same report.
Read the full page →Azure Hybrid Benefit for Linux lets eligible RHEL and SLES subscriptions be applied to Azure VMs, which can reduce cost when you already hold enterprise subscriptions. NTSPL checks eligibility and support terms before switching.
Read the full page →Not automatically. RISE bundles infrastructure, Basis operations and licences into one subscription, so compare it with your full IaaS run cost including operations staff. NTSPL builds a like-for-like comparison at renewal points.
Read the full page →For production HANA that will stay on one instance family and size for three years, reservations or resource-based commitments usually give the deepest discount and apply cleanly to memory-optimized shapes. Flexible savings plans or spend-based commitments cost a little more but survive family or size changes, which suits application servers and systems likely to be resized after an S/4HANA conversion or acquisition. NTSPL typically reserves production and DR HANA once growth is understood, and covers application servers with flexible plans, keeping project systems on demand.
Read the full page →Typically 20 to 35 consultant-days over four to six weeks, depending on the number of SAP systems and whether proofs are needed. Proof capacity is often funded by providers' evaluation programmes, which NTSPL arranges without letting that influence scores.
Read the full page →NTSPL delivers SAP on all three and discloses partner relationships at the start. Weights are agreed before scoring and every score cites evidence, so the steering committee can check the reasoning independently.
Read the full page →AWS Mumbai and Hyderabad, Azure Central India, South India, West India and India South Central (Hyderabad), and Google Cloud Mumbai and Delhi. We check zone support, certified shape availability and DR pairing for each, which matters for DPDP Act 2023 data mapping and regulated group entities.
Read the full page →Yes. Under RISE, SAP runs the infrastructure but you still choose the hyperscaler. The evaluation then focuses on ecosystem fit, adjacent workloads, data paths to analytics and your existing agreements rather than infrastructure tooling.
Read the full page →Yes, SAP can be moved between clouds with HANA backup restore or replication, but it is a full migration project with downtime. That is why the decision record includes review triggers, such as a major acquisition or contract renewal.
Read the full page →They change the commercial score, sometimes significantly, and are shown transparently. But they should not override capacity, resilience or skills gaps. The evaluation separates agreement discounts from the underlying normalized cost.
Read the full page →Run SAP on one cloud and get resilience from zones and a second Indian region on that same cloud. HANA system replication, Pacemaker fencing, virtual IP handling and backup integration are all provider-specific, so spreading one SAP system across two clouds multiplies complexity without improving recovery in practice. A second cloud makes sense for different workloads, such as analytics on BigQuery or AI services, fed with SAP data through supported replication. NTSPL recommends cross-cloud SAP DR only where regulation or group policy explicitly requires provider diversity, and then plans it as backup-based recovery with a longer RTO.
Read the full page →Both models are supported, but the work differs. Under RISE with SAP, SAP runs the infrastructure and Basis layer, so NTSPL focuses on readiness, conversion, integration and the customer-side responsibilities. On your own AWS, Azure or Google Cloud account, NTSPL designs, builds and operates the full stack, including HANA, clusters, backup and cost.
Read the full page →SAP ECC 6.0, Suite on HANA, S/4HANA, BW on HANA, BW/4HANA, SAP CRM, SRM, PI/PO, Solution Manager, GRC and the NetWeaver Java and ABAP stacks behind them. SaaS products such as SuccessFactors or Ariba stay with SAP, and NTSPL covers only their integration paths and identity.
Read the full page →A like-for-like move of an existing HANA landscape takes 10 to 16 weeks. A brownfield ECC to S/4HANA conversion with a database change usually takes 6 to 9 months, driven mostly by custom-code remediation, finance data checks and at least two mock conversions rather than by infrastructure build time.
Read the full page →Yes. Production, DR and backups can all be kept inside India by pairing AWS Mumbai with Hyderabad, Azure Central India with South India, or Google Cloud Mumbai with Delhi. NTSPL also routes SAP security audit logs to an Indian-region store to support CERT-In's 180-day log retention requirement.
Read the full page →No. Many customers lift ECC to cloud first, sometimes migrating the database to HANA at the same time, and convert to S/4HANA later on cloud capacity. The right order depends on hardware expiry dates, custom-code volume and how much change the finance team can absorb in one year.
Read the full page →That is agreed in a written RACI before cutover. NTSPL can run Basis and the cloud platform together under one SLA, or run only the infrastructure, HANA and backup layers while your Basis team or an SAP AMS partner keeps application support, transports and authorization changes.
Read the full page →Pricing is usually per monitored resource or per service tier. For a typical Indian mid-market estate of 80 to 200 VMs, containers and databases, NTSPL's managed monitoring runs from about ₹1.5 lakh to ₹4 lakh a month, excluding native tool charges such as log ingestion. Onboarding is a fixed fee covering the first six weeks.
Read the full page →No. The NOC works with read and alert-management permissions through cross-account IAM roles on AWS, Azure Lighthouse delegation and Google Cloud IAM groups. Any remediation beyond restarting a service under an approved runbook goes through your change process or is escalated to your engineers.
Read the full page →It supports them. CERT-In's 2022 directions require reporting specified cyber incidents within 6 hours and keeping ICT system logs for 180 days within India. We configure retention in Indian regions and flag security-relevant events to your security team, but incident reporting itself sits with your designated point of contact.
Read the full page →Yes. Azure Arc, AWS Systems Manager hybrid activations and an OpenTelemetry Collector exporting to Google Cloud Observability all cover on-premises servers, so hybrid estates appear on the same health wall. We need outbound HTTPS from the servers or a private connection to the cloud.
Read the full page →Most clients see alert volume fall by half within the first month, mainly by removing duplicate and informational alarms. Getting to above 60% actionable alerts usually takes two to three monthly review cycles, because some thresholds need real incident data to tune.
Read the full page →The NOC engineer follows the runbook, gathers logs, recent deployments and graphs into the ticket, and then calls your named escalation contact by phone, not just email. If no one answers within 15 minutes, the next level in the matrix is called.
Read the full page →For estates under roughly 400 workloads, managed monitoring wins on cost. Three-shift coverage needs at least six to seven engineers once leave and attrition are counted, which in India runs ₹60-90 lakh a year before tools and supervision. A shared NOC spreads that over many clients, so you pay a fraction for the same acknowledgement time. In-house makes sense when monitoring is inseparable from product knowledge, for example a trading platform where each alert needs deep domain judgement, or when you exceed several hundred services and can keep a team busy. Many clients keep L3 in-house and outsource L1/L2 shifts.
Read the full page →It is usually bundled with 24x7 monitoring, adding roughly 30-40% to the monitoring fee for incident command, provider escalation and reviews. Standalone incident command for clients with their own monitoring starts at about ₹1.2 lakh a month for one production environment, with a fixed setup fee for the severity matrix, runbooks and game day.
Read the full page →The incident commander recommends and the service owner you nominate approves, ideally within a pre-agreed rule such as 'any P1 within two hours of a deployment triggers rollback unless the owner objects'. That rule removes most debate on the bridge.
Read the full page →Our P1 checklist includes a reportability check against the CERT-In incident categories at the 60-minute mark. If the incident may be reportable, we alert your designated point of contact and prepare the timeline and indicators. Filing the report remains your organisation's responsibility.
Read the full page →Yes. We work inside PagerDuty, ServiceNow, Jira Service Management or Freshservice, using your escalation policies and adding our commanders as responders. If you have no tool, we provide paging and ticketing through our ITSM instance and export every incident record and timeline to you monthly.
Read the full page →Only if agreed in advance. Most clients keep customer communication with their own support team, using our templated updates so wording is consistent. Where you prefer, we update a public status page directly, using a pre-approved template set and your brand voice, and never comment on cause before you approve.
Read the full page →The first gains come within four to six weeks, mainly from faster declaration and clear roles on the bridge. Deeper reductions come over two quarters, as review actions remove recurring causes and each repeat incident type gets its own tested restoration runbook.
Read the full page →Incident management restores service; problem management removes the cause. During an incident, rolling back a release or restarting a stuck service is the right move even if nobody yet knows why it broke. Problem management starts afterwards: it groups related incidents, investigates the underlying condition, such as a connection pool limit or an untested failover, and schedules a permanent fix. ITIL 4 treats them as separate practices for good reason. Teams that merge them either restore slowly because they insist on root cause first, or never fix anything because the pressure ends once service is back. NTSPL runs both, with separate owners.
Read the full page →We price on estate size and request volume. A typical estate of 100-250 resources with up to 80 requests a month starts around ₹1.8 lakh a month. The initial import and cleanup sprint is a fixed fee, usually four to six weeks of effort depending on how much is unmanaged.
Read the full page →No. If you have none, we generate code for existing resources using provider export tools and Terraform import blocks, then clean it into reusable modules. If you prefer Bicep on Azure or CloudFormation on AWS, we use those instead; the request, review and drift operating model stays the same.
Read the full page →Yes, in their sandbox and non-production accounts within policy limits on regions, sizes and spend. For production, they raise a catalogue request or submit a pull request themselves, which we review and apply. This keeps delivery speed while ending undocumented production changes.
Read the full page →We enforce allowed-region policies through SCPs on AWS, Azure Policy and Organization Policy on Google Cloud, typically limiting production to Mumbai and Hyderabad, Central and South India, or Mumbai and Delhi. That supports DPDP Act 2023 obligations and sector rules such as RBI's payment data storage directive.
Read the full page →We flag them in the lifecycle register and plan in-place or rebuild upgrades. Windows Server 2012 and 2012 R2 Extended Security Updates ended on 13 October 2026, so any remaining instances are now unpatched and are treated as priority exceptions with isolation until upgraded.
Read the full page →Yes. We often run infrastructure while another vendor supports the application. A RACI agreed at onboarding defines who owns which layer and who approves what, and shared tickets carry both teams' notes, so handoffs during an incident or a change window do not lose context.
Read the full page →One DevOps engineer can run a small estate, but becomes the bottleneck and single point of failure as soon as requests exceed 30-40 a month or the estate spans two clouds. Leave, attrition or a production firefight stops all infrastructure work. A managed service gives you a team with defined SLAs, multi-cloud skills and continuity, at a cost often similar to one senior hire in Bengaluru or Pune. The better pattern for growing companies is both: keep a platform lead in-house who owns architecture and priorities, and let NTSPL carry the request queue, drift, lifecycle and hygiene work.
Read the full page →Pricing depends on the number of protected resources and restore-test frequency. For about 100-300 protected VMs, databases and file shares, NTSPL's service usually runs ₹70,000 to ₹1.8 lakh a month, excluding provider backup storage charges. Additional restore tests beyond the monthly sample are priced per test.
Read the full page →For managed databases with point-in-time recovery, a restore to a new instance typically starts within one hour of an approved request, and completion depends on size. Our SLA covers starting the restore and keeping you updated; the database team confirms data before applications are repointed.
Read the full page →No. Tests restore into an isolated account, subscription or project in the same Indian region, with no network path to production. Test instances are shut down and deleted after verification, normally within seven days, and their cost is reported separately in the monthly report.
Read the full page →There is no single number. Sector rules, tax and company law records and contracts set minimums, while the DPDP Act 2023 expects personal data not to be kept beyond its purpose. We document retention per data class with your compliance team and apply it per policy, rather than keeping everything for years by default.
Read the full page →Yes. Many hybrid estates use Veeam, Commvault or Rubrik alongside native cloud services. We operate those consoles for daily job review, restores and restore testing, provided we have a scoped operator role and the product is on a version its vendor still supports.
Read the full page →A monthly pack with coverage percentage, success rate, failure causes and fixes, the list of exclusions with owners, and restore-test records showing system, recovery point used, time taken and validation result. These map to backup and recovery controls in ISO 27001 and sector frameworks.
Read the full page →Architecture decides what is protected, how often, for how long and where: policies, vaults, retention, immutability and cross-region copies. Operations makes sure that design keeps working every day as the estate changes. If you have no vaults, inconsistent retention or no immutability, you need architecture first, typically a two to four week engagement. If the design exists but you cannot prove restores, failures pile up or new resources go unprotected, you need operations. Most estates two years after migration need operations more than redesign, with small architecture fixes such as adding vault lock made during onboarding.
Read the full page →We price per server per month, with lower rates for rebuilt image-based tiers. For 100-300 Windows and Linux servers, expect roughly ₹900 to ₹1,800 per server per month including baseline enforcement and reporting. Onboarding, covering ring design and baseline definition, is a fixed fee.
Read the full page →For load-balanced or clustered tiers, yes, by draining and patching nodes in separate waves. Single-instance servers need a reboot window, usually 15-30 minutes. We list single points of failure during onboarding so you can decide whether to add redundancy or accept a window.
Read the full page →Regulated entities are expected to have a documented patch management process with risk-based timelines and evidence. RBI's 2023 Master Direction on IT governance and SEBI's CSCRF both cover vulnerability and patch management. Our ringed process, deadlines, exception register and monthly reports provide that evidence; your CISO owns the policy.
Read the full page →Legacy servers, such as an application certified only on an old OS, get an exception with compensating controls: network isolation, restricted admin access, extra monitoring and a dated upgrade plan. Windows Server 2012 now falls into this group, as its Extended Security Updates ended on 13 October 2026.
Read the full page →We patch OS-level packages and common middleware such as IIS, Apache, Nginx and Tomcat. Database engine minor versions running on VMs are patched in coordination with Managed Database Operations, because they need replica-first sequencing, a tested rollback and application checks before the primary is touched.
Read the full page →Most estates reach a median critical patch latency under 14 days within two monthly cycles, once rings and windows are agreed. The 72-hour target for actively exploited vulnerabilities applies from the first month, because emergency waves run outside the regular schedule and do not wait for the next window.
Read the full page →Use the native tool of the cloud where the server runs, and avoid WSUS for cloud fleets. WSUS needs its own servers, handles only Windows and offers limited reporting. Azure Update Manager covers Windows and Linux in Azure and, through Azure Arc, on-premises and other clouds, which makes it a strong single console for Azure-first hybrid estates. Systems Manager Patch Manager does the same for AWS and hybrid nodes. For a genuinely multi-cloud fleet, NTSPL runs each native tool under a common ring and deadline policy and merges compliance into one report, rather than forcing one tool everywhere.
Read the full page →Monthly reviews and regression checks for five to ten key services typically cost ₹80,000 to ₹2 lakh a month. Peak-event load tests are priced per event, usually ₹1.5-4 lakh including scripting and the war room, plus the cloud cost of the test environment for a few hours.
Read the full page →Regional vCPU and instance-family quotas in Mumbai or Pune, database connection limits, NAT gateway ports, and rate limits at SMS, OTP and payment partners. OTP delivery limits in particular fail login journeys on big days even when every cloud component has headroom.
Read the full page →No. We identify the bottleneck with traces and profiles and tell your developers exactly which query, call or pool size needs to change. We do change infrastructure configuration, scaling policies, connection pooling and caches under your change process. Every infrastructure change is tested against the same load profile first.
Read the full page →Six weeks is comfortable: two weeks to model and request quotas, two weeks for fixes, and two weeks for load tests and a rehearsal. Two weeks is possible if quotas are already adequate, but leaves no room to fix what the test finds.
Read the full page →We avoid it. Test data is synthetic or masked so that load tests do not process personal data under the DPDP Act 2023. Masked production-sized data sets keep realistic volumes and distributions without real names, numbers or addresses. Masking scripts are kept in your repository for reuse.
Read the full page →A table per service listing each component, its tested ceiling expressed in business units such as logins per minute, current peak usage, forecast peak and headroom. Anything under 30% headroom has an action and owner next to it. The business reads it in its own units, not CPU percentages.
Read the full page →Autoscaling handles elastic tiers; capacity management handles everything autoscaling cannot see. Scaling policies react to load within limits you set, and still fail when a regional vCPU quota, a database connection ceiling, a NAT port limit or a partner API rate limit is reached. They also react with a delay, which matters when traffic jumps 10x in a minute at a results announcement. Capacity management finds those ceilings, raises them before they matter and pre-warms for known spikes. For steady, gently varying traffic, autoscaling alone is often fine; for event-driven Indian businesses, it is not.
Read the full page →Pricing depends on accounts or subscriptions monitored and alert volume. For 10-40 accounts, expect roughly ₹2.5-6 lakh a month for 24x7 triage, containment and monthly reporting, excluding native detection and SIEM charges. Onboarding with backlog triage is a fixed fee.
Read the full page →It supplies the continuous monitoring, response and reporting evidence those frameworks ask for in cloud environments. SEBI's CSCRF and RBI's IT governance directions place accountability on the regulated entity, so your CISO keeps ownership and approves our authority matrix and reports.
Read the full page →Every confirmed incident is checked against CERT-In's reportable categories, and if applicable we alert your designated point of contact immediately with a draft containing timeline, affected resources and indicators, so the report can go out within the 6-hour window. Filing remains with your organisation.
Read the full page →Analysts see metadata such as resource names, principals, IPs and API calls, not database contents. Where an investigation needs data access, it is approved per case and logged. This supports purpose limitation under the DPDP Act 2023. Investigation notes record what data was viewed and why.
Read the full page →Yes. We forward cloud detections and enriched cases into Splunk, QRadar, Microsoft Sentinel, Google Security Operations or a similar SIEM, and work cases there so your SOC sees the same record. We avoid duplicating raw cloud log ingestion into two platforms, which usually doubles cost without improving detection.
Read the full page →An assessment is a point-in-time review of your configuration that ends with a findings report and a roadmap. Security operations is continuous: it works new detections every day and night, runs containment when something is real, and keeps the posture remediation queue moving month after month with owners and dates.
Read the full page →A traditional SOC watches network and endpoint telemetry and is skilled at malware and lateral movement inside a corporate network. Cloud attacks look different: a leaked access key, a role assumed from an unusual region, a storage policy made public, a cryptominer launched in a region you never use. Investigating them needs fluency in IAM, audit logs and provider APIs, and containment means API calls rather than unplugging a laptop. Many Indian enterprises keep their existing SOC for endpoints and add cloud security operations from NTSPL, with detections forwarded to the SOC's SIEM so both teams share one case record.
Read the full page →Either a fixed monthly fee based on spend under management, typically ₹75,000 to ₹2.5 lakh, or a lower fixed fee plus a share of verified savings for the first year. We prefer fixed fees once the estate is stable, so incentives do not push towards risky cuts.
Read the full page →Schedules and the first cleanup batch usually show on the next monthly bill, often 8-15% of spend. Rightsizing and commitment changes add more over the following two to four months as changes go through change windows. The savings ledger shows each change against the bill.
Read the full page →Read access to billing and resources is enough to start. For scheduling and cleanup, we use a scoped role that can stop and start tagged non-production resources and delete only resources with an approved ticket. Production changes go through your change process.
Read the full page →Yes. We allocate costs by tags, accounts, subscriptions or projects and report in INR, including GST treatment as invoiced by the provider or your reseller, so finance sees business-unit costs that reconcile to the invoice. Untagged spend is shown separately with a named owner for fixing it.
Read the full page →We schedule non-production node pools and remove idle clusters as part of this service. Detailed per-namespace cost allocation, requests-and-limits tuning and bin-packing are a separate Kubernetes FinOps engagement, because they need application-level analysis with your developers and a different cadence.
Read the full page →Only outside agreed hours. Developers can extend a window themselves with a tag or a chat command, and we review overrides weekly with team leads. Most teams stop noticing schedules within a month, and release weeks can be exempted in advance through the release calendar.
Read the full page →Governance sets the rules; operations does the work. FinOps governance defines who owns spend, how costs are allocated, what KPIs matter and how leadership reviews them. Cost operations is the weekly execution: triaging anomalies, applying schedules, deleting idle resources and tracking commitments. If you have no tagging or ownership, operations has nobody to send tickets to, so start with a light governance setup of two to four weeks. If governance exists but savings never arrive, operations is the missing piece. Most mid-size Indian companies need a little of the first and a lot of the second.
Read the full page →We price per database instance by tier. For a typical estate of 5-15 production instances across engines, expect ₹60,000 to ₹2.2 lakh a month, covering weekly reviews, monthly reports, quarterly drills and up to an agreed number of upgrade cutovers per year.
Read the full page →Yes. We plan the version path, rehearse on a clone with your test suite, compare query plans, schedule the cutover and run it with rollback ready. Your team confirms application behaviour before and after. Each upgrade has a written go or no-go checkpoint before the cutover begins.
Read the full page →Amazon RDS and Google Cloud SQL charge extra to keep running some major versions after end of standard support. Upgrading before that date avoids the charge; we keep a version register so the upgrade starts six months ahead. Other engines and providers have their own end-of-support policies, which the register tracks too.
Read the full page →We need administrative access to databases but avoid reading business data. Access runs through just-in-time roles with session logging, and any task requiring data inspection is approved by ticket. This supports purpose limitation and access logging under the DPDP Act 2023.
Read the full page →Yes, for SQL Server, PostgreSQL, MySQL and MongoDB on VMs, with additional duties such as OS-level backup checks and engine patching. Oracle on VMs is supported for operations tasks, though licensing questions stay with you. Coverage includes replication checks and backup verification.
Read the full page →Through tickets that contain the statement, plan and suggested change, tested on a clone. We join sprint planning once a month to prioritise database work, and review migrations on large tables before release. Urgent fixes during incidents bypass the queue through the bridge.
Read the full page →Yes, though less of one. Providers handle host patching, backups, storage and the mechanics of high availability. They do not tune your queries, decide when and how to move to the next major version, check that your application survives a failover, review who has access, or plan for a table that will triple next year. Those tasks need perhaps a quarter to half of a DBA's time for a typical mid-size estate, which is why a shared remote DBA service fits better than a full-time hire. Large estates with dozens of busy databases may justify an in-house DBA plus our cover for nights and drills.
Read the full page →We price per cluster by size and criticality. A production cluster with up to about 50 nodes typically costs ₹1-2.5 lakh a month including quarterly upgrades, monthly node refresh, add-on lifecycle and 24x7 cluster incident response. Non-production clusters are priced lower.
Read the full page →We plan sequential upgrades, one minor version at a time, typically two to three weeks apart after deprecated APIs are fixed. Where the gap is large or the cluster is heavily drifted, a blue-green rebuild on the current version can be faster and safer.
Read the full page →We support the cluster layer and deployment tooling such as Argo CD or Flux. Application rollouts, Helm values and code-level failures stay with your teams, though we diagnose whether a problem sits in the cluster or the application during incidents.
Read the full page →We keep node images patched within the timelines your compliance programme sets, such as one month for critical patches under PCI DSS, enforce admission policies, and keep clusters for regulated payment data in Indian regions in line with RBI's data storage directive. Evidence is included in monthly reports.
Read the full page →Yes. Many clients run EKS and AKS or GKE together. We keep one version register and add-on matrix across all clusters and align upgrade trains, while respecting each provider's maintenance and release mechanisms. Upgrade trains are aligned so clusters stay on the same minor version.
Read the full page →Yes, at a lighter level and lower price. Amazon ECS, Cloud Run and Azure Container Apps have no node or Kubernetes version upgrades for you to run, so we focus on task and revision health, scaling settings, base image patching, secrets rotation and 24x7 incident response for the services.
Read the full page →The provider manages the control plane: API server availability, etcd and the Kubernetes binaries. You still own choosing when to upgrade, checking your manifests for removed APIs, upgrading nodes, maintaining add-ons, setting PDBs and responding when pods will not schedule. GKE Autopilot and EKS Auto Mode take on more of the node layer, but upgrades and add-ons remain your problem. Managed operations fills that gap with a team that runs upgrades every quarter across many clusters, so the process is routine rather than a yearly crisis.
Read the full page →For an organisation with 20-80 accounts, subscriptions or projects, NTSPL typically charges ₹1-2.5 lakh a month for vending, exception management, monthly reviews and policy upkeep. Building or repairing the vending pipeline is a fixed one-time fee, usually four to six weeks of effort.
Read the full page →Yes. Allowed-region policies in SCPs, Azure Policy and Organization Policy restrict production to Indian regions such as AWS Mumbai and Hyderabad, Azure Central, South and West India, and Google Cloud Mumbai and Delhi. Global services such as IAM need carefully scoped exceptions.
Read the full page →We map each policy to the relevant control in RBI's IT governance directions, SEBI CSCRF or IRDAI's cyber security guidelines. Compliance data then becomes audit evidence, showing enforcement, exceptions with approval and monthly review records. Auditors can sample any policy and trace it to enforcement.
Read the full page →Your CCoE lead or CISO, according to a matrix agreed at onboarding. NTSPL prepares each request with risk, compensating controls and expiry, and implements it once approved. We do not approve exceptions ourselves. Every approval is logged against the exception record.
Read the full page →No. Your CCoE sets direction and makes decisions. We run the recurring tasks, prepare the monthly review and implement agreed changes, which lets a small CCoE of two or three people govern a large estate. Decision rights stay entirely with you.
Read the full page →Sandboxes in under an hour, non-production within one working day and production within two working days. Each arrives with network attachment, central logging, budgets, mandatory tags and baseline policies already applied, so teams can deploy immediately without a follow-up request to the platform team.
Read the full page →An operating model decides who does what: the CCoE's remit, decision rights, roles, skills and processes. Governance operations is the monthly execution of the rules that model sets. If nobody agrees who approves production accounts or owns the policy baseline, an operating model assessment comes first. If those roles exist but policies drift, exceptions pile up and new accounts take weeks, governance operations is what is missing. Most organisations two years into cloud already have a workable model on paper and need the operational rhythm to make it real.
Read the full page →For clients on NTSPL managed services, monthly reporting and quarterly reviews are included. Standalone reporting across your own teams or other vendors starts at about ₹60,000 a month, with a one-time setup fee for the measure catalogue and data pipeline.
Read the full page →Yes, if their monitoring and ticket data can be accessed. We apply the same measure definitions to every provider so performance can be compared fairly, which is useful when you run multiple managed service partners. Vendors keep their own tools; we only need read-only exports.
Read the full page →Regulated entities must monitor and review the performance of IT service providers. RBI's 2023 Master Direction on outsourcing of IT services expects ongoing oversight. Our monthly reports, review minutes and registers form a documented record of that oversight. Your board can review it directly.
Read the full page →Raw data is available to you, and every measure has a written formula. We reconcile disputes against source data within five working days. Most disagreements disappear after the first calibration month. Agreed corrections are applied and noted in the next report.
Read the full page →Yes. Each report shows spend by service in INR, the change from last month with reasons, commitment utilisation and savings actions taken, aligned with Cloud Cost Operations if you use it. Finance gets the same figures as the invoice reconciliation.
Read the full page →Reports use aggregated measures and ticket metadata, not personal data. The reporting store sits in an Indian region with access limited to named people, consistent with DPDP Act 2023 purpose limitation. Access to the store is reviewed quarterly and logged.
Read the full page →Both, for different audiences. An SLA is a contractual promise with consequences, such as service credits, and should cover only a few measures the business cares about, set at a level the provider can reliably meet. An SLO is an internal engineering target, usually tighter than the SLA, used to decide when to slow releases or invest in reliability. Reports should show SLO attainment and error-budget burn, because they warn early, and SLA attainment, because it settles accountability. If you track only SLAs, problems surface when it is too late to act.
Read the full page →Yes, and most clients do. A common starting set is 24x7 monitoring, incident management and backup operations, adding patching, databases or cost operations later. Each service has its own scope and SLA, and a RACI shows which tasks stay with your team, so there are no grey areas at handover.
Read the full page →Through delegated, least-privilege access you control: cross-account IAM roles on AWS, Azure Lighthouse on Azure and IAM groups on Google Cloud. Elevated actions use just-in-time access with session logging. You can revoke access at any time, and all infrastructure code stays in your repositories.
Read the full page →Yes. Transition usually takes six to ten weeks: knowledge capture and shadowing, a parallel-run period, then cutover with a signed acceptance. We inventory runbooks, credentials, open tickets and known problems from the outgoing provider before taking primary ownership.
Read the full page →We keep logs and evidence in Indian regions with 180-day retention for CERT-In, enforce data residency through policy, and map reports to RBI, SEBI CSCRF or IRDAI controls where you are regulated. Regulatory accountability stays with your organisation; we provide the operational evidence and the outsourcing oversight records.
Read the full page →For a mid-market estate of 100-300 workloads taking monitoring, incident management, patching, backups and monthly reporting, combined fees usually fall between ₹4 lakh and ₹10 lakh a month, excluding cloud consumption. Onboarding is a fixed fee per service, typically recovered through cost operations savings within the first year.
Read the full page →Yes. Our NOC and engineering teams work from India in three shifts, so night-time and weekend coverage does not depend on offshore hand-offs. Escalation contacts, review meetings and reports follow IST, and quarterly reviews can be held in person for clients in major Indian cities.
Read the full page →For 10-40 accounts or subscriptions across one or two clouds, NTSPL typically completes the review in three to five weeks at INR 6-14 lakh, depending on the number of regulated workloads that need manual attack-path review. Native tool charges during the review, such as Security Hub or Defender trials, are usually a few thousand rupees a month and stay with your account.
Read the full page →No. We work only through read-only roles such as AWS SecurityAudit plus ViewOnlyAccess, Azure Reader and Security Reader, and Google Cloud Security Reviewer. You deploy the role yourself, keep the right to revoke it, and no long-lived keys are issued to NTSPL engineers.
Read the full page →It helps by fixing exposures auditors find, but it is not an audit opinion. Findings reference the control areas in RBI's IT governance master direction or SEBI's CSCRF where relevant, so your compliance team can show remediation. A formal control-by-control evidence pack is produced under Compliance Control Mapping.
Read the full page →Yes. CERT-In's April 2022 directions require ICT system logs to be kept for a rolling 180 days within India. We check, per account and region, whether audit and flow logs are enabled, where they are stored and for how long, and flag any log bucket or workspace outside Indian regions.
Read the full page →Native tools produce raw findings, often hundreds per account, with generic severity. The review adds an estate inventory the tools cannot see, external reachability checks, identity analysis based on real activity, manual attack-path chaining and a ranked plan with owners. Teams that simply switch tools on often stall at a 30-40% secure score.
Read the full page →Yes, provided the accounts sit under your organisation or you can obtain a read-only role from the vendor. Vendor-held accounts are a frequent source of critical findings, so we include them by default and share the vendor-specific findings with them in a separate pack.
Read the full page →Start with the security assessment. A penetration test probes a defined scope, usually a few applications or IP ranges, and tells you whether a skilled attacker can break in there. It will not tell you that 11 accounts lack audit logs, that 140 users hold keys older than a year, or that a snapshot is shared publicly. A posture review covers the whole estate's configuration in weeks and fixes the cheap, high-impact gaps first. Commission the penetration test afterwards, scoped to the internet-facing applications the review flags as highest risk, so testers spend their days on real paths instead of rediscovering misconfigurations.
Read the full page →For 200-600 cloud users across one or two clouds, expect 10-12 weeks. NTSPL fees are typically INR 12-25 lakh depending on vendor count and workload key replacement. Licensing is extra: Entra ID P2 or ID Governance for users who elevate, while AWS IAM Identity Center carries no separate charge.
Read the full page →No. Each team moves in a wave after a pilot, with federated and old access running side by side for up to two weeks. Local users and keys are deleted only after the team confirms clean federated use, and tested break-glass accounts cover any identity provider outage.
Read the full page →Yes. SEBI's Cybersecurity and Cyber Resilience Framework of August 2024 and RBI's IT governance master direction both expect controlled, logged and reviewed privileged access. Time-boxed elevation with approvals, quarterly access reviews and 180-day sign-in logs give auditors direct evidence for those control areas.
Read the full page →Phishing-resistant MFA uses FIDO2 security keys, passkeys or certificate-based authentication, which cannot be relayed by a fake login page the way OTPs and push prompts can. We require it for anyone who can elevate to admin; standard users can stay on authenticator app MFA initially.
Read the full page →On AWS we use IAM Roles Anywhere with certificates from your private CA. On Google Cloud, Workload Identity Federation can trust an on-prem OIDC or SAML issuer. On Azure, Arc-enabled servers receive a managed identity. Any system that cannot use these gets a key in a vault with 90-day rotation.
Read the full page →Vendors with many staff on your estate should federate their own identity provider so their leavers are removed automatically. Smaller vendors sign in as guests with your MFA policy. Either way, they receive eligible roles scoped to their accounts that expire with the contract.
Read the full page →For cloud control-plane access, native tools win in most Indian estates. Entra PIM, Google Cloud Privileged Access Manager and Identity Center permission sets give just-in-time elevation with approvals and logs, at a fraction of the cost of a PAM suite, and they cannot be bypassed by signing in directly. A PAM vault such as CyberArk or a similar product still earns its place for session recording on servers, network devices and databases, and for shared OS root credentials. The usual answer is both: native elevation for the cloud consoles and APIs, the vault for host and database sessions.
Read the full page →NTSPL's design and build for a single cloud with 10-30 spokes typically runs INR 12-22 lakh over 9-12 weeks. Run costs depend on the firewall: a managed firewall in two Availability Zones plus data processing often lands between INR 1.5 and 4 lakh a month per region for mid-size estates.
Read the full page →Vendors move to identity-based access through Session Manager, Azure Bastion or Identity-Aware Proxy, signing in with their own accounts and MFA. Access is logged per session, which most vendors find simpler than managing IP allowlists, and you can revoke it instantly.
Read the full page →Flow logs and firewall logs from every spoke are sent to a central store or SIEM in an Indian region and kept for at least 180 days, matching CERT-In's April 2022 directions. Clock sources are aligned so timestamps hold up during incident reporting.
Read the full page →For outbound traffic from servers, inspecting connections to uncategorised domains catches most command-and-control and exfiltration attempts. Full decryption of all traffic is rarely worth the certificate management effort. We usually decrypt selectively and leave regulated portals and pinned applications on bypass.
Read the full page →Yes. Spokes are moved behind the hub one at a time during agreed windows, with flow logs confirming each application's traffic before and after. Rules start permissive and logged, then tighten, so most migrations complete without user-visible impact. Database replication and HL7 or API integrations are moved last, after a dry run.
Read the full page →Zoning separates groups of workloads by sensitivity and inspects traffic between them. Micro-segmentation applies identity-based rules per workload, so two servers in the same zone cannot talk unless explicitly allowed. We combine both: zones at the firewall, micro-segmentation through security groups and NSGs.
Read the full page →Choose the cloud-native firewall unless you have a hard requirement it cannot meet. AWS Network Firewall, Azure Firewall Premium and Cloud NGFW Enterprise scale automatically, need no patching or HA design, and are managed through the same Terraform and policy tooling as the rest of the estate. A virtual appliance from Palo Alto, Fortinet or Check Point makes sense if your SOC is built around that vendor's console, you need identical rules on-prem and in cloud, or you need features like user-ID-based policy. Expect appliances to cost more in licences and operations time, and plan for throughput limits per instance.
Read the full page →NTSPL's tuning engagement for two to five applications typically costs INR 6-12 lakh over six to seven weeks. Run costs vary: WAF and bot management are billed per rule and per million requests, often INR 30,000-2 lakh a month for Indian consumer apps, while DDoS response plans add a fixed annual or monthly fee.
Read the full page →A WAF alone with IP rate limits stops only crude attacks. Credential stuffing now uses residential proxies across thousands of IPs, so you need bot signals, client-side tokens and checks against known breached credentials, such as AWS WAF ATP or reCAPTCHA Enterprise signals, combined with MFA on the application.
Read the full page →Government websites and applications in India are generally expected to clear a security audit by a CERT-In-empanelled auditor before hosting. A tuned WAF does not replace that audit or code fixes, but it closes the OWASP findings auditors commonly retest while developers remediate, and provides logs for CERT-In incident reporting.
Read the full page →Every rule runs in count mode first through a peak day, and we measure matches against logged-in, paying sessions. Challenges replace blocks for uncertain traffic, synthetic checkout tests run continuously, and a false-positive report from customer support is reviewed within one business day.
Read the full page →Yes. Mobile apps integrate the provider's SDK or reCAPTCHA mobile SDK to attach tokens to requests, which lets the WAF tell the genuine app from scripts calling the API directly. Schema validation at the API gateway then rejects malformed or undocumented calls.
Read the full page →Yes. PCI DSS requirement 6.4.2 expects an automated technical solution that detects and prevents web attacks in front of public-facing web applications, and a tuned WAF in blocking mode meets that. Payment page script controls under 6.4.3 and 11.6.1 need separate client-side measures.
Read the full page →If your applications sit on one cloud and your main problems are OWASP attacks, bots on login and sign-up, and DDoS, the native WAF is usually enough and far simpler to operate: AWS WAF with Bot Control and Fraud Control, Front Door Premium, or Cloud Armor with reCAPTCHA Enterprise. Choose a third-party WAAP when applications span several clouds and on-prem data centres and you want one policy, when you need advanced client-side script protection for PCI DSS payment pages, or when your traffic is large enough that bundled CDN pricing beats native egress. Avoid running both in series without clear ownership.
Read the full page →For an estate with 100-300 data stores, NTSPL's engagement typically runs INR 10-20 lakh over ten weeks. Scanner charges are separate and depend on volume; with sampling-based discovery most mid-size Indian estates spend INR 25,000-1.5 lakh a month after the baseline scan.
Read the full page →Built-in detectors vary by provider and some cover Indian identifiers, but coverage of policy numbers, ABHA numbers, UHIDs and internal customer IDs always needs custom identifiers. We build and test regex, checksum and keyword-proximity rules on sample data before full scans to keep false positives manageable.
Read the full page →The DPDP Act 2023 requires data fiduciaries to take reasonable security safeguards to prevent personal data breaches and to notify the Data Protection Board and affected individuals of a breach. Failing to take those safeguards can attract a penalty of up to INR 250 crore.
Read the full page →Possibly, so we check first. Load balancer and endpoint logs show negotiated TLS versions per client for a few weeks; old Android devices, legacy partner integrations and embedded devices are the usual stragglers. They get a dated exception on a separate endpoint while partners upgrade.
Read the full page →No. Use them where they add control: restricted data, datasets you may need to crypto-shred, and stores requiring separation between key administrators and data administrators. Provider-managed keys are fine elsewhere. Key hierarchy and rotation design are covered under Secrets & Key Management.
Read the full page →Discovery scans run on non-production accounts as well, deny policies block copying restricted-class resources across environment boundaries, and masked or synthetic datasets are generated by an approved pipeline. Any restricted finding in non-production opens a ticket with a 7-day closure target.
Read the full page →No. Encryption at rest protects against stolen disks and some misdirected snapshots, but most cloud data leaks happen through valid access paths: a public bucket, an over-privileged role, a test copy of production or a bulk export by an insider. The DPDP Act expects reasonable security safeguards, which regulators and courts will read as knowing where personal data is, restricting who can reach it, preventing it leaking to the wrong place and being able to detect and report a breach. Treat encryption as the baseline, then spend most effort on discovery, access restriction, non-production rules and leak detection.
Read the full page →NTSPL's 12-week build of standards, routing, remediation and guardrails typically costs INR 10-20 lakh for one or two clouds. Ongoing tool charges depend on resource counts: Security Hub and Config, Defender CSPM and SCC Premium usually total INR 50,000-4 lakh a month for mid-size Indian estates.
Read the full page →Yes. Defender for Cloud connects AWS accounts and GCP projects through multicloud connectors and assesses them against built-in standards, including CIS benchmarks, alongside Azure. It suits organisations whose SOC already works in the Microsoft security stack. Plan connector permissions carefully and confirm which Defender plans you enable on each cloud.
Read the full page →It provides continuous evidence that configuration controls are monitored and fixed, which auditors increasingly expect instead of point-in-time screenshots. Exported compliance reports, exception registers and remediation tickets show control operation over the audit period. Mapping to specific regulatory clauses is done under Compliance Control Mapping.
Read the full page →Mid-size Indian estates with 20-60 accounts or subscriptions usually start with 1,500-5,000 open findings. Tuning standards and deduplicating typically removes 25-40% of them before any fix. The remaining backlog is burnt down by owners, with automation clearing a large share of logging and encryption defaults.
Read the full page →For the right findings, yes. We automate only reversible changes that do not alter application behaviour, run each runbook in notify-only mode first, and respect change-freeze tags. Anything touching network rules or permissions on live workloads goes to the owner as a ticket instead.
Read the full page →Application and platform teams should own fixes for the resources they run; security owns the standards, severity model, exceptions and reporting. Routing findings to the people who can change the resource is the single biggest factor in shrinking the backlog.
Read the full page →Start native unless your estate is large and spread across three clouds. Security Hub, Defender for Cloud and Security Command Center cover configuration checks, attack paths in their premium tiers and integration with each cloud's own policy engine, at lower cost. A CNAPP earns its licence when you need one graph across AWS, Azure and GCP, agentless vulnerability and secrets scanning on workloads, and deep Kubernetes context in one place, typically above 2,000 workloads. Whatever you choose, the operating model of owners, SLAs, auto-fixes and preventive policies decides outcomes; a CNAPP without it produces a bigger backlog.
Read the full page →NTSPL's ten-week setup typically costs INR 8-16 lakh depending on account count and image pipelines. Scanner charges are per instance, image or function scanned; for a 300-500 VM estate with a container platform, native scanning usually costs INR 60,000-2.5 lakh a month.
Read the full page →Because CVSS critical often covers thousands of instances, many never exploited in the wild or sitting on unreachable systems. Adding EPSS probability, CISA KEV status and exposure focuses effort on the 2-5% that attackers actually use, and gets those fixed within days rather than months.
Read the full page →Extended security updates for Windows Server 2012 and 2012 R2 ended on 13 October 2026, so new flaws will not be fixed. Upgrade in place or rebuild on a supported release; until then, isolate the server, remove internet egress and monitor it closely under a time-limited exception.
Read the full page →Regulators expect a documented, risk-based patch management process with timelines and evidence, rather than one fixed number for every system. Our priority bands, SLA reports and exception register give auditors that evidence, and CERT-In advisories are added as a trigger for out-of-cycle P1 patching.
Read the full page →Containers should not be patched in place. The fix is to update the base image or dependency, rebuild, rescan and redeploy. We automate weekly base image rebuilds and trigger application rebuilds when a P1 or P2 CVE affects a base layer they use.
Read the full page →The key measure is exposure window: how many days a high-priority vulnerability remains open on a reachable asset. We also track scanner coverage, SLA compliance by band, image age and exception counts, published weekly by team so owners see their own numbers.
Read the full page →For cloud-only estates, native scanners now cover most needs: Amazon Inspector, Defender Vulnerability Management and Artifact Analysis scan VMs, images and functions, integrate with patch tools, and cost less. A commercial scanner remains the better choice when a large share of servers sits on-premises or in colocation, when the security team already runs a mature Qualys or Tenable programme with years of reporting, or when you need authenticated network scanning of appliances and databases. Many Indian enterprises run both: the commercial tool for on-prem and network scanning, native tools for cloud workloads, with findings combined in one priority model.
Read the full page →NTSPL's 12-week design and build typically costs INR 14-28 lakh, depending on the number of clouds, SIEM choice and custom rules. Run costs depend on volume; with tiering and filtering, mid-size Indian estates commonly spend INR 1.5-6 lakh a month on ingestion and retention.
Read the full page →CERT-In's directions of April 2022 require organisations to enable logs of ICT systems, maintain them securely for a rolling 180 days within Indian jurisdiction, and provide them when required for incident reporting. They also require clocks synchronised to NIC or NPL NTP servers or traceable sources.
Read the full page →Identity sign-in logs and control-plane audit logs come first, because most cloud attacks begin with stolen credentials and continue through API calls. Next come threat detector findings, key and secret access logs, WAF logs and DNS logs. Flow logs are valuable for investigation but rarely the first signal.
Read the full page →Yes. Sentinel has connectors for AWS CloudTrail, GuardDuty and other AWS logs through S3 and SQS, and for Google Cloud audit logs through Pub/Sub. It works well for organisations whose identity and endpoints are already in Microsoft, though cross-cloud data transfer costs should be estimated.
Read the full page →Each rule ships with a test case. We run attack simulations with open-source tools such as Stratus Red Team and Atomic Red Team in a controlled account, confirm the rule fires with the right entities, and repeat monthly so regressions are caught when services or log schemas change.
Read the full page →Yes. Security logs belong in a dedicated log archive account, subscription or project with restricted access, so an attacker who compromises a workload account cannot delete evidence. Object lock or immutable storage policies add further protection for the 180-day trail.
Read the full page →Native threat detectors are essential but not sufficient once you have more than a handful of accounts or any compliance obligation. They detect known bad patterns well, such as crypto-mining, malicious IPs and credential exfiltration, but cannot correlate a suspicious sign-in in Entra ID with a key creation in AWS and a bulk download from GCP, and they do not hold your 180-day searchable trail. A small single-cloud start-up can begin with native detectors plus central log retention. Anyone regulated by RBI, SEBI or IRDAI, or running two clouds, should add a SIEM with custom rules.
Read the full page →For 20-60 applications, NTSPL's engagement typically runs INR 10-20 lakh over 10-12 weeks. Vault charges are modest, usually a small monthly fee per secret plus API calls, so most estates spend INR 10,000-60,000 a month. Dedicated HSMs are a significant addition, often several lakh a month per cluster.
Read the full page →Rotate the credential immediately; deleting the commit does not help because forks and scrapers copy it within minutes. Then check access logs for use of that credential since the commit time, scope the impact and, if personal data or financial systems were reachable, assess CERT-In and DPDP reporting duties.
Read the full page →Regulators generally require strong key management and protection of cryptographic keys rather than naming a specific product. Card scheme rules, PCI requirements and some contracts with banks call for HSM-protected or dedicated hardware for certain keys. We map each requirement to the minimum control that satisfies it.
Read the full page →With BYOK you generate key material in your own HSM and import it into the cloud KMS, which then holds and uses it. With hold-your-own-key or external key management, key material stays outside the provider and each use is a call to your key manager, so revocation is immediate but availability depends on you.
Read the full page →Yes, if the pattern is right. Managed database rotation and our rotation functions create a new credential while the old one stays valid, applications refresh from the vault within minutes, and the old credential is revoked only after all instances use the new one.
Read the full page →Pre-commit hooks and pipeline scanning block commits and builds containing secrets, platform secret scanning watches repositories continuously, and developers get vault paths and SDK patterns that make the right approach easier than hard-coding. Any blocked secret is treated as exposed and rotated.
Read the full page →For workloads on one cloud, use the native manager. AWS Secrets Manager, Azure Key Vault and Google Secret Manager integrate with platform identities, managed rotation, KMS and audit logs with no servers to run. HashiCorp Vault is the better fit if you run several clouds plus on-premises and want one secrets API, need dynamic short-lived database credentials across many engines, or already operate Vault well. Vault Enterprise or the HCP-managed offering adds licence cost, and self-hosted Vault becomes a critical service you must patch, back up and keep highly available. Do not adopt it just to avoid three consoles.
Read the full page →For 20-80 repositories on one CI platform, NTSPL's engagement typically costs INR 9-18 lakh over 12 weeks. Open-source scanners add no licence cost; commercial code security platforms are licensed per committer, so for 50 developers expect several lakh a year.
Read the full page →Not noticeably if designed well. Pull request scans are diff-aware and budgeted at about three minutes per stage, heavier full scans run nightly, and only a narrow set of high-confidence issues blocks a merge. Most teams see total pipeline time rise by two to four minutes.
Read the full page →Increasingly, yes. Banks and large enterprises in India now ask software vendors for SBOMs in procurement and audits, and SBOMs let you answer within minutes whether a newly disclosed vulnerable library is in any production image. We generate SPDX or CycloneDX for every image automatically.
Read the full page →GitHub Actions, GitLab CI and Azure DevOps can present OIDC tokens that AWS IAM, Microsoft Entra workload identity federation and Google Cloud Workload Identity Federation trust. Each repository and environment receives a narrowly scoped role, and tokens last minutes, so there is no key to leak.
Read the full page →Developers can mark a finding as a false positive or request an exception through a documented flow, reviewed by security within one business day. For urgent production fixes there is a logged break-glass override that creates a follow-up ticket automatically.
Read the full page →Yes. Regulators expect secure software development practices, including code review, vulnerability testing before release and change control. Pipeline logs showing scans, approvals, signed artefacts and exceptions give auditors continuous evidence across every release instead of samples. CERT-In and DPDP investigations also benefit from this trail.
Read the full page →Put automated controls in the pipeline first; keep human review for what tools cannot judge. Scanners catch known-vulnerable dependencies, leaked secrets, IaC misconfigurations and common code flaws in minutes on every change, which no review team can match at weekly release cadence. Human application security effort is better spent on threat modelling new features, reviewing authentication and payment flows, and penetration testing before major launches. Teams that rely only on periodic reviews find issues months after release; teams that rely only on tools miss business logic flaws. Use both, in that order.
Read the full page →NTSPL's eight-week readiness engagement, including playbooks, forensic tooling for one or two clouds and two exercises, typically costs INR 8-15 lakh. An external incident response retainer is separate and usually priced as pre-paid hours. Forensic environment running costs are low because analysis instances start only when needed.
Read the full page →CERT-In's April 2022 directions require service providers, intermediaries, data centres and body corporates to report specified cyber incidents to CERT-In within six hours of noticing them, and to provide logs and information on request. The list includes data breaches, unauthorised access and ransomware.
Read the full page →The DPDP Act 2023 requires a data fiduciary to notify the Data Protection Board and each affected data principal of a personal data breach. Your playbooks therefore need a track for assessing whether personal data was affected, gathering facts and preparing notices alongside the CERT-In report.
Read the full page →Leaders and responders walk through a realistic scenario, such as ransomware spreading from a compromised vendor account, as injects arrive over two to three hours. Each decision is recorded, gaps in roles, information and authority surface quickly, and we produce a report with prioritised fixes.
Read the full page →A compromised account cannot be trusted for analysis, and evidence must be protected from tampering. A dedicated forensic account, subscription or project with read-only access to evidence and no trust from production keeps snapshots and logs safe and lets analysts start immediately.
Read the full page →Providers help within the shared responsibility model: they secure the underlying platform, and offer services such as AWS Security Incident Response or Mandiant retainers. Investigating your accounts, identities, workloads and data, and reporting to regulators, remains your responsibility. Pre-agree how provider support will be engaged.
Read the full page →You need both, and readiness comes first. A retainer gives you forensic specialists and surge capacity, but they arrive hours later and depend on what your team has done in the meantime: whether evidence was preserved, logs exist, access is ready and decisions were taken. In-house readiness covers the first hours, which decide most outcomes and the CERT-In deadline. Build roles, playbooks, forensic tooling and reporting internally, then sign a retainer with cloud forensics capability and pre-agreed access so the external team can start work in minutes when they join, not after a day of onboarding.
Read the full page →For two to five frameworks over one or two clouds, NTSPL typically delivers the library, mappings and evidence automation in about ten weeks for INR 12-24 lakh. Native evidence tools add modest running costs, mostly AWS Config rule evaluations and Security Hub CSPM checks.
Read the full page →That depends on your licence and data. RBI master directions apply to banks, NBFCs and payment entities; SEBI's CSCRF to regulated market entities; IRDAI's information and cyber security guidelines to insurers and intermediaries; CERT-In directions and the DPDP Act broadly to most organisations processing digital personal data.
Read the full page →Yes. The 2022 revision has 93 Annex A controls in four themes: organisational, people, physical and technological, and adds controls such as information security for use of cloud services and threat intelligence. Most technological controls map directly to cloud configurations, while physical controls are largely inherited from the provider.
Read the full page →Only for what the provider operates. AWS, Microsoft and Google publish ISO, SOC and PCI attestations covering their data centres and services, which you cite for inherited controls. Your identity configuration, data handling, logging and incident processes remain your responsibility and need your own evidence.
Read the full page →DPDP obligations such as reasonable security safeguards, breach notification and data retention limits are mapped as clauses like any other. Many are already satisfied by sector controls; the mapping shows where DPDP adds requirements, for example notifying affected individuals and handling children's data.
Read the full page →Most auditors accept system-generated reports and query outputs with timestamps and scope, and often prefer them to screenshots because they cover the full period. We agree evidence formats with your auditor before the audit, and keep a sample of manual evidence where they require it.
Read the full page →Choose one unified framework. RBI, SEBI CSCRF, IRDAI, PCI DSS, ISO 27001 and the DPDP Act overlap heavily on access control, logging, encryption, vulnerability management and incident response; running them separately means collecting the same evidence several times and risking different answers to the same question. A unified library defines each control once, maps it to every clause, and generates framework-specific packs from shared evidence. Keep framework-specific controls only where a requirement is genuinely unique, such as PCI DSS payment page script controls. The usual result is roughly half the audit effort and fewer contradictory observations.
Read the full page →Start with the Cloud Security Assessment. In three to five weeks it shows what is exposed, who holds privilege and where logging is missing, and ranks fixes by risk. Most organisations then move into identity and network foundations, because those close the most attack paths per rupee spent.
Read the full page →Yes. Many of our clients run two clouds, often Azure for corporate systems and AWS or Google Cloud for digital products. We use each cloud's native controls and connect them through one severity model, one tagging standard and, where it makes sense, a single SIEM or posture console.
Read the full page →No. This family designs and builds the controls, pipelines, playbooks and evidence that a SOC depends on. A managed security operations team then monitors and responds 24x7. Building first means your SOC receives fewer, better alerts with the context needed to act.
Read the full page →The DPDP Act requires reasonable security safeguards and breach notification. Data discovery and encryption show where personal data is and how it is protected, identity and network work restrict access, detection and incident readiness enable timely notice, and control mapping documents it all for the Data Protection Board or auditors.
Read the full page →Individual capabilities usually run INR 6-28 lakh each over six to twelve weeks. A combined programme covering assessment, foundations and operations for a mid-size regulated firm commonly totals INR 60 lakh to 1.5 crore over six to nine months, plus native tool run costs.
Read the full page →Not if designed with them. We baseline existing findings so teams are judged on new risk, budget pipeline checks to a few minutes, use just-in-time access with approval times under ten minutes, and automate safe fixes. Most teams find fewer interruptions once guardrails replace ad-hoc reviews.
Read the full page →A typical engagement takes four weeks. For an estate of 100-400 servers across one or two clouds plus on-premises, effort is usually 25-40 consultant days. The largest variable is restore sampling: archive-tier restores and multi-terabyte databases add elapsed time but little effort. NTSPL quotes a fixed fee after a one-hour scoping call.
Read the full page →No. Extraction uses read-only roles, and restores go into a separate sandbox network with no route to production. The only artefacts created are the temporary audit roles and the sandbox, both removed at close and documented in the evidence pack.
Read the full page →Yes. RBI's IT governance direction for regulated entities and SEBI's cybersecurity and cyber resilience framework both expect tested backups and documented recovery. The evidence pack includes timed restore logs, coverage reconciliation and retention justification, which are the artefacts inspectors typically ask for.
Read the full page →Yes. Most Indian estates run a mix. NTSPL pulls job and catalogue data from Veeam, Commvault, Veritas and native cloud services, and reconciles all of them against one inventory so double-protected and unprotected workloads are both visible. Licence counts and agent versions are also checked, since outdated agents are a frequent cause of silent failures.
Read the full page →Then it has done its job. Unrestorable Tier 1 items are escalated within 24 hours, not held for the final report, and NTSPL proposes an immediate interim fix, such as an extra snapshot schedule or a manual export, while the proper design change is planned.
Read the full page →Yes, if they are in scope. Mailboxes, OneDrive, SharePoint and shared drives are commonly assumed to be protected by the provider's retention. The assessment checks whether a separate backup exists, what it covers and whether restores of a deleted site or mailbox actually work.
Read the full page →Yes, but they answer different questions. Monitoring tells you whether last night's jobs ran; an assessment tells you whether the estate as a whole can be recovered. Monitoring will never flag a server that was never added to a policy, a retention ladder that is three times too long, or a vault an admin can purge, because those are design gaps, not job failures. Run an assessment once to reset the baseline, after major migrations, and before regulatory inspections. Then let monitoring and monthly restore tests keep it healthy. If you can only fund one this year and have never audited, start with the assessment.
Read the full page →For a landing zone with 10-30 accounts or subscriptions and 200-600 resources, plan six to eight weeks and 35-55 consultant days, including infrastructure-as-code build and restore testing. Ongoing cost is mostly storage; NTSPL provides a per-tier INR model so the run cost is known before rollout.
Read the full page →For regulated sectors and most personal data, yes. Both production and copy vaults can stay in-country: AWS Mumbai and Hyderabad, Azure Central India, South India, West India and India South Central, Google Cloud Mumbai and Delhi. RBI's payment data storage direction and CERT-In's log retention rule both point to in-country storage.
Read the full page →Yes. Zone and region replication protect against infrastructure failure, but they replicate deletions, bad updates and encryption by ransomware within seconds. Backups and point-in-time recovery are the only way to go back to a state before the mistake. A replica cannot bring back last Tuesday's data; a backup can.
Read the full page →Persistent volumes alone are not enough; you also need cluster resources such as deployments, secrets and config. NTSPL uses Backup for GKE, Azure Backup for AKS, or Velero on EKS and wherever portability matters, with the same tier tags applied to namespaces.
Read the full page →Partly. Azure Backup with the MARS agent or Backup Server, AWS Backup for VMware, and Google Backup and DR Service can protect on-premises systems into cloud vaults. The tier catalogue and retention ladders stay the same; only the agent and network path differ.
Read the full page →The platform team owns the policies and vaults; workload owners own the tag on their resources and approve their tier. NTSPL hands over the code, runbooks and reports, and can operate daily backup through a managed service if you prefer.
Read the full page →Use cloud-native backup (AWS Backup, Azure Backup, Google Backup and DR Service) as the default for cloud workloads. It needs no servers, is billed per protected resource and storage, integrates with organisation policy and supports vault locks. Third-party software such as Veeam or Commvault is worth keeping when you protect a large on-premises estate alongside cloud and want one catalogue, need granular application restores the native tool lacks, or have multi-cloud copies to a single target. Avoid running both on the same resource; double protection is the most common source of wasted backup spend.
Read the full page →Typically five weeks and 25-45 consultant days for 10-40 business services, depending on how many owners must be interviewed and how complex the dependencies are. NTSPL quotes a fixed fee. The assessment usually pays for itself by moving over-tiered systems to cheaper patterns.
Read the full page →Generally regulators require regulated entities to define and test RTO and RPO for critical systems and have board-approved BCP and DR policies, rather than prescribing one value for every entity. Market infrastructure institutions under SEBI do have specific targets. NTSPL maps your sector's actual requirements during the regulatory overlay step.
Read the full page →Yes. If the existing secondary site meets the tiers at lower cost than cloud DR, the recommendation says so. Commonly the answer is mixed: Tier 2 and Tier 3 move to cloud backup-restore while a few Tier 1 systems keep site-based replication until the next refresh.
Read the full page →One owner per business service for a 60-90 minute interview, the CIO and infrastructure leads, the CISO, someone from risk or compliance, and finance for the cost model. Total business-side time is usually under 40 hours spread across five weeks.
Read the full page →Ransomware is scored as a separate scenario because replicas copy encrypted data. Its recovery time depends on clean backups and a clean-room restore, not on failover. The assessment sets a separate cyber-recovery target per tier and flags where immutable backup is needed.
Read the full page →No. Patterns are costed for the cloud where each workload runs today or will run, and multi-cloud or hybrid options are included where they make sense, such as on-premises production with recovery into AWS Hyderabad or Azure South India. Each option carries the same RTO, RPO and INR cost format so they can be compared directly.
Read the full page →A DR assessment decides the technical recovery strategy: which IT services must come back, how fast, with how much data loss and using which DR pattern at what cost. A business continuity plan covers the whole organisation's response: people, premises, manual workarounds, communications, suppliers and crisis governance. The BIA is shared between them, which is why NTSPL builds it once. If you have neither, do the DR assessment first, because it produces the BIA and costs; then align the BCP to it. If you have a BCP with no technical backing, the DR assessment fills that gap.
Read the full page →For a typical three-tier application of 6-20 servers, a pilot light build takes six to eight weeks. Ongoing DR run cost is mostly the database replica, replication service and storage, usually 10-20% of the production bill. NTSPL provides a fixed build quote and an INR monthly run estimate before work starts.
Read the full page →Yes. Common pairs are AWS Mumbai to Hyderabad, Azure Central India to South India, and Google Cloud Mumbai to Delhi. Keeping both sites in India satisfies RBI payment data storage rules and CERT-In log retention without cross-border transfer questions. The DR region still needs its own quotas, keys and images prepared in advance.
Read the full page →It implements a form of pilot light for servers: data replicates continuously to low-cost staging resources, and full recovery instances are launched only during drills or failover. It is ideal for lift-and-shift servers; for cloud-native apps, native database replicas plus templated compute are often simpler.
Read the full page →Yes. On-premises VMware, Hyper-V or physical servers can replicate into AWS, Azure or Google Cloud and launch there on failover. Network connectivity for users and integrations must be planned in advance, typically through VPN or SD-WAN to the DR region.
Read the full page →Replication is reversed from the DR region to the restored primary, a sync period follows, and a planned failback runs during a low-traffic window. NTSPL scripts failback during the build, because teams that have not tested it often stay in DR far longer than planned.
Read the full page →Not if run as isolated drills. Most tools can launch recovery instances into an isolated network while production replication continues. NTSPL recommends one isolated drill per quarter and a full traffic switch at least once a year. Each drill ends by tearing down launched instances so DR run cost stays low.
Read the full page →Choose pilot light when you can accept 30 minutes to a few hours of recovery and want DR to cost roughly 10-20% of production. Choose warm standby when recovery must be within about 15 minutes, when application start-up and cache warm-up are slow, or when you need confidence that the DR stack works every day rather than only during drills. Warm standby typically costs 25-50% of production because a scaled-down copy runs continuously. A useful test: if your measured pilot light drill exceeds RTO mainly because of compute start-up rather than data promotion, move to warm standby.
Read the full page →Usually 25-50% of production, driven by database replica size and standby app capacity. For a system costing INR 10 lakh a month in production, expect INR 2.5-5 lakh for warm standby. Routing reporting or read traffic to the standby can offset part of that by retiring separate reporting replicas.
Read the full page →Measured recoveries are typically 5-15 minutes from declaration to full-capacity service. Data loss is limited to cross-region replication lag, usually seconds. The decision to fail over often takes longer than the technical steps, so NTSPL sets a decision timebox in the runbook.
Read the full page →Yes. Both regions can be in India, encryption keys can be region-specific, and access is governed by the same identity controls. DPDP Act 2023 obligations apply to both copies equally, so the standby needs the same access logging and breach-response coverage as production.
Read the full page →Not safely. Testing changes on the standby risks leaving it inconsistent with production. It can safely serve read-only and reporting traffic. Keep UAT separate, but you can schedule UAT to shut down during drills to free quota. Training users can also be given read-only access to the standby to learn on live-like data.
Read the full page →At least once a year with real traffic, ideally twice, plus quarterly component tests. Because the standby is proven daily by synthetic probes, full drills focus on scale-up, integrations and the human decision, rather than on whether the stack starts.
Read the full page →For fleets above about 20 instances or for GPU and large-memory types, yes, because regional capacity can be tight in an incident that affects many customers. Reservations cost the same as running instances, so NTSPL usually reserves 40-60% of required scale-up capacity.
Read the full page →Warm standby gives minutes of recovery and seconds of data loss for roughly 25-50% of production cost, using conventional single-writer databases. Active-active removes failover time almost entirely but costs 80-120% of production and usually requires application changes: multi-region write data stores, idempotent operations and conflict handling. Justify active-active only when even a few minutes of downtime is unacceptable to customers or regulators, or when you already need two regions for latency or capacity. For most Indian enterprise systems, a well-drilled warm standby with a 10-minute RTO is the better investment.
Read the full page →Infrastructure typically runs at 80-120% above a single-region deployment, because each region carries spare headroom and data is stored twice. Engineering effort for a platform of 20-60 services is usually a 4-6 month programme. NTSPL limits scope to the customer-facing paths that need it, which keeps total uplift closer to 60-80%.
Read the full page →Conventional single-primary relational databases cannot accept writes in two regions safely. Options are globally distributed SQL databases, partitioning so each region owns a subset of rows, or keeping the relational system as a single writer and moving hot paths to multi-writer stores. Aurora Global Database's write forwarding still sends writes to one primary.
Read the full page →AWS Mumbai and Hyderabad, Azure Central India and South India, and Google Cloud Mumbai and Delhi. Round-trip latency between these pairs is low enough for asynchronous replication with lag of around a second, while keeping all data in India for DPDP and sectoral rules.
Read the full page →No. Typically only the customer-facing transaction path qualifies: browse, cart, checkout, login or gameplay. Back-office, analytics and batch services stay single-region with backup or warm standby. Mixing patterns is normal and keeps cost proportionate. Over-applying the pattern is the most common reason active-active budgets overrun, so scope is agreed per service before design starts.
Read the full page →Start with internal users on a test cell, then drain a small production cell, then a whole region during a normal business period. Each drain is reversible in under two minutes. NTSPL recommends monthly cell drains and a full region evacuation each quarter.
Read the full page →Payment initiation uses an idempotency key tied to the order reference, so a retry in the other region is recognised. Gateway callbacks are registered to a global hostname reachable in both regions. In-flight payments are reconciled against the gateway's status API after the switch.
Read the full page →Multi-zone deployment protects against a data centre or zone failure and should be the baseline for every production system. It does not protect against a regional control-plane issue, a bad configuration pushed region-wide, a regional networking event or a provider-side incident affecting several zones. Active-active across regions covers those, at roughly double the cost and with real application changes. If your platform loses more than INR 25-50 lakh per few minutes of outage, or you already need two regions for latency, multi-region active-active is justified. Otherwise, multi-zone plus a warm standby in a second region is the better balance.
Read the full page →The shared foundation, including connectivity, replicated registries and keys, usually costs INR 1-4 lakh a month for a mid-size estate. Data replication adds inter-region transfer and second-region storage. Workload compute cost depends on the DR pattern chosen. NTSPL itemises each so finance sees what the second region costs regardless of pattern.
Read the full page →AWS: Mumbai and Hyderabad. Azure: Central India (Pune), South India (Chennai), West India (Mumbai) and India South Central (Hyderabad), with Central India and South India as the formal pair. Google Cloud: Mumbai and Delhi. All pairs keep data in India, which satisfies RBI's payment data storage direction and most sector localisation expectations.
Read the full page →For most regulators and boards, yes. The cities are several hundred kilometres apart in different seismic and flood zones and on different power grids. Distance also keeps asynchronous replication lag low, typically seconds for databases, which is why it is the default AWS pair for Indian workloads.
Read the full page →Logs must remain available for 180 days within Indian jurisdiction. NTSPL replicates the central log archive to the DR region and configures the DR stack to write to an in-region log sink immediately, so there is no gap in coverage after failover.
Read the full page →If users, plants or partners reach the application privately, yes, or at least an SD-WAN or VPN path that can be redirected to the DR region. A cloud DR that users cannot reach is not recovery. For internet-facing apps, global DNS or load balancing is enough.
Read the full page →Yes, but dependencies must be complete. If the application recovers in Hyderabad but authentication still calls a Mumbai-only service, recovery fails. The dependency register is designed to catch exactly these partial setups. Partial DR is fine as long as every dependency of the recovered part is also available in the second region, or has a documented fallback.
Read the full page →For almost all Indian enterprises, cross-region on the same provider is the better choice. It reuses the same services, IAM model, tooling and skills, replication is native, and both regions are in India. Cross-cloud DR protects against a provider-wide event or a commercial dispute, but doubles the platform skills needed, forces lowest-common-denominator designs and makes data replication, keys and identity much harder. Consider cross-cloud only for a small set of systems where a regulator or board explicitly requires provider diversity, and then usually as backup copies in the second cloud rather than a running DR stack.
Read the full page →For 10-30 databases across two or three engines, expect six to seven weeks and 30-45 consultant days. Run cost changes are mostly longer PITR retention and long-term backup storage, often INR 10,000-60,000 a month per large database. NTSPL prices the retention design before changes are applied.
Read the full page →Amazon RDS and Aurora support PITR up to 35 days. Azure SQL Database and Managed Instance support 1-35 days with long-term retention up to 10 years. Cloud SQL and AlloyDB also support PITR windows that can be configured; beyond them, keep scheduled long-term backups.
Read the full page →Usually by restoring the whole database side-by-side, then copying or merging the needed tables or rows. Most managed engines restore at instance or database level. NTSPL keeps reconciliation scripts ready so table-level recovery takes hours, not days. Restoring the full database to a separate instance also keeps production online during the recovery.
Read the full page →Yes. Regulated entities must retain records for periods set by their sector rules and the PMLA, often five to ten years, and RBI expects tested backups. NTSPL maps retention per data class and ensures long-term copies stay in India and are restorable.
Read the full page →Keep at least one backup copy in a locked or logically air-gapped vault that database administrators cannot delete, encrypted with keys outside the production account. Combine this with the Immutable & Protected Backup design so a compromised DBA account cannot erase recovery points.
Read the full page →Yes. A restore that opens can still contain corruption. NTSPL runs engine-native consistency checks on a restored copy, not production, at least monthly for Tier 1 databases and quarterly for others, which also avoids loading production during business hours. Failures are escalated to the DBA lead the same day.
Read the full page →No. Replicas, availability groups and multi-zone deployments protect against infrastructure failure by copying every change within seconds, including deletes, bad updates and ransomware encryption. Backups with transaction logs let you go back to a time before the damage. You need both: replicas for availability, backups and PITR for recoverability. A delayed replica that applies changes a few hours late sits in between and can be useful for very large databases, but it is not a substitute for backups with retention, because its window is short and it is still writable by the same administrators.
Read the full page →The build typically takes six to eight weeks and 30-45 consultant days. Run cost is mostly the extra copy's storage in the recovery account, often 30-60% on top of existing backup storage depending on the retention ladder. NTSPL models this before locking, because locked retention cannot be shortened later.
Read the full page →Once a vault lock in compliance mode is in effect, AWS states that the lock becomes immutable and cannot be changed or deleted by any user or by AWS, and recovery points cannot be deleted before retention expires. Azure locked immutable vaults behave similarly. Only retention expiry or account closure ends them.
Read the full page →RBI's IT governance and cyber security frameworks expect regulated entities to maintain and test backups and recovery. CERT-In requires cyber incidents, including ransomware, to be reported within 6 hours. A documented clean-room recovery and locked backups give the evidence regulators and insurers ask for after an incident.
Read the full page →It stops existing recovery points from being deleted or altered. New backups taken after encryption will contain encrypted data, which is why you need retention long enough to step back past the attack and anomaly alerts that flag sudden backup size or change-rate jumps.
Read the full page →Ideally yes. NTSPL commonly places the locked vault in the second Indian region, such as Hyderabad, South India or Delhi, combining protection against both region loss and admin compromise. Both copies remain in India for data residency. Region separation adds a little inter-region transfer cost.
Read the full page →The attacker exercise uses a dedicated test role granted the same rights a compromised production admin would have, and attempts deletions against test recovery points and policies. It proves blocks and alerts work without touching production copies. Results go into the evidence pack.
Read the full page →Both can be effective if done properly, but locked cloud vaults in an isolated account are now the better default for most Indian enterprises. Tape is truly offline but restores slowly, is hard to test frequently and depends on physical handling and off-site logistics. A locked vault with separate identity and keys cannot be deleted by a compromised admin, restores in hours and can be tested monthly. Keep tape if a regulator or policy requires it, or for very long-term archives. Otherwise, a logically air-gapped cloud copy plus a clean-room process gives faster, more testable recovery.
Read the full page →For 5-10 business services, plan five to six weeks and 25-40 consultant days, including automation and walkthroughs. Effort depends most on how much existing automation can be reused and how many partner or manual steps are involved. Ongoing upkeep is typically a few hours per runbook per quarter.
Read the full page →Yes. Many recoveries involve both, such as on-premises production failing over to cloud, or cloud applications depending on on-premises identity. Runbooks call automation on each side and list manual steps for systems without APIs. The on-premises steps are tested in the same drills as the cloud steps.
Read the full page →Regulators such as RBI, SEBI and IRDAI expect documented, tested BCP and DR procedures with defined roles. CERT-In's 6-hour incident reporting rule also means the runbook should include the reporting step and who owns it. Runbooks with execution logs provide that evidence.
Read the full page →Yes, as a separate runbook. Ransomware recovery differs from failover: it uses isolated backups, a clean-room environment, a choice of recovery point before the intrusion and security sign-off before reconnecting. Mixing it into the failover runbook causes dangerous shortcuts. It needs security sign-off.
Read the full page →A structured document in version control, such as Markdown or a wiki page generated from it, with step numbers, owners, durations, commands and checks. Automation lives alongside in code. NTSPL avoids long prose and screenshots that go stale quickly. Each step is short.
Read the full page →The team that operates each system owns its runbook, with a DR coordinator owning the overall set, the declaration tree and the review calendar. Ownership is recorded in the runbook header and checked at each quarterly review. Gaps go to the DR coordinator.
Read the full page →For most enterprise systems, runbook-driven failover with heavy automation and a few human gates is safer than fully automated failover. Automatic failover triggered by health checks reacts fastest, but it can fail over on a partial or transient issue, cause split-brain on databases, or flip traffic back and forth. Runbook-driven failover lets a person confirm the situation, then runs automated modules for the heavy lifting, typically adding only 10-20 minutes. Reserve fully automated failover for stateless tiers and for platforms such as active-active designs where the data layer arbitrates and failover is just traffic shift.
Read the full page →Setting up the programme and running the first cycle of drills takes about 12 weeks and 30-50 consultant days for 5-10 Tier 1 services. Each later drill costs a few consultant days plus cloud run cost of the DR environment during the test, often INR 10,000-80,000 per drill depending on scale.
Read the full page →Yes. RBI expects regulated entities to test BCP and DR periodically and report outcomes to the board or its committees. SEBI expects market participants to conduct DR drills, and market infrastructure institutions have specific drill and live-from-DR requirements. NTSPL formats evidence for your sector's inspection expectations.
Read the full page →Mostly, through isolated failover and component tests, which run while production continues. Live failover does involve customers, but in a low-traffic window with tested rollback, impact is usually a few minutes of reconnects. Many teams also use the live drill to validate planned maintenance procedures.
Read the full page →Finding problems. First drills commonly exceed RTO by 50-200% because of missing dependencies, slow decisions or stale runbooks. The value is the fix list. By the second or third drill, most teams reach their targets, and the focus shifts to keeping them as systems change.
Read the full page →Yes, as its own drill. Test restoring from locked or isolated backups into a clean room, choosing a recovery point before a simulated intrusion, and getting security sign-off. It typically takes much longer than failover, and leadership should see the realistic number.
Read the full page →You cannot fail them over, but you can test your degraded mode: queuing transactions, switching to a backup provider or manual workarounds. Ask providers for their own DR test reports and include their contractual RTO in your drill assumptions. Their gaps go on the findings list.
Read the full page →Both, for different failures. A tabletop tests people: whether leaders know who declares, how the business operates during recovery, how customers and regulators are informed, and how decisions are made under uncertainty. It is cheap and should run twice a year. A live failover tests technology and integrations: whether systems actually start, data is current, partners accept traffic and users can transact. It is expensive and risky, so it runs once or twice a year after isolated tests pass. Organisations that only do tabletops overestimate technical readiness; those that only do failovers often stall on decisions.
Read the full page →Typically nine weeks and 30-45 consultant days for 15-40 critical processes, depending on how current the existing BCP and BIA are. Most of the business-side effort is in workaround validation and the joint exercise. NTSPL quotes a fixed fee once the BCP and DR documents have been reviewed.
Read the full page →Cyber incidents must be reported to CERT-In within 6 hours. Personal data breaches must be notified to the Data Protection Board and affected individuals under the DPDP Act 2023. Regulated entities have additional duties to RBI, SEBI, IRDAI, exchanges or depositories. NTSPL builds a matrix specific to your licences.
Read the full page →No. Providers are responsible for the resilience of their infrastructure, but your recovery, workarounds, communications and regulatory duties remain yours. Provider audit reports support your supplier assessment; your own region design, backups and drills provide your recovery capability. This is the shared responsibility model applied to continuity.
Read the full page →The BCP covers premises and people; alignment ensures IT supports them, for example remote access capacity, cloud-hosted contact centre and systems reachable from alternate sites. Joint exercises often use a combined scenario, such as monsoon flooding of an office with simultaneous network failure.
Read the full page →Jointly, the business continuity or risk function and IT. BCM owns processes, tolerances and workarounds; IT owns systems, tiers and achieved RTO. A named coordinator keeps the register current and reports to the risk committee. Changes to either side trigger a register review.
Read the full page →Yes. The register, BIA, recovery strategies, exercise reports and management review records map to ISO 22301 clauses. NTSPL can prepare evidence and support readiness reviews, while certification itself is performed by an accredited certification body. Gaps found are fixed before the external audit.
Read the full page →Certification is worth pursuing when customers, regulators or tenders demand it, typically for IT services firms, payment processors, data centres and outsourcing providers. For most other Indian enterprises, aligning BCP and DR to ISO 22301 practices without formal certification delivers most of the resilience benefit at lower cost: a BIA, recovery strategies, documented plans, exercises and management review. NTSPL structures the alignment so that certification later is a documentation and audit step, not a redesign. If a key customer has asked for certification in their vendor assessment, start the formal route now.
Read the full page →Start with a backup assessment, then a DR assessment. The first tells you whether your existing copies can actually be restored and how long that takes; the second decides which systems need more than backup. Skipping the audit risks designing DR on top of backups that are incomplete or untested.
Read the full page →For most mid-size Indian estates, a pilot light or warm standby design on cloud costs 15-35% of what a dedicated secondary data centre with idle hardware and colocation fees would. The saving comes from paying for compute only during drills and real events, while storage and replication run continuously.
Read the full page →Data localisation rules differ by sector. RBI requires payment system data to be stored in India, and CERT-In requires logs to be maintained within Indian jurisdiction for 180 days. With two AWS regions, four Azure regions and two Google Cloud regions in India, in-country DR is available on every major provider.
Read the full page →Only if at least one copy is immutable and isolated from production credentials. Attackers routinely delete backup catalogues and snapshots before encrypting. NTSPL designs a locked or logically air-gapped copy, a separate recovery identity and a clean-room restore process so recovery does not reintroduce the infection.
Read the full page →Tier 1 systems should see at least one full failover drill a year and a component-level test each quarter; many regulated entities test every six months. Tabletop exercises with business owners should run at least twice a year, because people and contact lists change faster than infrastructure.
Read the full page →Yes. Many engagements use cloud as the recovery site for on-premises VMware, Hyper-V or physical servers, replicating with AWS Elastic Disaster Recovery, Azure Site Recovery or Google Backup and DR Service, while production remains in the customer's data centre.
Read the full page →Most assessments take four to six weeks. NTSPL prices them as a fixed fee scaled to the number of accounts, subscriptions or projects and providers; for a single-provider estate of ₹20-60 lakh monthly spend, the fee is typically recovered within the first month of executing the no-regret findings. A fee linked to realised savings is available for larger estates.
Read the full page →No. The assessment uses read-only billing, monitoring and inventory roles. Any change, even deleting an obviously orphaned disk, is listed in the register and executed later by your team or under a separate change-managed engagement, so the audit never touches production.
Read the full page →Yes. NTSPL lands billing data in a dataset in your own account in AWS Mumbai or Hyderabad, Azure Central India or Google Cloud Mumbai or Delhi. Billing exports can contain user email addresses in tags and resource names, so this supports your DPDP Act 2023 obligations and keeps the data under your access controls.
Read the full page →Yes, but reseller invoices often apply margins, credits or bundled support that the provider export does not show. NTSPL reconciles provider-native exports to the reseller invoice and reports the gap separately, which sometimes reveals billing errors or credits that were never passed through.
Read the full page →Estates that have never been audited typically show 18-35% identified run-rate savings, of which owners confirm 70-85%. Roughly a third is no-regret cleanup, a third needs testing such as rightsizing, and a third needs commitments or design change. Estates with mature FinOps practices usually show 8-12%.
Read the full page →The register is sequenced into execution workstreams: idle cleanup, rightsizing, scheduling, storage and commitments. You can execute internally, use NTSPL for specific workstreams, or move into Continuous FinOps Governance so savings are tracked monthly and new waste is caught before it accumulates.
Read the full page →If workloads already run in cloud and you are paying a monthly bill, you need a cost assessment: it works on actual billing exports and utilisation, and its output is a list of resources to change. A TCO business case works on server inventories and assumptions, compares a three-to-five-year on-premises refresh against cloud, and its output is a go/no-go decision. Companies mid-migration often need both, but in sequence: audit the 40% already in cloud first, because its real unit costs make the business case for the remaining 60% far more credible than list-price estimates.
Read the full page →A typical first cycle runs 12-14 weeks for a fleet of 300-800 instances, with about 60 days of that spent collecting evidence. Client effort is mainly owner approvals and change windows, roughly two hours per application. NTSPL prices it as a fixed-fee cycle or as a share of billing-verified savings.
Read the full page →Most VM resizes need a stop and start, typically two to five minutes per instance. For instances behind a load balancer, NTSPL resizes one at a time so the service stays up. Database class changes on Multi-AZ or zone-redundant deployments use failover, keeping disruption to about a minute.
Read the full page →For Linux workloads on Java, Node.js, Python, Go or containers, usually yes: the Arm instances are priced below comparable x86 sizes. The barrier is any x86-only binary, agent or licensed product. NTSPL scans for these first and runs a week-long canary before moving a whole tier.
Read the full page →They count as changes and must follow your change-management controls. For RBI-regulated entities, NTSPL produces change records with approvals, test evidence and rollback outcomes that fit the IT governance and outsourcing audit trail. Region does not change: a resize stays in AWS Mumbai, Azure Central India or wherever the resource already runs.
Read the full page →Native tools see one resource's metrics; they do not know licence terms, upcoming launches, festive peaks or whether the application can tolerate a restart. In NTSPL engagements, roughly 25-35% of native recommendations are rejected or modified after owner review, and those rejected ones are usually where outages would have come from.
Read the full page →Run a full cycle once, then a lighter quarterly review of the top 50 resources by cost and anything launched in the quarter. New instances should be launched with the workload-class headroom standard, which prevents most of the drift that made the first cycle necessary.
Read the full page →They solve different waste. Autoscaling removes waste over time by adding and removing instances as load changes; rightsizing removes waste inside each instance by matching its size to what one unit of load needs. A fleet that autoscales on oversized instances still wastes 40-60% of every instance. A rightsized fleet without autoscaling still pays for peak capacity all night. For stateless tiers, rightsize the instance first, then set autoscaling floors and targets. For databases and single-instance legacy servers that cannot scale horizontally, rightsizing is the only lever.
Read the full page →Estates older than three years typically recover 6-12% of monthly spend. A first cleanup runs 8-10 weeks; NTSPL usually prices it as a fixed fee or a share of verified savings. Because idle items have no performance trade-off, most of the saving appears within the first billing cycle after quarantine.
Read the full page →During quarantine, yes: the resource is only stopped or detached. After deletion, NTSPL keeps a final snapshot for 90 days so a volume or VM can be rebuilt. Resources that cannot be snapshotted, such as an IP address, are only released after DNS and firewall checks.
Read the full page →Audit logs resolve most cases. Where the creator left or logs have rolled over, the asset is assigned to the account or subscription owner and goes through a longer hold. Unclaimed after the hold, it is deleted with the final snapshot retained.
Read the full page →CERT-In's 2022 directions require logs to be kept for 180 days within India. NTSPL never deletes log storage or logging resources as idle without checking that requirement, and the deletion audit trail itself is retained for at least 180 days in an Indian region.
Read the full page →Not without approval. Automated quarantine and deletion is limited to agreed low-risk classes in non-production accounts, such as unattached disks and unassociated IPs. Production compute, databases and anything tagged compliance, legal-hold or DR are routed to a ticket that requires a named owner's approval before any action.
Read the full page →Three controls catch most recurrence: delete-on-termination defaults for volumes, mandatory owner and expiry tags on sandbox accounts and disks, and a weekly sweep that notifies owners of anything newly orphaned. NTSPL sets these up as part of the final wave.
Read the full page →Cleanup deletes assets that have no further purpose: an unattached disk from a deleted VM, an IP from a closed project. Scheduling keeps assets that have a purpose but only during certain hours: a QA environment used 9 a.m. to 8 p.m. on weekdays. Treating a scheduled environment as idle breaks testers' mornings; treating an orphan as schedulable keeps paying for storage forever. NTSPL classifies each low-utilisation asset into delete, schedule or rightsize before acting. In most estates the split is roughly one-third delete, one-third schedule and one-third rightsize.
Read the full page →Ten to twelve weeks for an estate of 200 TB to 5 PB, driven mainly by the 30-day observation needed before tiering. NTSPL prices it as a fixed fee or as a share of verified savings. Volume retuning savings usually appear within the first month; tiering savings build over the following two to three months.
Read the full page →No. EBS Elastic Volumes changes type, IOPS and throughput while the volume stays attached and in use. Performance can be briefly variable during optimisation, so NTSPL runs changes in batches outside peak hours and checks application latency after each batch.
Read the full page →The Act expects personal data to be erased once its purpose is served, unless another law requires retention. That makes retention definitions a compliance task, not only a cost task. NTSPL records the purpose and legal retention basis for each data class, so lifecycle expiry rules support both erasure obligations and lower storage cost.
Read the full page →Yes, with different access times. Glacier Instant Retrieval, Azure Cold and GCS Coldline open in milliseconds. Glacier Flexible Retrieval, Deep Archive and Azure Archive need a restore that takes minutes to hours. NTSPL puts anything an application might read without warning into an instant-access class.
Read the full page →Only where DR or a regulator requires it. If you do, use an infrequent-access class for the copy, since it is read only during failover. Pairs such as AWS Mumbai and Hyderabad, Azure Central India and South India, or Google Cloud Mumbai and Delhi keep both copies within India.
Read the full page →Versioning and soft delete protect against mistakes but can silently double storage. NTSPL adds lifecycle rules that expire noncurrent versions after a defined period, typically 30-90 days, and cleans up incomplete multipart uploads, which are invisible in most console views but still billed.
Read the full page →Use Intelligent-Tiering when you cannot predict access: user uploads, shared data lakes, media libraries where old items occasionally trend again. It moves objects automatically with no retrieval fees, for a small per-object monitoring charge. Use lifecycle rules when access is predictable: application logs, daily exports, transaction archives that are read heavily for weeks and rarely after. Rules have no monitoring charge and can move data to Deep Archive or delete it. Most estates need both: NTSPL typically puts 30-40% of capacity under Intelligent-Tiering and the remainder under explicit rules.
Read the full page →Typically 35-60% of backup and snapshot cost at steady state. The redesign takes 10-12 weeks, but savings accrue gradually because old restore points age out under their original retention rather than being deleted at once. Expect about half the saving within three months and most of it by month twelve.
Read the full page →Bulk deletion is irreversible and can remove points someone still relies on. NTSPL lets existing points expire under their original policy unless the compliance owner explicitly approves early deletion, and deletes unmanaged orphaned snapshots only after owner tracing and a final review.
Read the full page →It depends on the record and regulator. KYC and transaction records under PMLA rules are kept for five years after the relationship ends, and SEBI and IRDAI have their own record-keeping rules. Those obligations usually apply to records, which can often be retained as database exports in archive storage instead of keeping full VM backups for years.
Read the full page →For those specific points, yes. EBS Snapshots Archive restores take hours, and Azure vault-archive needs a rehydration before restore. That is acceptable for monthly or yearly points needed for audit, not for recent operational restores, which is why dailies stay in standard tiers.
Read the full page →Yes, and NTSPL treats them as non-negotiable. Vault Lock on AWS, immutable vaults on Azure and locked backup vaults on Google Cloud stay in place. The savings come from shorter daily retention, archive tiers and fewer copies, not from removing immutability.
Read the full page →Not automatically. Third-party tools can be cheaper for large multi-cloud or hybrid estates with global deduplication. The problem is overlap, not the tool. NTSPL compares cost and restore capability per workload and keeps one tool for each, which may mean keeping the third-party tool and removing native backups.
Read the full page →If you cannot answer three questions (are all critical workloads protected, do restores succeed, and does retention meet obligations), start with a backup assessment, because reducing cost on an unverified estate can hide gaps. If those answers are known and the problem is that protection is expensive, go straight to cost optimization. In practice they overlap: NTSPL's cost engagement includes restore tests and an obligation register, but it does not audit backup coverage across every workload. Many clients run the assessment first and use its findings as the starting map for cost work.
Read the full page →The planning engagement runs four weeks, then monthly tracking. NTSPL prices it as a fixed fee or as a share of the first year's verified savings. On a ₹50 lakh monthly compute bill moving from 20% to 75% coverage, the annual saving is typically ₹1-1.5 crore, so the fee is small relative to the value at stake.
Read the full page →Either works technically; what matters is who holds purchase authority and how benefits are allocated. Under a reseller or CSP arrangement, confirm that the reseller passes through the full commitment discount and that utilisation reports are available to you. NTSPL reviews the commercial terms alongside the portfolio design.
Read the full page →Rules differ by provider and instrument. Some Azure reservations can be exchanged or refunded within limits, AWS Convertible Reserved Instances can be exchanged, and Savings Plans and Google Cloud CUDs generally cannot be cancelled. That is why NTSPL ladders purchases and keeps a flexible share instead of relying on exchanges.
Read the full page →Some are. EC2 Instance Savings Plans, Azure VM reservations scoped to a region, and resource-based CUDs apply only in their region, such as AWS Mumbai or Google Cloud Delhi. Compute Savings Plans, Azure savings plan and spend-based CUDs apply across regions, which matters if DR or a second-region expansion is planned.
Read the full page →Spot and preemptible capacity is already heavily discounted and cannot be covered by commitments. NTSPL sizes commitments to the steady floor, runs fault-tolerant batch and CI on Spot above that floor, and uses on-demand only for the unpredictable peak in between.
Read the full page →Finance should hold authority, with platform engineering confirming the baseline. A typical policy: tranches under ₹10 lakh annual value approved by the FinOps lead, larger ones by the CFO. This prevents individual engineers making large, poorly timed purchases, which is the most common cause of expiry cliffs.
Read the full page →Buy reservations for usage that will not change: a specific VM series in a specific region, or databases such as Azure SQL and Cosmos DB, which savings plans do not cover. Buy the savings plan for compute that moves between VM series, regions or services such as App Service and Container Apps. Reservations give deeper discounts; the savings plan gives flexibility. Because reservations are applied first, the right answer is usually both: reserve the stable core, then add a savings plan sized to the remaining steady compute. Do not buy a savings plan to cover usage already well covered by reservations.
Read the full page →Non-production compute typically falls 45-65%, which on estates where non-production is a third of spend means 15-20% off the total bill. A rollout takes eight to ten weeks. NTSPL charges a fixed fee for design and build; ongoing operation is light, mostly the monthly exception review.
Read the full page →Disks, snapshots and reserved IPs remain billed; compute does not. On Azure the VM must be deallocated to stop compute charges. On AWS, public IPv4 addresses are charged even when unattached. NTSPL factors these residual costs into the savings estimate so expectations are accurate.
Read the full page →The scheduler reads a holiday calendar, including national holidays and regional ones such as Ganesh Chaturthi in Pune or Pongal in Chennai offices, and keeps environments off on those days unless a team requests otherwise. Release freeze calendars can force environments on during critical testing windows.
Read the full page →Schedule them to start 30-45 minutes before application tiers. Where the engine supports it, move dev databases to serverless options with auto-pause, such as Aurora Serverless v2 or Azure SQL serverless, which resume on first connection and need no schedule at all.
Read the full page →Yes, but plan them together. Scheduled usage is not steady, so non-production compute should generally not be covered by commitments sized to 24x7. NTSPL recalculates the commitment baseline after scheduling, often reducing planned purchases. In one typical case, scheduling removed a third of the compute that a planned Savings Plan would otherwise have covered.
Read the full page →Stopped resources generate no new logs, which is acceptable. What matters is that monitoring agents restart correctly and that stopped periods are not misread as outages. NTSPL tags scheduled resources so alerting suppresses expected-down states. CERT-In's 180-day log retention is unaffected, because stored logs are kept centrally.
Read the full page →Ephemeral environments, created per branch or pull request and destroyed after tests, are the better end state for stateless services with fast, automated provisioning. They remove idle time completely. But most Indian enterprises have long-lived UAT and integration environments with seeded data, third-party sandboxes and manual testers, which take hours to rebuild. For those, scheduling is the practical answer. NTSPL usually does both: schedule shared long-lived environments now, and move developer and feature environments to ephemeral patterns as pipelines mature.
Read the full page →Twelve to fourteen weeks to reach deny-mode enforcement and trusted monthly showback. NTSPL prices the design and build as a fixed fee; the main client effort is finance and engineering agreeing the taxonomy and split rules. Ongoing upkeep is a few hours a month once policies enforce tags at creation.
Read the full page →Yes, existing resources can be tagged, and NTSPL uses audit logs to identify creators for back-tagging. But billing data before a tag is applied or activated usually does not carry it. For historic months, NTSPL applies hierarchy and rule-based allocation so trend reports are still complete.
Read the full page →Allocate on amortised cost to the accounts or subscriptions that consumed the discounted usage, not to the account that paid. Otherwise one central account looks expensive and everyone else looks cheap. All three providers support amortised views, and NTSPL uses them consistently in showback.
Read the full page →They can if they hold personal data beyond what is needed. NTSPL recommends team or role identifiers, or a work email at most, never phone numbers or personal identifiers. Billing exports containing tags should stay in an Indian region with restricted access.
Read the full page →Cluster cost can be split by namespace using requested CPU and memory, with idle capacity allocated proportionally or to the platform team. That work is detailed in NTSPL's Kubernetes FinOps page; the allocation programme here provides the taxonomy the namespace labels should follow.
Read the full page →Yes. Dedicated tenant resources are tagged directly; shared resources are split by a usage driver such as API calls, storage or transactions per tenant from application metrics. NTSPL joins those drivers to allocated cost, giving cost per tenant suitable for pricing and margin analysis.
Read the full page →Showback reports each owner's cloud cost without moving budget; chargeback actually debits the owner's P&L or cost centre. Showback is the right start almost always, because it lets teams challenge numbers safely while allocation rules mature. Chargeback creates stronger accountability but only works when allocation exceeds 90%, shared-cost rules are agreed and reports reconcile to the invoice. Groups with separate legal entities or operating companies usually need chargeback for inter-company billing; single-entity product companies often get most of the behavioural benefit from showback with budgets attached.
Read the full page →Six to eight weeks, assuming an allocation model exists. NTSPL prices it as a fixed fee. Native anomaly and budget tooling is free or close to it; the running cost of enrichment functions, alarms and BigQuery models is usually under ₹20,000 a month.
Read the full page →Partly. AWS budget actions can apply restrictive policies or stop instances, Azure budgets can trigger automation through action groups, and Google Cloud budgets publish to Pub/Sub so a function can act. None caps spend natively. NTSPL applies automatic actions only to sandboxes and experiment accounts.
Read the full page →With billing-based detection, typically within a day. With usage alarms on fast-moving drivers such as NAT data processed, GPU hours or BigQuery bytes scanned, within minutes. NTSPL uses both, so expensive loops are caught in hours, not at month end.
Read the full page →Budgets are set per month from the finance plan, so Diwali, end-of-season sales or financial year-end have higher budgets built in. Anomaly models learn seasonality from history, and campaign launches can be pre-registered so expected spikes are annotated rather than alerted.
Read the full page →Sometimes. A sudden spike in compute or egress can indicate cryptomining or data exfiltration after a compromise. NTSPL's runbooks route security-suspicious anomalies to the security team immediately, because CERT-In requires reportable incidents to be notified within six hours of noticing them.
Read the full page →The team that can fix the cause: the product or platform team owning the spend, not finance or a shared mailbox. Finance gets a weekly digest and escalations. NTSPL maps each alert to an owner channel and escalates to the FinOps lead if it is not acknowledged within four working hours.
Read the full page →For most Indian estates on one or two providers, native tools are enough when configured properly: AWS Cost Anomaly Detection, Azure anomaly alerts and Google Cloud budgets with a BigQuery-based model cover detection at no or low cost. What they lack out of the box is segmentation by owner, enrichment and routing, which NTSPL adds with a few functions. Third-party platforms earn their licence when you run three providers plus SaaS spend, need one alerting model across all, or want anomaly detection on unit costs. Configure native tools first; buy only if a specific gap remains.
Read the full page →A first programme takes 12-14 weeks across three to six clusters. Visibility is in place by week three, with savings from request rightsizing and node strategy following. NTSPL prices it as a fixed fee per cluster group; native allocation features and OpenCost carry no licence cost.
Read the full page →Not necessarily. EKS split cost allocation data, the AKS cost analysis add-on and GKE cost allocation cover most single-cloud needs, and OpenCost provides consistent allocation across providers. Commercial tools add features such as automated recommendations and governance workflows, worth evaluating for large multi-cluster estates.
Read the full page →Not if done carefully. NTSPL sets memory from p99 usage with headroom, avoids CPU limits on latency-sensitive services, and applies changes in waves while watching latency, throttling and OOM events. Any regression rolls back through the same GitOps pull request.
Read the full page →Allocate each namespace the higher of its requests and its usage, priced at actual node cost including commitments. Report idle capacity separately under the platform team. This rewards teams for realistic requests and gives the platform team ownership of packing efficiency.
Read the full page →Yes. Native allocation data lands in your billing export or Cost Management, which you can keep in AWS Mumbai, Azure Central India or Google Cloud Mumbai or Delhi datasets. OpenCost runs inside your cluster and stores data in your own Prometheus, so nothing leaves your environment.
Read the full page →Spot usage cannot be covered by commitments. NTSPL commits only to the steady on-demand floor that remains after Spot adoption and rightsizing, recalculated once the new node mix has run for a month, so commitments are not stranded by the shift.
Read the full page →Managed Kubernetes operations keeps clusters healthy: upgrades, node patching, add-on management and incident response under an SLA. Kubernetes FinOps makes them economical and accountable: who pays for what, whether requests are realistic, how densely pods pack and what can run on Spot. A well-operated cluster can still waste 40% of its nodes; a cost-optimised cluster can still fall behind on upgrades. If clusters are stable but expensive, start with FinOps. If upgrades and incidents are the pain, start with operations, then add FinOps once the platform is steady.
Read the full page →About 12 weeks to reach use-case showback, a GPU capacity plan and stage gates. NTSPL prices it as a fixed fee scaled by platform count. Savings come mainly from GPU consolidation and right-sized commitments, often 20-35% of GPU and provisioned-capacity spend.
Read the full page →Yes, where needed. Tag each application's endpoint or inference profile, and log customer or tenant identifiers with token counts in application telemetry. NTSPL joins those to the bill. Do this only where pricing or margin decisions need it, as it adds logging and privacy considerations.
Read the full page →Only to the steady floor. GPU prices and generations change quickly, so long commitments carry real stranding risk. NTSPL recommends one-year commitments for proven inference load, short-term reserved capacity for training, and on-demand or Spot for experiments. Each commitment is re-checked against utilisation every quarter.
Read the full page →Allocation telemetry must not capture personal data unnecessarily, so NTSPL uses metadata, not prompts or outputs. RBI, SEBI and IRDAI-regulated entities often require data and inference to stay in India, which limits which model regions and capacity options are eligible and therefore affects commitment planning.
Read the full page →Databricks, Microsoft Fabric, Snowflake, BigQuery, Redshift and Synapse for data; SageMaker, Bedrock, Microsoft Foundry and Gemini Enterprise Agent Platform for AI; plus GPU instances and Kubernetes GPU pools on all three clouds. Allocation uses each platform's native billing or system tables.
Read the full page →There is no universal benchmark; it depends on the business value per unit. A document-extraction use case might be judged on cost per document against manual processing cost, an agent on cost per resolved conversation against a human-handled one. NTSPL publishes both numbers side by side.
Read the full page →GenAI cost engineering works inside one application: choosing smaller models for simple requests, caching responses, compressing prompts and batching offline jobs to reduce cost per call. Data and AI FinOps works across the organisation: attributing all lakehouse, GPU and model spend to teams and use cases, planning GPU and platform commitments, and deciding which use cases deserve to scale. A company with one GenAI product needs engineering first. A company with ten AI use cases on shared platforms needs FinOps first, because it cannot prioritise engineering effort without knowing which use cases cost most.
Read the full page →Twelve to sixteen weeks to reach a functioning council, policy set, KPI tree and first executive review. NTSPL prices setup as a fixed fee, with optional quarterly advisory afterwards. The internal cost is a FinOps lead, full-time for larger estates, plus a few hours a month from each persona.
Read the full page →The FinOps Foundation's FinOps Framework: its principles, personas, Inform, Optimize and Operate phases, and crawl-walk-run maturity model. NTSPL adapts it to Indian enterprise structures, such as group companies with inter-company recharges and April-March financial years, rather than inventing a proprietary method.
Read the full page →A FinOps lead reporting jointly to the CFO and CTO works best, so neither finance nor engineering sees it as the other's project. The lead needs enough technical depth to challenge architecture and enough finance fluency to own forecasts. NTSPL helps define the role and can coach an internal candidate.
Read the full page →Regulated entities must show board-level oversight of outsourced IT, including cloud. A documented FinOps operating model with council minutes, policies and executive reviews provides evidence of financial oversight of cloud services, complementing the risk and security governance those regulators require.
Read the full page →Three mechanisms matter most: enforced policies that stop common waste at creation, monthly team reviews that make owners look at their numbers, and architecture review triggers for new services above a cost threshold. NTSPL tracks erosion explicitly in the savings ledger so the council sees it early.
Read the full page →Usually yes, once cloud governance is stable. Marketplace purchases, observability and security SaaS, and database licences often total 15-30% of technology run cost. NTSPL typically adds them in the second six-month cycle, using the same council and KPI structure. The same allocation rules and KPIs then apply.
Read the full page →A managed cost operations service does the recurring work: weekly anomaly triage, cleanup tickets, schedule maintenance, recommendation follow-up. A governance framework decides how cost decisions are made: who owns what, which policies apply, what the KPIs are, how forecasts and commitments are approved. Operations without governance keeps cleaning up after decisions nobody made deliberately; governance without operations produces policies nobody executes. Organisations above about ₹1 crore a month generally need both: the framework first, so that operations staff, internal or outsourced, have clear rules and owners to work with.
Read the full page →With a Cloud Cost Assessment in most cases. It reconciles billing data to invoices, measures waste, commitment coverage and allocation gaps, and produces a priced register. That register decides which of the other engagements to run first, so effort goes where the money is rather than where the tools happen to point.
Read the full page →Yes. Each of the twelve engagements has its own scope, deliverables and savings measure. Clients often buy two or three, such as rightsizing, scheduling and commitments, and run the rest internally. The only firm sequencing rule is to remove waste before buying long-term commitments.
Read the full page →Fixed fees for assessments and governance design, and either fixed fees or a share of billing-verified savings for execution engagements such as rightsizing, storage and commitments. Savings are counted against agreed rules: run-rate reduction on the specific resources changed, net of any new commitment cost.
Read the full page →Assessments use read-only billing, monitoring and inventory roles. Execution work changes resources through your change process and, where infrastructure is code-managed, through pull requests to your Terraform or Bicep repositories. NTSPL does not make console changes to production outside agreed windows.
Read the full page →Yes. Billing exports, analysis datasets and dashboards are built in your own accounts in Indian regions: AWS Mumbai or Hyderabad, Azure Central India or South India, Google Cloud Mumbai or Delhi. This keeps tag values and resource names, which can include personal data, under your DPDP Act 2023 controls.
Read the full page →These engagements design and deliver specific changes and frameworks. Managed cost operations is the recurring run work afterwards: weekly anomaly triage, cleanup tickets, schedule upkeep and recommendation follow-up. Many clients use both, with the governance framework defining the rules that the operations service executes.
Read the full page →On a well-curated corpus, 90-95% of in-scope questions can be answered correctly with valid citations. The remaining errors usually trace to missing or contradictory source documents rather than the model. We measure accuracy on your own golden set before launch, so the number you see is specific to your content and users, not a vendor benchmark.
Read the full page →A first production assistant over one or two departments' content usually takes 8-10 weeks of NTSPL effort, with indicative fees from about ₹18-35 lakh depending on corpus size, connectors and identity complexity. Run cost is mostly model tokens and the search index, often ₹40,000 to ₹3 lakh a month for a few thousand users.
Read the full page →Yes, in most designs. Indexes, document stores and logs can sit in AWS Mumbai or Hyderabad, Azure Central India or South India, or Google Cloud Mumbai or Delhi. The model endpoint is the variable: we choose models offered in an Indian region with regional processing and avoid global or cross-region routing options when the data includes personal data.
Read the full page →Permissions are enforced at retrieval, not in the prompt. Each chunk carries the access groups of its source document, and the user's identity-provider groups are applied as a mandatory filter. A restricted passage never reaches the model, so it cannot be summarised. We verify this with a leak test using accounts from every group.
Read the full page →Start with the 200-500 documents behind the most frequent questions to a central desk, such as HR, credit policy, clinical protocols or product manuals, that have a named owner and a clear version history. Broad crawls of every share drive produce noisy retrieval and permission risk; we widen scope only after the first corpus meets its accuracy target.
Read the full page →Incremental sync picks up new and changed files every 15-60 minutes, and deleted or superseded files are removed within one cycle. Content owners get a weekly report of questions the assistant could not answer, which usually shows the gaps in documentation more clearly than any audit.
Read the full page →Use RAG. Fine-tuning changes how a model writes, not what it reliably knows, and it cannot cite a source, respect document permissions or forget a superseded circular without retraining. RAG keeps knowledge in an index you can update in minutes, filter by user and audit by citation. Fine-tuning earns a place later only for narrow style or format needs, such as producing a fixed report layout, or for a small model that must run cheaply at high volume. Even then it sits on top of retrieval, not instead of it. For policy, clinical, credit or engineering content, we have not seen a case where fine-tuning alone was the right first step.
Read the full page →Only where you explicitly allow it. Every action is assigned an autonomy level, and new agents start with all writes requiring approval. Actions move to notify-only status after hundreds of clean approvals and a documented sign-off. Payments, filings and customer communications usually stay behind approval permanently.
Read the full page →A first agent for one well-defined case type typically takes 10-12 weeks to assisted production, with indicative NTSPL fees of about ₹22-45 lakh depending on the number of systems and approval surfaces. Run costs are usually ₹8-40 per case in model and orchestration spend, depending on documents and tool calls.
Read the full page →Anything with an API, a database view or a message queue: SAP, Oracle, Dynamics, HRMS, ticketing tools, transport systems and email. We prefer API or MCP-server access with a dedicated service identity. Screen-driving is a last resort and only for read steps.
Read the full page →Each case has a trace showing the trigger, every plan step, tool call, tool response, checker result and the approver's decision with timestamps. Traces are retained in-region per your policy, and the replay harness can rerun any historic case against a newer agent version to show what would change.
Read the full page →Agents are new privileged identities, so their actions must be logged and retained, typically for at least 180 days in India to meet CERT-In's 2022 directions, and incidents must be reportable within six hours. Under the DPDP Act 2023, agents should access only the personal data needed for the case purpose.
Read the full page →The workflow engine holds case state, so the agent does not lose progress. Tool calls retry with backoff, and after a set threshold the case moves to a human queue with the work done so far. No write is retried without its idempotency key, so duplicate postings are prevented.
Read the full page →Use RPA, or better an API integration, when inputs are structured and screens are stable; it is cheaper per transaction and fully deterministic. Use an agent when cases arrive as emails, PDFs and exceptions that need reading and judgement before the next step, which is where RPA failure rates climb above 10-15%. In most programmes we build a hybrid: the workflow engine and existing bots handle fixed steps, and the agent handles classification, extraction, reconciliation and drafting. Replacing a working bot with an agent just to modernise adds cost and variability with no gain.
Read the full page →For clean printed forms and invoices, 75-85% of documents can pass with no human touch. For medical reports, handwritten forms or mixed bundles, 50-65% is a good outcome. We agree targets per document type after the sample audit, because averages across types hide where the effort really sits.
Read the full page →A pipeline for two to four document types typically takes 10-12 weeks with indicative NTSPL fees of ₹15-35 lakh, depending on labelling effort, rules and integrations. Processing costs usually range from ₹0.50 to ₹6 per page depending on extractor type, plus reviewer time on exceptions.
Read the full page →Identifiers are detected and masked in reviewer screens and logs. Aadhaar numbers are shown with only the last four digits unless a role needs the full value, and full numbers are stored only in an approved vault if your entity is permitted to hold them. PAN and GSTIN are format-validated during extraction.
Read the full page →Printed Devanagari and several other Indic scripts are supported by the major OCR services, but accuracy varies by script, font and scan quality. We test each candidate service on your own pages in the sample audit and report accuracy per language before committing to a platform.
Read the full page →Documents, extracted data and review logs can stay in AWS Mumbai, Azure Central India or Google Cloud Mumbai or Delhi. We confirm that each chosen extraction service and model is available in-region for your data class, which matters for DPDP Act 2023 obligations and for sector rules from RBI or IRDAI.
Read the full page →Every extracted value stores its page and bounding box, the extractor version and confidence, any rule results and the reviewer's change if one was made. Monthly accuracy is measured on a random sample double-checked by people, giving auditors a documented control rather than a vendor claim.
Read the full page →Replace it if more than a third of your volume falls outside its templates or the exception queue keeps growing; keep it if it already clears 85% of documents with acceptable accuracy. Template OCR is cheap per page but brittle: every new supplier layout or form revision needs a new template. AI-based IDP generalises across layouts, handles handwriting and merged bundles better and gives per-field confidence that lets you automate safely. The cost per page is higher, so we often keep template extraction for the few stable high-volume layouts and route everything else through the AI pipeline.
Read the full page →It adds semantic matching, so 'notice period for resignation' finds the clause titled 'termination by employee', and it ranks with a trained re-ranker rather than title words and dates. It also spans multiple repositories in one index, with permissions mirrored from each, and extracts metadata so users can filter by model, matter, client or date.
Read the full page →A search layer over two to four repositories typically takes 10-12 weeks with indicative NTSPL fees of ₹16-32 lakh. Run cost depends on index size and query volume; for one to five million passages and a few thousand users, expect roughly ₹60,000 to ₹2.5 lakh a month for the search service and embeddings.
Read the full page →Yes. Each document's access list, including nested groups and ethical-wall exclusions, is captured from the source and stored with the index entry. Every query carries the user's resolved groups as a filter, so a restricted document never appears in results, counts or facets. We verify this with test accounts before go-live.
Read the full page →We use judgement lists, where experts grade results for real queries, and compute NDCG@10 and success at first result before and after. In production we track zero-result rates, reformulations and clicks on the first three results. Satisfaction surveys alone are too noisy to steer tuning.
Read the full page →Yes. Azure AI Search, Amazon OpenSearch Service and Google Cloud search services can be deployed in Indian regions such as Central India, Mumbai or Delhi. We confirm the embedding model also runs in-region, since sending passages to an embedding endpoint elsewhere would move data outside India.
Read the full page →Largely, yes. Multilingual embedding models handle Hindi and Hinglish queries reasonably for semantic matching, and we add transliteration synonyms for common terms. We test on your actual query logs, because performance on technical vocabulary in Indian languages varies by model and by how users type.
Read the full page →Build search first in most cases. A RAG assistant is only as good as the retrieval underneath it, and search is that retrieval with a ranked list people can inspect. Search also serves intents a chatbot handles badly: finding a specific drawing, a signed version, a form or every document mentioning a party. Once success-at-one is above about 60% and permissions are proven, add a generated answer panel or a separate assistant on the same index. Going straight to a chatbot hides poor retrieval behind fluent text, and teams then tune prompts to fix what is really a ranking problem.
Read the full page →On a well-described semantic layer with verified examples, 85-95% of in-scope questions return the correct number. Accuracy against raw warehouse tables is much lower. We measure execution accuracy on your own question set before launch and publish the result to users, along with the types of questions the tool will refuse.
Read the full page →If a governed semantic model already exists, a first persona can go live in 8-12 weeks with indicative NTSPL fees of ₹12-28 lakh. Most of the effort is metric certification and descriptions. Platform cost depends on Fabric capacity, Looker licences or Quick Sight seats, plus modest model usage.
Read the full page →No, if designed correctly. Queries run under each user's own identity, so the same row-level and column-level security as their existing reports applies. We test with accounts from each persona, such as a regional manager and a national head, to confirm results differ as expected.
Read the full page →Current models handle Hinglish questions about business data reasonably well, especially when the glossary includes common local terms. We include Hinglish questions in the test set and add synonyms for terms users actually type. Answers can be phrased back in the user's language while numbers come from the governed query.
Read the full page →Queries run in your existing warehouse region, such as Azure Central India, AWS Mumbai or Google Cloud Mumbai. Only schema context and the question go to the model; result rows may be summarised by it. Where results include personal data, the DPDP Act 2023 applies, so we restrict models to in-region deployments.
Read the full page →Questions requiring forecasts, statistical tests or data that is not in the governed layer should be routed to analysts. We configure the tool to recognise these and hand them off rather than improvise. Over time, frequent hand-offs show which metrics to add to the semantic layer next.
Read the full page →Yes. Dashboards remain the right tool for the 10-20 KPIs a role checks every day, for trend monitoring and for board packs, because they are consistent, scannable and cheap to serve. Conversational analytics covers the long tail: the one-off cut, the follow-up question and the field manager who will never open a BI tool. Both should sit on the same certified semantic layer so that a number in chat matches the number on the dashboard. Build or fix the semantic model first, keep dashboards for monitoring, and add conversation for exploration.
Read the full page →Major cloud speech and language services support Hindi, Bengali, Tamil, Telugu, Marathi, Gujarati, Kannada, Malayalam and others, with quality varying by language, accent and audio channel. We test word error rate on your own recordings and launch languages that meet the threshold, keeping others on agent assist until they do.
Read the full page →Agent assist for one contact centre typically takes 6-8 weeks and self-service for the top intents another 8-10 weeks, with indicative NTSPL fees of ₹20-50 lakh in total depending on channels, languages and integrations. Run costs are usually ₹1.5-6 per contained conversation, well below the cost of a human-handled contact.
Read the full page →Yes, through the WhatsApp Business Platform via an approved provider. The same orchestrator serves WhatsApp, web chat and app channels. WhatsApp conversation pricing and template approval rules apply, and sensitive actions still need step-up authentication within the flow, such as an OTP or a deep link to the app.
Read the full page →Recordings and transcripts are stored in-region, such as AWS Mumbai, Azure Central India or Google Cloud Mumbai, with card numbers and identifiers redacted. Consent notices are played at the start of calls, retention follows your policy, and under the DPDP Act 2023 access is limited to the stated purpose.
Read the full page →Not in practice. Assistants absorb repetitive transactional contacts and paperwork, which lets agents focus on complex, sensitive and sales conversations. Most centres we work with use the capacity to cut wait times and absorb growth rather than reduce headcount sharply, and agent assist makes new hires productive faster.
Read the full page →Agent assist summaries usually show measurable after-call work reduction within four weeks of pilot launch. Self-service containment grows over 8-12 weeks as intents are tuned on real conversations, so we agree intent-level targets and review them weekly rather than judging the programme on its first month.
Read the full page →A traditional bot or IVR works only when users follow the menu or use expected keywords; most containment is lost the moment someone explains their problem in their own words. A generative assistant understands free-form, code-mixed requests and can fill several details from one sentence, which typically raises containment on the same intents by 10-25 points. What does not change is the need for back-end APIs, strict authentication flows and fixed regulatory wording. The best design keeps deterministic flows for those and uses the model for understanding and conversation, rather than replacing everything with an open-ended chat.
Read the full page →Yes, provided its data can be reached. We typically expose the needed modules or database views through APIs, hosted on-premises or in the cloud, and add the AI feature either inside the desktop client or through a web panel launched from it. Where the client cannot be changed, a browser extension or side app is a fallback.
Read the full page →A first wave of two or three AI features in one application typically takes 10-14 weeks, with indicative NTSPL fees of ₹18-40 lakh depending on how much API work the legacy code needs. Model run costs are usually small relative to user time saved, often ₹2-10 per assisted record.
Read the full page →It gives one place to control which models are used, how many tokens each application can consume, what is logged and how failures are handled. Without it, every application holds its own keys and policies, so changing a model or answering an auditor's question about AI usage means touching every codebase.
Read the full page →It can. New data flows to model endpoints must be recorded in your processing register under the DPDP Act 2023, logs must support CERT-In incident reporting, and regulated entities may need to inform RBI, SEBI or IRDAI-mandated committees. Keeping models in Indian regions and masking personal data in the gateway simplifies this.
Read the full page →They help, but not automatically. Code assistants explain unfamiliar code, generate tests and handle repetitive framework upgrades well. Business-logic extraction from stored procedures and UI code still needs engineers who understand the domain, and every generated change must pass review and regression tests before release.
Read the full page →Each feature records accept, edit and reject actions and the time spent per record. After four to six weeks we compare acceptance and time saved with the agreed target. Features that miss are fixed or removed; this keeps the application from accumulating AI buttons nobody uses.
Read the full page →Add AI to the existing application first unless it is already scheduled for replacement within a year. A targeted strangler approach delivers AI features in 10-14 weeks and proves which ones users actually adopt, while a rebuild takes 12-24 months and bets on assumptions about AI value. The API facade and AI gateway you build are not wasted; a later rebuild reuses both. Rebuild first only when the legacy platform is unsupported, insecure or cannot be integrated at all, for example a desktop application with no reachable database layer and an expired vendor contract.
Read the full page →Leaderboards test general reasoning, coding and knowledge, not your documents, languages or formats. We regularly see a mid-ranked model outperform a leader on a specific extraction or Indian-language task, and at a fraction of the cost. Only an evaluation on your own tasks tells you which model is good enough.
Read the full page →For two or three use cases, a bake-off typically takes four to six weeks with indicative NTSPL fees of ₹8-18 lakh. Model usage during evaluation is usually ₹50,000 to ₹3 lakh. The datasets and harness remain yours, so later re-evaluations take days rather than weeks.
Read the full page →Availability changes frequently and differs by provider, model and deployment type. Each platform offers some models in its Indian regions, while others are only reachable through global or cross-region endpoints that may process data elsewhere. We check current availability for each candidate during shortlisting and treat in-India processing as a hard constraint where personal data is involved.
Read the full page →Sometimes. Fine-tuning a small model on a few thousand high-quality examples can match a larger model on a narrow, stable task at much lower serving cost. It adds training, versioning and re-evaluation work. We include a fine-tuned candidate in the bake-off only when volume is high and the task is stable.
Read the full page →Considerably. Quality in Hindi, Tamil, Bengali or Marathi varies more between models than English quality does, and tokenisation can make Indic text several times more expensive per word. We test each language separately and include models trained with stronger Indic coverage in the shortlist.
Read the full page →Re-run it when a model you use is announced for retirement, when a new candidate offers a likely cost or quality gain, or every six months for high-spend use cases. Because the datasets and harness already exist, a re-run usually takes three to five days.
Read the full page →Choose the platform where your identity, data and commercial commitments already sit, unless a measured quality gap on your tasks says otherwise. Organisations on Microsoft 365, Entra ID and Fabric usually gain most from Foundry and its OpenAI models. Those with data lakes on AWS benefit from Bedrock's breadth of model families under one API. BigQuery-centred organisations find Gemini Enterprise Agent Platform simplest, with strong multimodal and long-context models. All three offer enterprise controls and Indian regions for core services. Decide with a bake-off on your own data, then route any exceptional model needs through a common gateway rather than splitting governance.
Read the full page →Prompt injection is an attack in which text supplied by a user, or hidden in a document, email or web page the model reads, overrides the application's instructions. It can make an assistant reveal confidential context or make an agent take unintended actions. OWASP ranks it as the top risk for LLM applications.
Read the full page →A first programme covering inventory, policy, platform controls and red-teaming of three to five applications typically takes 10-12 weeks, with indicative NTSPL fees of ₹20-45 lakh. Ongoing costs include filter and gateway services, usually small, and periodic red-team testing for high-tier applications.
Read the full page →The DPDP Act 2023 governs personal data in prompts, retrieval and logs. CERT-In's 2022 directions require incident reporting within six hours and 180-day log retention in India. Regulated entities should also align with sector expectations; RBI's FREE-AI committee report of August 2025 sets out principles for responsible AI in financial services.
Read the full page →Not mandatory, but useful when customers, partners or regulators ask for evidence of an AI management system. It integrates well with an existing ISO 27001 programme. Many organisations first implement the controls and governance aligned to 42001 and decide on certification after a year of operation.
Read the full page →Partly. Offer an approved enterprise AI tool with data protection terms, block or warn on unapproved services at the network or browser level, and use DLP to detect sensitive data being pasted. Banning AI without an alternative usually drives use onto personal devices, which is harder to control.
Read the full page →Customer-facing, financial or agentic applications should be tested before launch and at each major release, and at least annually. Internal low-risk tools can rely on automated attack testing in their pipelines. Successful attacks from each exercise become permanent regression tests, so protection improves over time.
Read the full page →Extend what you have rather than building a parallel structure, but do not assume it already covers GenAI. Existing IT security, data classification and change management handle much of the baseline. What they miss are risks specific to models: prompt injection, unreliable outputs used in decisions, agents acting on systems, model vendor changes and training-data questions. Add an AI inventory, risk tiers, AI-specific testing and a named owner for each AI system, and report them through the existing risk committee. ISO/IEC 42001 is designed to integrate with an ISO 27001 management system in exactly this way.
Read the full page →LLM-as-a-judge uses a language model with a scoring rubric to grade another model's outputs. It is trustworthy only after calibration: we compare its scores with human expert labels on 100-200 items and use it for gates only when agreement is high. Humans still review a sample of judged outputs.
Read the full page →For one or two production applications, a typical engagement takes six to eight weeks with indicative NTSPL fees of ₹10-24 lakh. Ongoing costs include trace storage and online judge calls, usually 10-25% of the application's own model spend, plus a few hours a week of expert review.
Read the full page →Faithfulness, meaning claims are supported by retrieved context; citation precision; answer relevance; retrieval recall on known questions; and correct refusal for out-of-scope questions. Latency and cost per answer complete the picture. We avoid single overall quality scores because they hide which component failed.
Read the full page →Yes. Trace stores, logs and evaluation results can sit in AWS Mumbai, Azure Central India or Google Cloud Mumbai or Delhi. CERT-In's directions require ICT logs to be retained for 180 days within India, and DPDP Act 2023 obligations apply to personal data in prompts and responses, so we mask identifiers at ingestion.
Read the full page →Not necessarily. The native tracing and evaluation services on each cloud cover most needs, especially when combined with OpenTelemetry. Specialist open-source or commercial LLM observability tools add richer trace views and dataset management; we recommend them when several applications span multiple clouds.
Read the full page →We score whole tasks, not just final text: task completion against expected outcome, number and correctness of tool calls, policy compliance at each step, human override rate and cost per task. Replaying historic cases through a new agent version is the most reliable pre-release test.
Read the full page →Traditional tests assert exact outputs; GenAI outputs vary between runs and many correct answers exist. Evaluation therefore uses scored metrics over datasets rather than pass-or-fail assertions, and judges, human or model-based, to grade open-ended outputs. It also never ends at release: models, content and user behaviour change, so production traffic must be sampled and scored continuously. Keep conventional unit and integration tests for code, schemas and tool contracts, and add golden-set evaluation, calibrated judges and online monitoring on top. Teams that rely only on manual demo checks discover regressions from users, usually weeks late.
Read the full page →Usually more than model choice. In our projects, deduplication, version resolution and structure-aware chunking often raise retrieval recall by 15-30 points on the same queries and model. A strong model cannot recover an answer from a passage that retrieval never surfaces, or choose correctly between three conflicting copies.
Read the full page →A pipeline for one to three major sources typically takes 8-10 weeks with indicative NTSPL fees of ₹14-30 lakh, depending on scan share, formats and redaction needs. Processing costs vary widely: born-digital text costs very little per page, while vision-based parsing of drawings can cost ₹1-5 per page.
Read the full page →We detect structured identifiers with patterns and checksum validation, and names, addresses and contact details with model-based detection, then mask them before embedding. Under the DPDP Act 2023, personal data should be processed only for a specified purpose, so most AI corpora do not need identifiers at all.
Read the full page →Often yes, with enhanced OCR and clean-up. Scans below about 200 dpi, faded carbon copies and handwriting reduce accuracy, so we score OCR confidence per page and report pages below threshold. Owners then decide whether to re-scan, transcribe critical pages or exclude them.
Read the full page →Staging, processing and vector stores can run in AWS Mumbai or Hyderabad, Azure Central India or South India, or Google Cloud Mumbai or Delhi. We confirm that the chosen parsing, PII and embedding services are available in-region, because sending content to an out-of-region endpoint moves the data.
Read the full page →Match refresh to how often content changes and how costly stale answers are. Policy and protocol libraries usually need hourly or daily incremental runs; archives may need weekly runs. Deletions and supersessions must propagate within one run, or stale content keeps appearing in answers.
Read the full page →Start with managed connectors and default chunking if the corpus is small, born-digital and well organised; they are quick and cheap to run. Move to a custom pipeline when profiling shows high duplication, many scans, complex tables, personal data or inconsistent vocabulary, because managed defaults cannot resolve versions, normalise terms or redact Indian identifiers to your rules. In practice many programmes use both: custom preparation writes a clean, enriched corpus to storage, and the managed knowledge base or search service indexes that corpus. This keeps managed retrieval features while controlling what goes in.
Read the full page →For applications that have not been optimised, a 35-65% reduction in cost per task is common, mostly from routing simple requests to smaller models, trimming context, prompt caching and moving offline work to batch. Applications already using small models and tight prompts see smaller gains, often 15-25%.
Read the full page →A focused engagement on one to three GenAI applications typically takes six to eight weeks with indicative NTSPL fees of ₹8-20 lakh. Where monthly model spend exceeds ₹10 lakh, savings usually exceed fees within two to four months. We report savings from billing data, not estimates.
Read the full page →Not if it is gated properly. We compare the routed configuration with the original on the application's evaluation set and accept it only within an agreed tolerance, usually one to two points. Low-confidence requests escalate to the larger model automatically, and online monitoring catches drift after rollout.
Read the full page →Many tokenisers split Devanagari, Tamil or Bengali text into more tokens per word than English, so the same message can cost several times more. We measure token counts per language, compare models with more efficient Indic tokenisation and keep system prompts in English where it does not affect output quality.
Read the full page →Tag every model call at the gateway with application, feature and team, using inference profiles, API Management subscriptions or labels, then join token telemetry with billing exports. This gives showback per business unit and cost per task per feature, which is far more useful than one AI service line on the cloud bill.
Read the full page →It can if done carelessly. We exclude personalised, account-specific and sensitive answers from semantic caches, keep caches in-region, such as AWS Mumbai or Azure Central India, and expire entries when source content changes. Provider prompt caches are short-lived and scoped to your account, but data classification still applies under the DPDP Act 2023.
Read the full page →Pay-as-you-go is cheaper for most workloads until steady utilisation of a reserved unit stays above roughly 60-70% for most of the day. Provisioned throughput, such as Azure PTUs or provisioned capacity on Bedrock and Google Cloud, buys predictable latency and avoids throttling, but you pay for idle hours. The best pattern for spiky enterprise traffic is a modest reservation covering the steady base load, with on-demand spillover for peaks and batch lanes for anything non-urgent. Before committing, optimise prompts and routing first; reserving capacity for an unoptimised workload locks in waste for the commitment term.
Read the full page →Start with one workflow that has high volume, clear pain and measurable outcomes, such as policy queries to a central desk, document keying or contact-centre after-call work. Build a golden test set with the users first. A focused first application in 8-12 weeks teaches more than a broad platform programme with no live users.
Read the full page →Standardise on one primary platform where your identity, data and enterprise agreements already sit, because governance, networking and skills are simpler. Use a second cloud only for a specific, measured advantage, such as a model that performs materially better on your task, and route it through the same AI gateway.
Read the full page →We design for the DPDP Act 2023 from the start: purpose-limited data, masking of identifiers, in-region storage and model processing where personal data is involved, and defined retention for prompts and logs. Logging follows CERT-In's six-hour reporting and 180-day retention directions, and sector expectations from RBI, SEBI or IRDAI shape governance.
Read the full page →Agent-assist and document features often show measurable time savings within four to six weeks of pilot launch. Assistants and agents typically reach assisted production in 10-14 weeks. We set baselines before build so value is measured against real numbers, not demo impressions.
Read the full page →Yes. After hand-over we can operate applications under managed support: monitoring quality and cost, refreshing golden sets, re-evaluating when models change, updating content pipelines and handling incidents. Many clients keep product ownership in-house and use NTSPL for evaluation, security testing and FinOps cycles.
Read the full page →Usually three things: no agreed accuracy measure, so trust collapses after the first visible error; poor source content, which no model can fix; and costs that grow faster than value because nobody owns unit economics. Our capabilities in evaluation, data preparation and FinOps exist specifically to prevent these.
Read the full page →Typically 6-8 weeks for a mid-size enterprise with 10-25 source systems; groups with several business units take 10-12 weeks. Most engagements are fixed-price, between INR 18 and 45 lakh, and include the roadmap, reference architecture and steering-committee paper. Optional proofs of concept are quoted separately.
Read the full page →Yes, but only after the scoring is agreed. We work across AWS, Azure and Google Cloud and record the reasons in architecture decision records. Where your ERP, identity and skills already sit on one cloud, that usually wins unless a specific capability gap is proven.
Read the full page →It requires you to process personal data only for stated purposes and to erase it when the purpose ends. Architecturally, that means tagging personal data at ingestion, keeping a purpose register per dataset, designing for deletion across lake and warehouse copies and logging access. We bake these into the domain and zone design.
Read the full page →Usually not on day one. Mesh pays off when several domains have their own engineers and clear owners. Most Indian mid-market firms do better with a central platform team and domain-aligned squads, federating once two or three domains publish stable data products. That usually happens in phase three.
Read the full page →A decision-ready board paper, a reference architecture, a domain map with owners, an operating model and a quarterly roadmap with costs. Phase one is specified in enough detail to raise a purchase order or brief an internal team the following week, without another discovery round.
Read the full page →Yes. We assess its fit in the target state and decide whether to retire, migrate or keep it for a defined period, usually 12-24 months. If migration is chosen, the detailed move is planned and executed under our Data Modernization & Migration service.
Read the full page →Strategy first, if more than one business unit or platform is involved. A proof of concept shows whether a tool can run your queries; it cannot tell you which 15 KPIs matter, who owns the customer master or how to fund domain teams. We have seen PoCs succeed technically and programmes stall for a year on ownership. With a single team, source and use case, skip strategy and run a 4-week PoC. Otherwise run a short strategy sprint and use the PoC only to break ties.
Read the full page →Yes. We read redo logs from a Data Guard standby or use supplemental logging on a replica, so the primary sees negligible additional load. We measure source CPU and I/O before and after go-live and share the comparison with your DBA team.
Read the full page →Effort scales with source count and type. A typical first release of 8-12 sources, mixing CDC and SaaS connectors, takes 8-10 weeks and costs INR 25-50 lakh. Cloud run cost for managed CDC is usually INR 40,000-2 lakh a month depending on change volume.
Read the full page →For RBI-regulated payment data and most personal data under DPDP-driven policies, we keep capture, landing and processing in Indian regions such as AWS Mumbai, Azure Central India or Google Cloud Mumbai. Pipeline logs are retained 180 days to align with CERT-In directions.
Read the full page →Under the agreed drift policy, new nullable columns flow automatically and widened types are accepted. Renames and drops stop that table's pipeline and alert the owner before bad data lands, so downstream reports never silently lose a field. Every block is logged with the schema version.
Read the full page →Only if several systems consume the same change stream or you need sub-minute latency at scale. For a single warehouse target with 15-minute freshness, managed CDC straight into the lake or warehouse is simpler and needs fewer specialist skills. We add Kafka later if consumers multiply.
Read the full page →Yes. We start with a two-week audit of existing jobs, reconciling counts for every table, then migrate fragile jobs first. Pipelines that already reconcile cleanly are documented and kept rather than rewritten for the sake of it. Audit findings are shared table by table.
Read the full page →For tables above roughly 50 million rows or with high daily churn, log-based CDC is better on every count: it reads the transaction log instead of querying tables, adds almost no source load, captures deletes and delivers changes in minutes. Nightly extracts remain fine for small reference tables and sources without accessible logs, such as some SaaS apps. The cost of CDC is operational: log retention, replica access and someone who understands restarts. Most estates we build end up 70-80% CDC by volume and batch for the long tail.
Read the full page →Standard object storage in Indian regions costs roughly INR 1.8-2.2 per GB per month, and archive classes a small fraction of that. A 200 TB lake with sensible tiering usually runs INR 2-3 lakh a month for storage. Our build engagements typically cost INR 20-40 lakh over 8-10 weeks.
Read the full page →Yes. We pin storage, catalogue and query services to Indian regions such as AWS Mumbai or Hyderabad, Azure Central India and Google Cloud Mumbai or Delhi, and use policies that block replication outside India for datasets tagged as regulated. Access logs stay in India too.
Read the full page →Yes, on a schedule. Raw zones exist for replay, not for ever. We keep raw data 30-90 days for most sources, longer only where a regulator or contract requires it, and delete personal data when its DPDP purpose ends. Deletion jobs are logged as evidence for audits.
Read the full page →Use the engine native to your primary cloud: Athena or Redshift Spectrum on AWS, Synapse serverless SQL, Fabric or Databricks on Azure, and BigQuery over BigLake tables on Google Cloud. All of them read Parquet from the same catalogue. Pick one primary engine to keep skills focused.
Read the full page →Usually. We profile access logs to find what is actually read, register and convert those datasets first, then archive or delete the rest with owner sign-off. Clients typically reclaim 30-50% of stored volume in the process. Consumers are moved to the cleaned datasets before anything is deleted.
Read the full page →Nothing becomes readable without a catalogue entry, owner and sensitivity tag, and sandbox prefixes expire after 90 days. A monthly report lists uncatalogued prefixes and orphaned data, and owners must act on it. Uncatalogued data older than 60 days is quarantined, then removed.
Read the full page →Build a lake when a large share of your data is semi-structured or high-volume (logs, clickstream, sensor readings, documents), when data scientists need raw history, or when long retention must be cheap. Build a warehouse when data is mostly structured, users are mainly BI analysts and volumes are moderate. Many organisations need both, which is why most new builds in 2026 use a lakehouse: lake storage with open table formats and warehouse-style SQL on top. A plain lake without a table format is now mainly justified for raw retention and data science.
Read the full page →The first certified mart typically goes live in 8-10 weeks, and a warehouse covering finance, sales and operations in 4-6 months. Build cost for a mid-size company usually falls between INR 35 lakh and 1 crore, depending on source count and the number of marts.
Read the full page →Yes. We build regulatory marts at the grain each return needs, reconcile them to the general ledger and keep lineage from return line back to source records. Auditors can trace every figure, and spreadsheets drop out of the filing process.
Read the full page →Both work well. Dataform is built into BigQuery and is the natural choice on Google Cloud. dbt supports Redshift, Fabric, Snowflake and BigQuery and has a larger community, so we use it on AWS, Azure and multi-cloud estates. The modelling approach is identical either way.
Read the full page →We deploy in Indian regions: Redshift in AWS Mumbai or Hyderabad, Fabric capacity in Azure Central India or South India, and BigQuery datasets in Mumbai or Delhi. Dataset location is fixed at creation and enforced through organisation policies. Backups and snapshot copies stay in-country, using the paired Indian region for DR.
Read the full page →Yes, after re-pointing to the marts. We map each existing report to certified columns, rebuild calculations that duplicated warehouse logic and run old and new reports in parallel for one close cycle before switching. Users keep familiar report layouts throughout.
Read the full page →Incremental models re-process a rolling window, typically 7-35 days, so late entries and credit notes land in the right period. Larger corrections trigger a dated restatement that finance approves, with history preserved. Each restatement is logged with its reason and approver.
Read the full page →Choose by estate, not benchmark. If your ERP, identity and engineering skills are on AWS and workloads are steady, Redshift with reserved RA3 capacity is usually cheapest per query. If you live in Microsoft 365 and Power BI, Fabric Warehouse removes import refreshes through Direct Lake and simplifies licensing on one capacity. If workloads are spiky, ad hoc and you want minimal administration, BigQuery is the easiest to run. All three handle 1-100 TB comfortably; the deciding costs are egress, skills and BI integration.
Read the full page →A first domain with bronze, silver and gold layers and BI serving typically takes 12-16 weeks and costs INR 45 lakh to 1 crore, depending on source count and ML scope. Run cost depends mostly on compute; storage in Indian regions is a minor share for most clients.
Read the full page →Yes. On Fabric, Power BI uses Direct Lake mode on Delta tables in OneLake, avoiding import refreshes. On other platforms Power BI connects to a SQL warehouse endpoint, such as Databricks SQL or Athena, which reads the same tables. Permissions come from the same catalogue.
Read the full page →Neither is universally better. Delta is the native choice on Databricks and Fabric; Iceberg has the broadest multi-engine support across AWS, Google Cloud and Snowflake. We decide by your primary engines and prove reads and writes before committing. Switching later is possible but costly.
Read the full page →Erasure needs three steps: delete or update rows, expire the snapshots that still reference old files, and remove orphaned files. We automate all three on a schedule and keep a deletion log as evidence for the Data Protection Board if needed.
Read the full page →Usually not for new builds. Gold tables and serverless SQL endpoints serve most BI needs. Some clients keep an existing warehouse for a defined period while dashboards are re-pointed, then retire it. Re-pointing normally takes one or two reporting cycles, after which the separate warehouse licence and its pipelines can be removed.
Read the full page →Technically yes, with Iceberg tables and engines in each cloud reading a shared catalogue, but cross-cloud reads incur egress and latency. We recommend one primary storage location in India and sharing curated gold tables, not raw data, across clouds. Each cloud then serves its own users.
Read the full page →Usually yes once data passes about 50 TB or ML is a real workload, because you stop paying for duplicate storage, duplicate pipelines and the reconciliation between them. A separate warehouse can still be faster for highly concurrent BI on small data, and managed warehouses need fewer specialist skills. The honest test is your own workload: we run the top 20 queries and one training pipeline on both designs for two weeks and compare cost, latency and engineering effort before recommending.
Read the full page →A first use case with ingestion, one or two stream jobs, a hot store and live dashboards typically takes 10-12 weeks and costs INR 35-70 lakh. Run cost depends on throughput: a pipeline at 10,000 events a second usually costs INR 1.5-4 lakh a month.
Read the full page →Yes, if sized for them. We replay recorded peak traffic at three times its volume before go-live and set autoscaling and partition counts from those tests, not from average daily load. Peak drills are repeated before each known event. Results are shared before each event.
Read the full page →Yes. Events containing personal data are processing under the DPDP Act, so we minimise fields at the producer, mask identifiers in hot stores and keep processing in Indian regions. Pipeline logs are retained 180 days for CERT-In incident investigations. Hot stores keep only 24-72 hours of data.
Read the full page →They should, within a small, explained tolerance. The same events land in the lakehouse, and a daily job compares stream and batch totals. Differences above 0.1% raise an alert and are explained, usually by late events or duplicates. Finance-grade figures always come from batch.
Read the full page →Yes. For one or two consumers on a single cloud, Kinesis, Event Hubs or Pub/Sub are simpler and cheaper to operate. We design topics and schemas so you can move to Kafka later without changing producers. The migration then changes only consumers.
Read the full page →Consumer lag, watermark delay and job health have their own alerts to your on-call team or to NTSPL under a managed services agreement. Runbooks cover restarts from checkpoints, replays and scaling during unexpected spikes. Each incident ends with a short review and runbook update.
Read the full page →Choose Flink when latency must stay under a few seconds, state is large or event-time semantics are complex, such as sessionisation or pattern detection; managed Flink is available on AWS and through partners elsewhere. Choose Spark Structured Streaming when your team already runs Databricks or Fabric and 10-60 second latency is acceptable, because one engine for batch and streaming reduces skills and code. On Google Cloud, Dataflow covers both cases well. We decide by latency class and existing skills, not benchmark claims.
Read the full page →A first wave covering three to four roles, one semantic model and report rationalisation typically takes 10-12 weeks and costs INR 25-55 lakh. Licensing is separate and depends on viewer numbers, so we model per-user versus capacity options for you before rollout.
Read the full page →Yes. We pull usage logs, group reports by dataset and measure, and identify duplicates and unused content. Typically 50-70% of reports are archived or merged, and the remaining ones are rebuilt on certified semantic models over several sprints. Usage is re-measured after each sprint.
Read the full page →Yes, when designed for it. We build separate phone layouts with three to five KPIs, test them on 4G connections in actual stores or branches, and add push alerts so staff do not need to open the app to learn about exceptions.
Read the full page →Yes. Security roles map to identity groups such as Entra ID or IAM Identity Center, so a branch manager sees only their branch and a regional head sees their region. Hierarchy changes in HR systems flow through without editing reports.
Read the full page →Yes. Power BI Embedded, Looker embedding and Quick Sight embedding all support row-level security per external user. We keep partner data in Indian regions and log access, which helps with DPDP obligations where partner users see customer data. Partner logins are reviewed quarterly.
Read the full page →Each dashboard has a named business owner, a decision it supports and a usage target. We track weekly active users by role and review them monthly with owners. Low-usage dashboards are redesigned or retired rather than left to accumulate. Owners present usage alongside results.
Read the full page →Power BI is the default for Microsoft 365 organisations: strong self-service, Excel integration and, on Fabric F64 capacity or above, free-licence viewing for large audiences. Looker suits teams that want every metric in version-controlled LookML over BigQuery and strong embedding in their own apps. Amazon Quick Sight is the practical choice for AWS-centric estates rolling dashboards out to thousands of occasional viewers at low per-user cost. Tool choice matters less than having one semantic model; most failures we fix are definition and adoption problems, not tool problems.
Read the full page →For the first 50-150 critical elements, scorecards and lineage are usually live within 10-12 weeks, and quality pass rates rise noticeably within one or two reporting cycles. A first phase typically costs INR 30-60 lakh depending on the number of source systems.
Read the full page →RBI expects banks to submit accurate, timely returns and has pushed automated data flow from source systems for regulatory reporting. Lineage from return line to source, documented ownership and quality checks give compliance and audit teams the evidence they need when submissions are questioned.
Read the full page →Use the one native to your main data platform: Purview for Azure and Fabric, Dataplex Universal Catalog for BigQuery, SageMaker Catalog and Glue for AWS. Cross-cloud estates can still standardise on one, but lineage is richest for the platform it is built for.
Read the full page →We can within analytics: matching rules, survivorship and a golden record for reporting, with duplicate rates tracked on the scorecard. Fixing duplicates in operational systems needs process changes at data entry, which we specify and hand to system owners. Golden records are reviewed quarterly.
Read the full page →The business owns definitions and fitness; IT and data engineering own the pipelines and rule execution. Stewards, usually in operations or MIS teams, investigate and fix issues. Making IT the owner is the most common reason quality programmes fail. Owners must sign off definition changes.
Read the full page →Typically 3-6 rules per critical element covering completeness, validity, uniqueness, consistency and timeliness, so 300-600 rules for a first phase. More is not better: each rule needs a threshold, an owner and a reason someone will act on its failures.
Read the full page →Process first, with the tool chosen early but deployed narrowly. A catalogue cannot decide who owns 'active customer' or what threshold makes a regulatory feed unfit. Programmes that buy and scan first end up with tens of thousands of uncurated assets and no stewards. Programmes that define owners and rules for critical elements first, then use Purview, Dataplex or SageMaker Catalog to publish lineage and scores, show results within one quarter. Choose the tool native to your primary data platform; switching later costs more than any feature gap.
Read the full page →A mid-size estate of 20-80 TB with 2,000-5,000 objects typically takes 6-9 months in three to five waves. Costs commonly range from INR 80 lakh to 3 crore depending on code volume and the share of logic that cannot be auto-converted.
Read the full page →Tools such as BigQuery Migration Service and AWS SCT usually convert most standard SQL and DDL. Procedural code, vendor-specific functions and dynamic SQL need engineer work. We measure the rate on a pilot workload in the first month rather than promise a figure upfront.
Read the full page →Yes. Where an offline appliance is offered for India it is loaded within India; otherwise bulk data moves online over private links. Either way data is ingested into Indian regions such as AWS Mumbai, Azure Central India or Google Cloud Delhi. Chain-of-custody and encryption keys remain under your control throughout. Transfer logs are kept as audit evidence.
Read the full page →They are re-pointed to the new platform wave by wave and compared output by output with the legacy versions. Reports unused for 90 days or more are retired rather than migrated, after owners confirm. Users approve each report before the switch.
Read the full page →Usually, once dual running ends and licences are terminated, often by 30-50% on total run cost. Savings depend on tuning partitioning and compute; a lift of the old design without tuning can cost more, so FinOps controls are built in from the first wave.
Read the full page →Only for objects in the wave being cut over, typically for two to four weeks. Other areas continue normally, and any changes made during a wave are tracked and applied to both platforms until cut-over. Freeze windows are agreed per wave.
Read the full page →Re-platforming to a cloud-native warehouse or lakehouse, done in waves with parallel runs, is safer over the life of the platform. Lifting a Teradata or Hadoop stack onto cloud VMs keeps the licences, the administration effort and the batch-window problems, and often costs more than on-premises. The real safety comes from reconciliation, not from avoiding change: if every certified output matches for two cycles before cut-over, the business sees no difference on day one. Lift-and-shift only makes sense as a short bridge when a data centre exit date cannot move.
Read the full page →A first production model, including feature pipelines, MLOps deployment and a holdout test, typically takes 12-16 weeks and costs INR 30-65 lakh. Further models reusing the same feature store and pipelines usually cost 40-60% less each. Cloud run costs are usually modest.
Read the full page →For demand or load forecasting, at least two full seasonal cycles, ideally three years. For churn or propensity, 12-18 months with enough positive cases, generally a few thousand. We check sufficiency in the first two weeks before committing to model build.
Read the full page →Yes, if the purpose is covered by consent or a legitimate use, and data is minimised. We use pseudonymised identifiers in training, exclude unnecessary personal fields and keep training and scoring within Indian cloud regions, with the purpose recorded in the model card.
Read the full page →We keep a random holdout group that receives the business-as-usual treatment and compare outcomes over one or two cycles. The uplift report shows revenue, cost or retention differences with confidence intervals, not just model accuracy scores. Finance validates the method upfront.
Read the full page →No. Predictive models output numbers, such as forecasts or probabilities, from structured data. Generative AI produces text, images or code. Both can share the same data platform, and predictive scores are often used as inputs to generative AI applications. We build both on shared foundations.
Read the full page →Your data science team or NTSPL under a managed agreement. Monitoring alerts on drift and accuracy, and scheduled reviews decide on retraining. All pipelines are code in your repository, so ownership can move in-house at any time. Handover includes runbooks and training.
Read the full page →For most tabular forecasting, churn and propensity work, managed platforms win: BigQuery ML trains in SQL where the data already sits, while SageMaker AI and Azure Machine Learning provide pipelines, registries and monitoring that a custom stack must rebuild. A custom stack on Kubernetes makes sense only with a large ML team, unusual model types or strict portability needs. Accuracy differences between platforms are small; the bigger factors are how quickly features reach production and how reliably models are monitored.
Read the full page →As a Data Fiduciary you must process personal data only for lawful purposes, apply reasonable security safeguards, honour withdrawal of consent and erase data when the purpose is served. For analytics this means purpose mapping, minimisation, access controls, erasure across copies and breach readiness.
Read the full page →Yes. Deterministic tokens let analysts join, count and segment customers without seeing phone numbers or emails. Only a few processes, such as a dialler or a fulfilment system, can re-identify through the vault, and every such call is logged. Most teams notice no difference in their work.
Read the full page →For a typical lake and warehouse with 100-400 personal columns, a 10-12 week engagement costs INR 30-60 lakh. Running costs for discovery scans and tokenisation are usually modest, a few lakh a month at most. Fees vary with source count and engines.
Read the full page →Yes. CERT-In's 2022 directions require reporting of specified cyber incidents within 6 hours and retention of ICT logs for 180 days in India. We retain query and access logs for analytics platforms accordingly and alert on bulk exports of personal data.
Read the full page →Share aggregates or tokenised records with consent filters applied, or use clean-room services such as AWS Clean Rooms or BigQuery data clean rooms, where both sides analyse overlapping audiences without seeing each other's raw records. Partners get only what their purpose needs.
Read the full page →The DPDP Act requires verifiable parental consent for processing children's data and bars tracking, behavioural monitoring and targeted advertising directed at children. We tag such records at ingestion and exclude them from marketing analytics and model training by default. Controls are tested before go-live.
Read the full page →Tokenisation protects better because raw values never enter downstream zones; even an admin or a leaked export sees only tokens, while deterministic tokens keep joins and counts working. Dynamic masking is a presentation control: raw data is stored, and the engine hides it from roles without permission. It is useful for partial display and for columns that some roles genuinely need. The strongest pattern combines both: tokenise identifiers at ingestion, then use masking for the few attributes that must stay readable to selected roles.
Read the full page →Most clients see 25-45% lower data platform compute spend within a quarter, with larger savings where tables were never partitioned or BI datasets fully refreshed. A typical eight-week tuning sprint costs INR 15-35 lakh and is often paid back within two to three months.
Read the full page →General FinOps works on allocation, commitments and showback across all cloud spend. Analytics FinOps goes inside the data platform: rewriting queries, redesigning tables, changing slot or capacity models and tuning pipelines. Both are needed; they use different skills and data.
Read the full page →Usually the opposite: partitioning, clustering and incremental refreshes make dashboards faster. We measure query latency and refresh times before and after each change, and finance and regulatory workloads keep dedicated capacity so month-end is never at risk. Changes are rolled back if SLOs slip.
Read the full page →Yes. We tag queries and jobs by team, pipeline and product, join telemetry to billing exports and publish cost by business unit. For shared tables, cost is split by usage, which gives finance a defensible basis for showback or chargeback.
Read the full page →Not before tuning. Buying reservations on an untuned workload locks in waste for one to three years. We fix tables and queries first, observe four to six weeks of new utilisation, then size commitments in INR terms for your finance team.
Read the full page →Yes, though compute usually dominates. Long time-travel windows, unexpired lakehouse snapshots, duplicate copies and forgotten staging tables add up. Physical storage billing in BigQuery and lifecycle tiering in object storage often cut storage cost by 30-60%. We clean these up as part of the sprint.
Read the full page →On-demand is cheaper when query volume is light or spiky, because you pay only for bytes scanned and nothing when idle; it is also where unpartitioned tables hurt most. Editions slots become cheaper once steady workloads would scan enough data to cost more than a baseline reservation, typically when analytics runs throughout the business day. Many clients land on a hybrid: a modest baseline reservation with autoscaling for ELT and dashboards, and on-demand for occasional exploratory projects. Decide from 90 days of INFORMATION_SCHEMA data, after partitioning fixes, never before.
Read the full page →Start with Data Strategy & Architecture if more than one business unit or platform is involved, or if KPIs are disputed. Start directly with a build service, such as a warehouse, lakehouse or ingestion, when the target platform is already agreed and one team owns the outcome. Analytics FinOps can run in parallel with anything.
Read the full page →No. We deliver on AWS, Azure and Google Cloud, and on Snowflake and Databricks across them. We usually recommend one primary cloud for data, aligned with where your ERP and identity already live, and share curated data across clouds only where a clear business case exists.
Read the full page →Data platforms are deployed in Indian regions, personal data is tokenised at ingestion, columns carry policy tags for masking, and each dataset records its permitted DPDP purposes. Logs are retained for 180 days to align with CERT-In directions, and RBI, SEBI or IRDAI requirements shape residency and audit evidence.
Read the full page →Assessment and strategy work is usually fixed-price over 6-8 weeks. Build services are priced per release, typically 8-16 weeks each, with an agreed scope of sources, tables or models. Cost-tuning sprints are fixed-fee and often paid back within a quarter. Managed operations are available on a monthly retainer.
Read the full page →Yes. We can operate pipelines, monitor freshness and quality, handle schema changes, manage capacity and run monthly governance and cost reviews under a managed services agreement, or train your team and hand over runbooks, code repositories and dashboards so you run it in-house.
Read the full page →Generative AI applications depend on the same governed data, catalogues and access controls. Our data services provide those foundations, while our Generative AI family builds assistants, conversational analytics and AI data preparation on top, so both share one security and governance model.
Read the full page →Cloud computing is renting computing power, storage, databases and software over the internet and paying only for what you use, instead of buying and running your own servers. NIST SP 800-145 defines it by five traits: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. For an Indian business, that means a server in AWS Mumbai or Azure Central India can be live in minutes and billed in rupees, with no hardware purchase order.
Read the full page →The difference is how much of the stack you manage: IaaS gives you virtual machines, storage and networks; PaaS adds a managed runtime so you only deploy code and data; SaaS is a finished application you simply log into. Amazon EC2 and Azure Virtual Machines are IaaS, Azure App Service and Google App Engine are PaaS, and Microsoft 365 or Zoho are SaaS. Moving up that ladder cuts operations work but also reduces your control over configuration.
Read the full page →Under the shared responsibility model, the cloud provider secures the physical data centres, hardware and hypervisor, while the customer secures everything placed on top: identities, data, OS patches, network rules and application code. The split shifts with the service type, so you patch the guest OS on an EC2 instance but not on Azure SQL Database. Most incidents traced to cloud, such as open storage buckets or leaked access keys, fall on the customer's side of that line.
Read the full page →All three hyperscalers run multiple regions inside India. AWS has Asia Pacific (Mumbai) and Asia Pacific (Hyderabad); Microsoft Azure has Central India (Pune), South India (Chennai), West India (Mumbai) and India South Central (Hyderabad); Google Cloud has Mumbai (asia-south1) and Delhi (asia-south2). Two or more in-country regions per provider let you keep production and disaster recovery copies within India, which helps with RBI, SEBI and IRDAI data localisation expectations.
Read the full page →Cloud is usually cheaper for variable, growing or short-lived workloads, and can cost more for steady, always-on systems left on default pricing. A fair comparison counts the full on-premise cost: hardware refresh every four to five years, data centre space, power, UPS, AMC contracts, licences and staff time. On cloud, bills fall sharply with rightsizing, auto-shutdown of non-production, and commitments like AWS Savings Plans or Azure Reservations, which cut compute rates by up to 72%. NTSPL's cloud assessment builds this TCO before you commit.
Read the full page →A region is a geographic area such as Mumbai, while an availability zone is one or more physically separate data centres within that region with independent power, cooling and networking. AWS Mumbai and Hyderabad each have three availability zones, as do Google Cloud's Mumbai and Delhi regions. Spreading servers across zones protects against a single facility failure; spreading across regions protects against a city-level event and forms the basis of disaster recovery.
Read the full page →Pick the provider that fits your existing estate and skills first, then compare specific services and price. Organisations heavy on Windows Server, SQL Server and Microsoft 365 often gain licence savings on Azure through Azure Hybrid Benefit; teams wanting the broadest service catalogue and partner ecosystem tend toward AWS; data-led companies frequently choose Google Cloud for BigQuery. All three have Indian regions, so residency rarely decides it. A two-week proof of concept on your real workload beats comparing feature lists.
Read the full page →A public cloud shares a provider's infrastructure across many customers, a private cloud is dedicated to one organisation, and a hybrid cloud connects the two so workloads and data can move between them. A bank might keep core banking on a private VMware or OpenStack platform in its own data centre while running mobile apps and analytics on AWS or Azure, joined by Direct Connect or ExpressRoute. Hybrid is common in India where some regulated data or latency-sensitive plant systems must stay on premises.
Read the full page →Multi-cloud means using two or more public cloud providers, such as AWS and Azure, while hybrid cloud means combining public cloud with your own on-premises or private infrastructure. They often overlap: a manufacturer might run SAP on Azure, analytics on Google BigQuery and shop-floor systems in its own plant. Multi-cloud is usually about choosing best-fit services or reducing dependence on one vendor; hybrid is usually about keeping certain systems local for latency, regulation or sunk investment.
Read the full page →Most mid-sized Indian companies are better served by one primary cloud plus targeted use of a second, rather than spreading everything evenly. Every additional provider adds a separate identity model, network design, security tooling, billing relationship and skill set to maintain. Multi-cloud earns its cost when a specific service is clearly better elsewhere, when a regulator or large customer requires provider diversity, or after an acquisition brings in a second estate. Decide per workload, not as a blanket policy.
Read the full page →Azure Arc is the most widely used option, projecting Windows and Linux servers, Kubernetes clusters and SQL Server instances running anywhere, including AWS and Google Cloud, into Azure for policy, patching and Defender monitoring. Google Cloud offers fleet management for GKE and attached clusters on other clouds, and AWS Systems Manager can manage on-premises and other-cloud machines through hybrid activations. Terraform or OpenTofu then provides one provisioning language across all of them.
Read the full page →Multi-cloud usually raises total cost unless it is planned carefully, because of duplicated tooling, split commitment discounts and data transfer charges between providers. Egress from AWS, Azure or Google Cloud to the internet or another cloud is billed per GB, so a chatty application spread across two clouds can run up a large network bill. Keep tightly coupled services on one provider, concentrate commitments to earn bigger discounts, and use private interconnects for heavy cross-cloud traffic.
Read the full page →The usual pattern is to land both clouds on a shared colocation or carrier fabric and link them with AWS Direct Connect on one side and Azure ExpressRoute on the other, avoiding the public internet. Providers such as Equinix and Megaport, as well as Indian carriers, offer this in Mumbai. For lower volumes, a site-to-site IPsec VPN between an AWS Transit Gateway and an Azure VPN Gateway can be running within hours. Google Cloud adds Cross-Cloud Interconnect for direct links to other clouds.
Read the full page →Consistency comes from one identity source, one policy baseline and one place to see findings. Federate all clouds to a single identity provider such as Microsoft Entra ID or Okta, apply the CIS Benchmarks for each provider as the baseline, and send findings to one platform; Microsoft Defender for Cloud can assess AWS and Google Cloud accounts as well as Azure. Central log collection into a SIEM like Microsoft Sentinel or Google Security Operations also simplifies meeting CERT-In's 180-day log retention.
Read the full page →Vendor lock-in is the cost and effort it would take to leave a provider, created by proprietary services, data gravity and contracts. It can't be removed entirely, but it can be managed: containers and Kubernetes for portable compute, open engines such as PostgreSQL where practical, infrastructure as code, and open formats like Apache Iceberg or Parquet for analytics data. Since 2024 AWS, Azure and Google Cloud waive data egress fees for customers moving all their data out, which lowers the exit barrier.
Read the full page →Yes, a hybrid design can help, though localisation can also be met entirely in public cloud by using Indian regions. RBI's 2018 directive requires payment system data to be stored only in India, and the SEBI Cloud Framework expects regulated entities to keep data within Indian borders. Some banks and NBFCs keep core ledgers on premises and use AWS Mumbai, Azure Central India or Google Cloud Mumbai for digital channels, replicating to a second Indian region. The regulated entity stays accountable, so contracts and audit rights matter too.
Read the full page →The 7 Rs are the strategy options for each application: retire, retain, rehost (lift and shift), relocate, replatform, repurchase and refactor. Rehost moves a VM as-is, replatform makes small changes such as switching a self-managed database to Amazon RDS or Azure SQL Managed Instance, repurchase swaps to SaaS, and refactor rebuilds the application as cloud-native. Assigning one R per application during assessment drives the timeline, cost and risk of the whole programme.
Read the full page →Migration cost depends mainly on the number of applications, their complexity and the chosen strategy, so a lift-and-shift of 50 VMs may take a few weeks of effort while refactoring a monolith can take months. Budget for assessment, migration labour, temporary dual running of old and new environments, network links and training. Provider funding often offsets part of it: AWS's Migration Acceleration Program (MAP) and Microsoft's migration offers provide credits or partner funding for qualifying projects. NTSPL scopes this in an assessment first.
Read the full page →Each provider has a low- or no-cost native tool for server moves: AWS Application Migration Service (MGN), free for 90 days per server, Azure Migrate, and Google Cloud's Migrate to Virtual Machines. They replicate disks continuously from VMware, Hyper-V or physical servers, so cutover takes minutes rather than a weekend. For databases, AWS Database Migration Service, Azure Database Migration Service and Google's Database Migration Service handle replication with minimal downtime. Discovery and sizing come first, using Azure Migrate's appliance or Google Migration Center.
Read the full page →Most organisations either move VMware VMs unchanged to a hosted VMware service or convert them to native cloud VMs. Azure VMware Solution and Google Cloud VMware Engine run vSphere on dedicated hosts, allowing a fast move with HCX and no re-platforming, though you should check how VMware licensing is now bundled. Converting to native instances with AWS MGN, Azure Migrate or Migrate to Virtual Machines removes hypervisor cost but requires testing drivers, IP addressing and backups. Many choose a mix based on each application's remaining life.
Read the full page →A small estate of 20 to 50 servers commonly moves in 6 to 12 weeks, while an enterprise with hundreds of applications usually runs a 9 to 18 month programme in waves. The usual phases are assessment and business case, landing zone build, a pilot of two or three low-risk applications, then waves of 10 to 30 servers grouped by dependency. Database size, change freezes around financial year-end in March, and application owner availability are the most common causes of delay.
Read the full page →A landing zone is the pre-configured foundation of accounts, networks, identity, logging and guardrails that every migrated workload lands into. On AWS it is typically built with AWS Control Tower and AWS Organizations, on Azure with the Azure landing zone reference architecture and management groups, and on Google Cloud with the enterprise foundations blueprint. Building it before the first migration avoids retrofitting security and tagging later, and it is where controls such as CERT-In log retention are set once for all workloads.
Read the full page →Regulated entities generally need board-approved outsourcing and cloud policies, risk assessments and, depending on entity type, intimation or reporting to the regulator before moving material workloads. RBI's Master Direction on Outsourcing of IT Services (2023) and the SEBI Cloud Framework set expectations on due diligence, data localisation, audit rights and exit plans, and IRDAI's information and cyber security guidelines apply to insurers. The exact filing obligation varies, so confirm with your compliance team; NTSPL can supply the provider evidence they will ask for.
Read the full page →Downtime is kept low by replicating continuously and cutting over only after testing, rather than copying data in one bulk transfer. Block-level replication in AWS MGN or Azure Migrate keeps target disks in sync, and change data capture in AWS DMS or Azure Database Migration Service keeps databases current, so the final switch is a short window. Run a test cutover first, keep the source system intact as a rollback path, and lower DNS TTL values a few days ahead.
Read the full page →Kubernetes is open-source software that runs and manages containers across a cluster of servers, handling scheduling, scaling, self-healing and rolling updates. Companies adopt it to deploy microservices consistently, pack applications densely onto fewer machines and move workloads between clouds. Managed versions, Amazon EKS, Azure Kubernetes Service (AKS) and Google Kubernetes Engine (GKE), run the control plane for you. It suits teams with many services and some platform engineering skill; a handful of simple apps may be better on a serverless container service.
Read the full page →The cluster management fee is small, about USD 0.10 per hour per cluster (roughly USD 73 a month) on EKS, AKS Standard tier and GKE, while worker nodes make up most of the bill. AKS also has a Free tier without an uptime SLA, and GKE gives a monthly credit that covers one zonal or Autopilot cluster. A modest production setup of three to six mid-sized nodes in Mumbai typically costs a few hundred to a couple of thousand US dollars a month before discounts.
Read the full page →None is universally best; GKE is generally seen as the most automated, AKS integrates most closely with Microsoft Entra ID and Azure DevOps, and EKS fits teams already deep in AWS networking and IAM. GKE Autopilot bills per pod resource and manages nodes for you, EKS Auto Mode now offers similar node management, and AKS Automatic provides an opinionated, preconfigured cluster. All three are CNCF-conformant, so workloads stay portable. Choose the one on the cloud where your data and identity already live.
Read the full page →Use serverless containers when you have a modest number of stateless HTTP or event-driven services and want zero cluster operations; choose Kubernetes when you need fine control, many interdependent services, stateful workloads or custom operators. Google Cloud Run, Azure Container Apps and AWS Fargate with ECS all run a container image and scale it, and Cloud Run and Container Apps can scale to zero. Teams often start serverless and move to EKS, AKS or GKE only when complexity justifies a platform team.
Read the full page →Start with a private API endpoint, cloud identity for access, and the CIS Kubernetes Benchmark as the configuration baseline. Map pods to cloud roles with EKS Pod Identity, AKS Workload Identity or GKE Workload Identity Federation instead of storing keys in secrets. Enforce Pod Security Standards, network policies and image signing, scan images in Amazon ECR, Azure Container Registry or Artifact Registry, and add runtime threat detection through GuardDuty Runtime Monitoring or Defender for Containers. Upgrade Kubernetes versions before support ends.
Read the full page →AWS App Mesh was discontinued on 30 September 2026, so workloads using it need another service-to-service networking option. On Amazon ECS, ECS Service Connect is AWS's recommended replacement; on EKS, Amazon VPC Lattice or an open-source mesh such as Istio, including its sidecar-less ambient mode, or Linkerd are the common choices. Map your current routes, retries, timeouts and mTLS settings first, then migrate service by service with traffic shifting so a misconfiguration can't take everything down at once.
Read the full page →The Gateway API is the newer Kubernetes standard for routing traffic into and within clusters, replacing the older Ingress resource with role-separated Gateway and HTTPRoute objects. The community ingress-nginx controller was retired in March 2026, so clusters still running it no longer receive fixes and should plan a move. Managed options include the GKE Gateway controller, Application Gateway for Containers on AKS and the AWS Gateway API Controller for VPC Lattice, alongside open-source controllers such as Envoy Gateway.
Read the full page →Begin by containerising stateless components: write a Dockerfile, externalise configuration into environment variables, and move sessions and uploaded files off the local disk. Package each service with Helm or Kustomize, deploy through a GitOps tool such as Argo CD or Flux, and keep databases on a managed service like Amazon RDS or Azure Database for PostgreSQL rather than inside the cluster at first. Migrate one service at a time behind the existing load balancer, comparing latency and error rates before shifting all traffic.
Read the full page →Serverless computing lets you run code or containers without provisioning or managing servers, with automatic scaling and billing only while the code runs. AWS Lambda, Azure Functions and Cloud Run functions (formerly Google Cloud Functions) execute code in response to events such as an API call, file upload or queue message. Servers still exist, but the provider patches, scales and meters them in milliseconds. It suits spiky, event-driven or low-traffic workloads where paying for idle virtual machines would be wasteful.
Read the full page →AWS Lambda charges per request and per GB-second of compute, with an always-free monthly allowance of 1 million requests and 400,000 GB-seconds. Beyond that, requests cost USD 0.20 per million plus duration based on allocated memory, and Arm-based Graviton functions are about 20% cheaper per GB-second than x86. Azure Functions Flex Consumption and Cloud Run functions follow a similar request-plus-compute model. Costs climb for functions that are busy around the clock, which may be cheaper on containers.
Read the full page →All three run event-driven functions, but they differ in limits, hosting plans and ecosystem. AWS Lambda caps execution at 15 minutes and integrates tightly with EventBridge, SQS and Step Functions; Azure Functions offers Flex Consumption, Premium and dedicated plans plus Durable Functions for stateful workflows; Cloud Run functions run on Cloud Run's container platform and share its concurrency model and longer request timeouts. Language support overlaps heavily, so the deciding factor is usually where your data and other services already live.
Read the full page →A cold start is the extra delay when a serverless platform must create a new execution environment before running your code, ranging from under 100 milliseconds to several seconds depending on runtime and package size. Mitigations include Lambda SnapStart for Java, Python and .NET, provisioned concurrency on Lambda, always-ready instances on Azure Functions Flex Consumption or Premium, and minimum instances on Cloud Run. Smaller deployment packages and lighter runtimes such as Node.js or Go help too.
Read the full page →Serverless is a poor fit for long-running jobs, steady high-throughput services and workloads needing specialised hardware or very predictable latency. A function busy around the clock usually costs more than an equivalent container or reserved VM, and Lambda's 15-minute limit rules out lengthy batch processing. Applications holding large in-memory state, needing GPUs on a function platform, or tied to a legacy OS also struggle. For these, containers on ECS, AKS or Cloud Run with minimum instances, or plain VMs with commitments, are the better choice.
Read the full page →Event-driven architecture means services communicate by publishing and reacting to events, such as 'order placed', instead of calling each other directly. On AWS this typically uses Amazon EventBridge, SNS and SQS; on Azure, Event Grid, Service Bus and Event Hubs; on Google Cloud, Eventarc and Pub/Sub. Decoupling lets each consumer scale and fail independently and adds replay and retry. The trade-off is harder tracing, so plan correlation IDs and distributed tracing with OpenTelemetry from the beginning.
Read the full page →Yes, serverless services run in a chosen region, so deploying Lambda in Mumbai or Hyderabad, Azure Functions in Central India, or Cloud Run functions in asia-south1 keeps execution and storage in India. Residency can still leak through connected pieces: a global API endpoint, logs exported elsewhere, or a third-party monitoring SaaS hosted abroad. Check every integration, keep CloudWatch, Azure Monitor or Cloud Logging data in Indian regions, and document the design for DPDP Act and sector regulator reviews.
Read the full page →Give each function its own narrowly scoped role, keep secrets in a managed vault and validate every input, because the attack surface moves from servers to permissions and event sources. Use AWS Secrets Manager, Azure Key Vault or Google Secret Manager rather than plain environment variables for credentials. Put public endpoints behind Amazon API Gateway, Azure API Management or Apigee with authentication, throttling and a WAF. Scan dependencies in the CI pipeline, since vulnerable libraries are a frequent weakness in function code.
Read the full page →A managed database service is a database engine run by the cloud provider, which handles installation, patching, backups, replication and failover while you manage schemas, queries and access. Examples include Amazon RDS and Aurora, Azure SQL Database and Azure Database for PostgreSQL flexible server, and Google Cloud SQL and AlloyDB. You give up OS-level control in exchange for far less administration and built-in high availability across availability zones, typically backed by a 99.95% or higher SLA.
Read the full page →Choose a relational SQL database when data is structured, needs joins and must stay strictly consistent, as with finance or inventory; choose NoSQL when you need flexible schemas, massive scale or single-digit millisecond key lookups. Amazon DynamoDB, Azure Cosmos DB and Google Firestore serve high-scale NoSQL workloads, while PostgreSQL on RDS, Azure or AlloyDB covers most transactional systems. Many applications use both, with PostgreSQL for orders and a NoSQL store for sessions, carts or IoT telemetry.
Read the full page →The biggest saving usually comes from reusing existing licences or moving off SQL Server Enterprise where its features aren't needed. Azure Hybrid Benefit lets customers with Software Assurance apply SQL Server licences to Azure SQL Managed Instance or VMs, often cutting the database bill substantially. Many workloads run fine on Standard edition, and some can migrate to PostgreSQL on Amazon Aurora, Azure Database for PostgreSQL or AlloyDB, removing licence fees entirely; AWS DMS Schema Conversion estimates that conversion effort.
Read the full page →Amazon RDS runs standard MySQL, PostgreSQL, MariaDB, Oracle, SQL Server and Db2 engines on instance-attached storage, while Aurora is AWS's re-engineered MySQL- and PostgreSQL-compatible engine with a distributed storage layer keeping six copies across three availability zones. Aurora offers faster failover, up to 15 low-latency read replicas, Aurora Serverless v2 autoscaling and Global Database replication. It usually costs more per hour, so standard RDS can be the better value for small, steady databases.
Read the full page →You can either keep Oracle and move it, or convert to an open-source engine such as PostgreSQL. To keep it, use Amazon RDS for Oracle, Oracle Database@AWS, Oracle Database@Azure or Oracle Database@Google Cloud, or Oracle on VMs, with licensing as the critical check. Converting uses AWS DMS Schema Conversion or Google's Database Migration Service (Oracle to AlloyDB or Cloud SQL for PostgreSQL) to translate schemas and PL/SQL, then change data capture replication for a short cutover window.
Read the full page →Yes, by restricting backups and replicas to Indian regions, for example pairing AWS Mumbai with Hyderabad, Azure Central India with South India, or Google Cloud Mumbai with Delhi. Watch the defaults: some cross-region backup and geo-redundant storage options pick a paired region automatically, so confirm the pair stays in India. Encrypt with customer-managed keys in AWS KMS, Azure Key Vault or Cloud KMS located in the same region to strengthen residency evidence for RBI, SEBI or DPDP audits.
Read the full page →A read replica is a copy of a database that receives continuous updates from the primary and serves read-only queries, offloading reporting and heavy SELECT traffic. Amazon RDS, Aurora, Azure Database for PostgreSQL and MySQL, and Cloud SQL all support them, within a region or across regions. You need one when reads dominate and the primary's CPU is saturated, or to serve users in another geography. Replication is usually asynchronous, so the application must tolerate slightly stale data on the replica.
Read the full page →Use Cloud SQL for standard MySQL, PostgreSQL or SQL Server workloads, AlloyDB when you need higher PostgreSQL performance and fast analytical queries, and Spanner when a single database must scale horizontally with strong consistency. AlloyDB adds a columnar engine and built-in vector search for AI applications. Spanner offers up to 99.999% availability in multi-region configurations and suits large payment or ledger systems. Most mid-sized applications start on Cloud SQL and move up only when they outgrow it.
Read the full page →Object storage holds files as objects with metadata in a flat namespace accessed over HTTP, block storage provides raw disks attached to a server, and file storage offers shared folders over NFS or SMB. In cloud terms, Amazon S3, Azure Blob Storage and Google Cloud Storage are object stores; Amazon EBS, Azure Managed Disks and Google Persistent Disk or Hyperdisk are block; Amazon EFS and FSx, Azure Files and Google Filestore are file services. Object storage is cheapest at scale, while block is fastest for databases.
Read the full page →The largest savings come from moving rarely accessed data to colder tiers automatically and deleting what no one needs. S3 Intelligent-Tiering shifts objects between access tiers without retrieval fees, while lifecycle rules can move data to Glacier Deep Archive, Azure Archive or Google Archive storage at a small fraction of standard price. Also remove orphaned disks and old snapshots, compress logs and check for duplicate copies. Remember that colder tiers charge retrieval fees and impose minimum storage durations, such as 90 days for Coldline.
Read the full page →A content delivery network caches your website's images, scripts and videos on servers close to users, cutting load times and shielding your origin from traffic spikes and attacks. Amazon CloudFront, Azure Front Door and Google Cloud CDN all have edge locations in several Indian cities, so a visitor in Kolkata or Bengaluru isn't waiting on a round trip to a distant origin. If your audience spans India or abroad, or you serve video or downloads, a CDN typically improves speed and reduces origin bandwidth costs.
Read the full page →The three are functionally similar object stores, each designed for eleven nines (99.999999999%) of durability, and differ mainly in tier names, pricing details and integrations. S3 offers the widest range of storage classes, from Express One Zone to Glacier Deep Archive; Azure Blob uses Hot, Cool, Cold and Archive tiers with Data Lake Storage Gen2 hierarchy; Google Cloud Storage uses Standard, Nearline, Coldline and Archive behind one API. Pick the store closest to your compute to avoid egress charges.
Read the full page →Turn on account-wide public access blocking and enforce it with policy, so no individual bucket can be opened by mistake. On AWS that is S3 Block Public Access, enabled by default for new buckets; on Azure, disable anonymous blob access at the storage account level; on Google Cloud, enforce public access prevention through an organisation policy. Then serve public content only through a CDN with origin access control, and use AWS Config, Azure Policy or Security Command Center to flag any drift.
Read the full page →High-performance databases need low-latency block storage with guaranteed IOPS, not general-purpose disks. Common choices are Amazon EBS io2 Block Express or gp3 with provisioned IOPS, Azure Premium SSD v2 or Ultra Disk, and Google Hyperdisk Extreme or Balanced. For SAP HANA, use only storage configurations certified by SAP for that instance type, with Azure NetApp Files or Amazon FSx for NetApp ONTAP for shared file systems. Size for peak log-write throughput, often the bottleneck during month-end closing.
Read the full page →Data you store in a regional service stays in data centres within that region unless you configure replication or use a global service. Choosing S3 in Mumbai, Azure Blob locally or zone-redundant storage in Central India, or a Cloud Storage bucket in asia-south2 keeps objects in India. Geo-redundant Azure storage replicates to the paired region, which for Central India is South India, still in-country. Multi-region buckets and some CDN caches can place copies abroad, so check settings before DPDP and regulator reviews.
Read the full page →For tens of terabytes over a decent link, online transfer tools are usually fastest overall; for hundreds of terabytes, an offline appliance avoids weeks of upload. AWS DataSync, Azure Storage Mover or AzCopy, and Google Storage Transfer Service copy data online with verification and scheduling. A fully used 1 Gbps line moves roughly 10 TB a day. For larger volumes, Azure Data Box and Google Transfer Appliance ship physical devices, though availability in India should be confirmed with the provider first.
Read the full page →A VPC (Virtual Private Cloud on AWS and Google Cloud) or VNet (Virtual Network on Azure) is your own logically isolated private network in the cloud, where you define IP ranges, subnets, route tables and firewall rules. Servers, databases and containers sit inside it and talk privately. One notable difference: AWS VPCs and Azure VNets are regional, while a Google Cloud VPC is global with regional subnets. Plan address ranges that don't overlap with offices or other clouds, as renumbering later is painful.
Read the full page →Use a site-to-site VPN for quick, low-cost encrypted connectivity over the internet, and a dedicated private link for predictable latency, higher bandwidth or regulated traffic. AWS Direct Connect, Azure ExpressRoute and Google Cloud Interconnect provide private circuits, from 50 Mbps through partners to 100 Gbps or more on dedicated ports, at locations in several Indian metros. Many enterprises run both, with the private circuit as primary and a VPN as backup, linked to SD-WAN at branches and plants.
Read the full page →Egress charges arise because providers bill for data leaving a region or their network, while inbound transfer is free. Common culprits are serving files or APIs directly instead of through a CDN, cross-availability-zone chatter between microservices, NAT gateway processing fees, and replication between regions. Fixes include CloudFront, Azure Front Door or Cloud CDN for public content, VPC endpoints such as S3 gateway endpoints to bypass NAT, keeping chatty services in one zone, and compressing API responses.
Read the full page →Private Link lets your network reach cloud services such as storage, databases or a partner's SaaS through a private IP address, so traffic never crosses the public internet. AWS PrivateLink, Azure Private Endpoint and Google Private Service Connect implement it. Combined with disabling the service's public endpoint, it closes a major exposure path and simplifies firewall rules. BFSI security teams commonly mandate it for database and key vault access as part of segregating critical systems under RBI and SEBI expectations.
Read the full page →Hub-and-spoke places shared services, firewalls, DNS and on-premises connections in a central hub network, with each application environment in its own spoke connected only to the hub. AWS builds this with Transit Gateway or Cloud WAN, Azure with a hub VNet or Azure Virtual WAN, and Google Cloud with Network Connectivity Center or Shared VPC. Traffic between spokes passes through central inspection, typically AWS Network Firewall, Azure Firewall or Cloud NGFW, giving one place for egress control and logging.
Read the full page →Yes, CERT-In's April 2022 directions require organisations to enable logs of their ICT systems and keep them for a rolling 180 days within Indian jurisdiction, and network logs fall within that. In cloud, that means retaining VPC Flow Logs on AWS and Google Cloud, Azure Virtual Network flow logs, firewall and load balancer logs, and DNS query logs. Default retention in many services is shorter, so route them to storage or a SIEM in an Indian region with lifecycle rules of at least 180 days.
Read the full page →Put the site behind a CDN and web application firewall and enable the provider's DDoS protection, so attack traffic is absorbed at the edge before reaching servers. AWS Shield Standard is included at no extra cost with CloudFront and Route 53, with Shield Advanced adding 24x7 response support; Azure DDoS Protection covers virtual networks; Google Cloud Armor protects load-balanced services. Add rate limiting and bot rules in AWS WAF, Azure WAF or Cloud Armor, and keep origins reachable only from the CDN.
Read the full page →Plan one enterprise-wide IP scheme before building anything, reserving non-overlapping RFC 1918 ranges for each cloud, region, environment and on-premises site. Overlaps block peering and VPN routing later and are costly to unwind. A common approach allocates a /16 per region per cloud and /20 to /24 subnets per tier, leaving room for Kubernetes pod ranges, which consume addresses quickly with some CNI plugins. Track allocations in Amazon VPC IPAM, Infoblox or NetBox rather than a spreadsheet.
Read the full page →Managed cloud services means an outside provider operates your cloud environment day to day under a contract and SLA, covering monitoring, patching, backups, security, cost control and incident response. You keep ownership of the accounts and data, while the managed service provider (MSP) supplies the people, tooling and runbooks, often around the clock. It suits companies that want cloud without building a full in-house operations team. NTSPL's managed services cover AWS, Azure and Google Cloud from a single support desk.
Read the full page →Pricing typically follows one of three models: a percentage of monthly cloud spend, a fee per managed resource such as servers or databases, or a fixed monthly tier tied to a defined scope. Percentage models are simple but rise with your bill even when effort doesn't; per-resource models track workload more closely. Before comparing quotes, check what is included, such as after-hours response, security monitoring, patching windows and FinOps reviews, and what counts as an extra billable project.
Read the full page →An MSP is usually more economical below a certain scale, while a large, complex estate often justifies an in-house platform team backed by an MSP for 24x7 coverage. Staffing round-the-clock operations needs at least five or six engineers per skill area to cover shifts, leave and attrition, which is costly for a mid-sized firm. A blended model is common in India: internal architects own design and governance, while the provider handles monitoring, patching, backups and first-line incidents.
Read the full page →A useful SLA defines response and resolution times per severity, availability targets for components the provider controls, escalation paths, and service credits when targets are missed. For example, a P1 outage might require a 15-minute response at any hour, while a P3 request is handled within one business day. It should also state patching cadence, backup verification frequency, change approval rules and monthly reporting, and explain how the provider's commitments relate to the cloud vendor's own uptime SLA.
Read the full page →A well-run provider never uses shared passwords or long-lived keys; it reaches your environment through federated, auditable and revocable roles. On Azure this is typically Azure Lighthouse, which delegates scoped permissions to the provider's tenant; on AWS, cross-account IAM roles with external IDs or IAM Identity Center; on Google Cloud, IAM roles granted to the provider's groups. Privileged actions should need just-in-time elevation and MFA, with every action recorded in CloudTrail, Azure Activity Log or Cloud Audit Logs that you own.
Read the full page →It covers continuous watching of availability, performance, capacity, security alerts and backup status, with an engineer acting on alerts at any hour. Typical signals include CPU, memory and disk, application response times and errors, database replication lag, certificate expiry, failed backup jobs, and GuardDuty or Defender alerts. Monitoring is configured in CloudWatch, Azure Monitor or Google Cloud Monitoring, often with Grafana dashboards, and tied to runbooks so routine issues like a full disk are fixed before users notice.
Read the full page →A provider can carry much of the operational work, such as retaining logs for 180 days, running vulnerability scans, monitoring for incidents and preparing evidence, but legal accountability stays with your organisation. CERT-In requires reportable cyber incidents to be notified within 6 hours of noticing them, which needs round-the-clock detection and a clear escalation path. Under the DPDP Act 2023 you remain the data fiduciary even when the MSP acts as a processor, so the contract should define its security duties and breach notification timelines.
Read the full page →Switching is mostly a handover of access, knowledge and tooling rather than a migration of workloads, because the cloud accounts belong to you. Start by collecting architecture diagrams, runbooks, monitoring rules, backup schedules and open tickets from the outgoing provider, then revoke its roles and keys once the new provider is onboarded. Run both in parallel for two to four weeks, verify backups and alerting, and confirm billing arrangements, since a reseller or CSP contract may need a formal transfer.
Read the full page →Cloud Security Posture Management (CSPM) continuously checks your cloud configuration against best practices, while a Cloud-Native Application Protection Platform (CNAPP) combines CSPM with workload protection, container and Kubernetes security, identity risk analysis and code scanning. Native options include AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center; third parties such as Wiz, Prisma Cloud and CrowdStrike offer multi-cloud coverage. CSPM alone catches many of the misconfigurations behind cloud breaches, so it's a sensible first investment.
Read the full page →No cloud region is 'DPDP compliant' by itself, because the DPDP Act 2023 places obligations on your organisation as data fiduciary, not on a data centre. AWS Mumbai, like Azure's and Google Cloud's Indian regions, gives you in-country storage, encryption, access controls and audit logging that help you meet the Act's duties on reasonable security safeguards, breach notification and erasure. The Act permits cross-border transfers except to countries the government restricts, though RBI, SEBI or IRDAI rules may still require local storage.
Read the full page →CERT-In's April 2022 directions require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents to CERT-In within 6 hours of noticing them. Covered incidents include data breaches, ransomware, unauthorised access to systems and attacks on cloud infrastructure. The same directions require ICT logs to be kept for 180 days within India and system clocks synchronised to NIC or NPL time servers. In cloud, detection, escalation and log retention must be designed in from day one.
Read the full page →Storage and databases on AWS, Azure and Google Cloud are encrypted at rest by default, so the real decision is who controls the keys. Provider-managed keys need no effort; customer-managed keys in AWS KMS, Azure Key Vault or Cloud KMS let you control rotation, access policies and revocation; dedicated HSMs such as AWS CloudHSM, Azure Managed HSM or Google Cloud HSM provide FIPS 140-validated control. Banks often choose customer-managed keys held in an Indian region, with every key use logged for audit.
Read the full page →No, the provider's ISO/IEC 27001 certificate covers its own infrastructure and processes, not the systems you build on top. You can reuse evidence for physical and data centre controls through AWS Artifact, the Microsoft Service Trust Portal or Google Cloud's Compliance Reports Manager, but your own information security management system, access reviews, configuration and incident response must be certified separately. ISO/IEC 27001:2022 lists 93 Annex A controls, many of which map neatly to native cloud tools.
Read the full page →Lock down the root or global admin identity, switch on logging everywhere and set baseline guardrails before deploying any workload. In practice: enable MFA on the root user and stop using it, create named admin users through SSO, turn on CloudTrail, Azure Activity Log export or Cloud Audit Logs to a protected store, activate GuardDuty, Defender for Cloud or Security Command Center, block public storage access, and set a billing alert. Then apply that provider's CIS Benchmark, which native tools can score automatically.
Read the full page →Zero trust is a security model in which no user, device or network is trusted by default, and every access request is verified using identity, device health and context, as described in NIST SP 800-207. In cloud, that translates into SSO with MFA, Conditional Access policies in Microsoft Entra ID, private endpoints instead of open network ranges, least-privilege roles, and identity-aware access such as Google Identity-Aware Proxy or AWS Verified Access in place of traditional VPNs. Adoption is incremental, usually starting with identity.
Read the full page →Native security tools are priced by usage, so cost scales with the size of your estate rather than a fixed licence. Amazon GuardDuty charges by the volume of logs and events analysed, Microsoft Defender for Cloud has free foundational CSPM but charges per server, database or storage account on paid plans, and Google Security Command Center is sold in tiers. A small environment might spend tens of dollars a month and a large estate thousands. GuardDuty and Defender plans offer 30-day free trials for estimating real cost.
Read the full page →Identity and Access Management (IAM) is the system that decides who or what can perform which actions on which cloud resources. It covers users, groups and roles for people, plus service identities for applications, combined with policies that grant permissions. AWS IAM, Microsoft Entra ID with Azure RBAC, and Google Cloud IAM are the native services. Because stolen credentials and over-broad permissions sit behind many cloud breaches, IAM design is often the single most important security decision in a cloud programme.
Read the full page →Begin with narrow, job-based roles and use the provider's analysis tools to strip out permissions nobody uses. AWS IAM Access Analyzer generates policies from CloudTrail activity and reports unused access, Google Cloud's IAM role recommendations suggest removing excess roles, and Microsoft Entra access reviews prompt managers to confirm who still needs access. Avoid broad roles like Owner or AdministratorAccess for daily work, scope permissions to specific resource groups or projects, and repeat reviews every quarter.
Read the full page →Just-in-time access means administrators hold no standing privileges and instead request elevated rights for a limited period, with approval and full logging. Microsoft Entra Privileged Identity Management (PIM), part of Entra ID P2, provides this for Azure and Microsoft 365 roles; Google Cloud offers Privileged Access Manager; on AWS, IAM Identity Center can be paired with AWS's open-source temporary elevated access solution. Time-boxing admin rights to a couple of hours sharply limits the damage from a compromised admin account.
Read the full page →Yes, every Azure and Microsoft 365 tenant includes Microsoft Entra ID Free, which covers user and group management, single sign-on to Azure and basic MFA through security defaults. Features such as Conditional Access require Entra ID P1, while Privileged Identity Management and risk-based policies require P2; both are licensed per user per month, and Microsoft 365 E3 and E5 include P1 and P2 respectively. For most companies, P1 is the practical minimum for controlling admin access to Azure.
Read the full page →Applications should use workload identities that receive short-lived tokens automatically, rather than access keys embedded in code or configuration files. On AWS, attach IAM roles to EC2, Lambda or EKS pods; on Azure, use managed identities; on Google Cloud, use attached service accounts and avoid downloading service account keys. For CI/CD pipelines in GitHub Actions or GitLab, and for workloads running in another cloud, OpenID Connect federation and Google's Workload Identity Federation remove long-lived secrets entirely.
Read the full page →Single sign-on (SSO) lets users log in once and reach many applications, while multi-factor authentication (MFA) demands a second proof, such as an authenticator app or security key, at login. They complement each other: SSO cuts password sprawl and MFA makes a stolen password useless on its own. Federating AWS IAM Identity Center and Google Cloud to Microsoft Entra ID, Okta or Google Workspace delivers both. Phishing-resistant MFA using FIDO2 passkeys is now the recommended standard for administrator accounts.
Read the full page →The DPDP Act 2023 requires data fiduciaries to take reasonable security safeguards to prevent personal data breaches, and restricting who can access personal data is central to that. In practice this means role-based access, MFA, logging every read of sensitive tables, masking fields such as Aadhaar or PAN in non-production, and removing access promptly when employees leave. Personal data should also be erased once its purpose is served, so access and retention policies need designing together. Treat this as general guidance, not legal advice.
Read the full page →Separate environments and business units into their own accounts, subscriptions or projects, grouped under a hierarchy where policies are applied once at the top. On AWS, use AWS Organizations with organisational units and Service Control Policies; on Azure, management groups with Azure Policy; on Google Cloud, folders with Organization Policy constraints. A typical split puts production, non-production, shared networking, security and logging in separate containers, which limits the blast radius of mistakes and makes cost allocation straightforward.
Read the full page →Backup keeps point-in-time copies of data so you can restore files, databases or systems after deletion, corruption or ransomware; disaster recovery is the plan and infrastructure for resuming whole business services after a major outage. Backups answer 'can we get the data back?', while DR answers 'how fast can we run again, and where?'. You need both: AWS Backup or Azure Backup for retention and restore, plus AWS Elastic Disaster Recovery or Azure Site Recovery for fast failover.
Read the full page →The 3-2-1 rule says keep three copies of data, on two different types of storage, with one copy offsite, and it still applies in cloud with modern additions. In cloud terms, that means the production copy, a backup in a separate backup vault, and a copy in another region or account. Many teams now follow 3-2-1-1-0: one extra immutable or air-gapped copy and zero errors in restore tests. AWS Backup logically air-gapped vaults and Azure immutable vaults support that extra copy.
Read the full page →Make backups immutable, store them in a separate account or tenant, and restrict who can delete them, because attackers increasingly target backups first. Use AWS Backup Vault Lock in compliance mode or S3 Object Lock, Azure Backup immutable vaults with soft delete and multi-user authorisation, or Google Cloud Backup and DR backup vaults with enforced retention. Alert on deletion attempts and policy changes, and keep backup administrators separate from production admins so one compromised identity can't wipe both.
Read the full page →Cloud backup cost is driven by how much you protect and how much backup storage accumulates, so retention period and data change rate shape the bill. Azure Backup charges a protected-instance fee plus vault storage; AWS Backup charges per GB-month of warm or cold storage, with recovery points moved to the cheaper cold tier kept there for at least 90 days; Google Cloud Backup and DR bills for protected data and storage. Seven-year compliance retention becomes far cheaper when older recovery points move to archive tiers automatically.
Read the full page →Azure Business Continuity Center is Azure's unified console for managing backup and disaster recovery across Azure Backup and Azure Site Recovery, replacing the earlier Backup Center experience. It shows which resources are protected and which aren't, job status, and the security posture of vaults, such as immutability and soft delete, and lets you configure protection across subscriptions and regions in one place. It covers Azure VMs, SQL Server and SAP HANA in VMs, Azure Files, Blob Storage and managed disks.
Read the full page →There is no single Indian retention period for backups; it depends on the data and your sector. The Companies Act generally requires books of account to be kept for eight years, tax and GST laws set their own periods, CERT-In requires ICT logs for 180 days, and RBI, SEBI and IRDAI set record-keeping rules for regulated entities. The DPDP Act pushes the other way, requiring personal data to be erased once its purpose ends. Set retention per data class with your compliance team, then automate it.
Read the full page →Yes, in most cases, because SaaS providers keep the service running but their built-in retention is not a full backup under your control. Microsoft 365 recycle bins and retention policies have limits, and an admin error, malicious deletion or ransomware sync can remove data across mailboxes and OneDrive. Microsoft 365 Backup and third-party tools such as Veeam, Druva or Commvault provide independent point-in-time restores. The same reasoning applies to Google Workspace and Salesforce.
Read the full page →Test restores at least quarterly for critical systems and after any major change, with smaller automated checks weekly, because a backup that has never been restored is only an assumption. AWS Backup restore testing runs scheduled restores and validates them automatically, while Azure Backup and Google Cloud Backup and DR support restoring into isolated test environments. Record the time taken against your RTO, verify application consistency rather than file presence, and keep the evidence for ISO 22301 or regulator audits.
Read the full page →RPO (Recovery Point Objective) is the maximum amount of data you can afford to lose, measured in time, while RTO (Recovery Time Objective) is the maximum time a service can be down before it must be restored. An RPO of 15 minutes means backups or replication must capture changes at least every 15 minutes; an RTO of 4 hours means the system must be running again within 4 hours of an outage. Lower values cost more, so set them per application through an ISO 22301-style business impact analysis.
Read the full page →The four standard cloud DR strategies, in rising cost and falling recovery time, are backup and restore, pilot light, warm standby and multi-site active-active. Backup and restore rebuilds from backups with RTOs of hours; pilot light keeps core data replicated with minimal compute; warm standby runs a scaled-down working copy; and active-active serves traffic from two regions continuously, aiming at near-zero RTO and RPO. AWS's Well-Architected reliability guidance describes all four, and most organisations mix them by application tier.
Read the full page →Yes, each major provider now has at least two Indian regions far enough apart to act as primary and DR: AWS Mumbai and Hyderabad, Azure Central India (Pune) and South India (Chennai), and Google Cloud Mumbai and Delhi. Keeping both inside India supports RBI, SEBI and IRDAI localisation expectations while separating sites against regional floods or grid failures. Confirm that every service you depend on, including managed databases and AI services, is actually offered in the DR region.
Read the full page →Cloud DR is typically much cheaper than a second physical data centre because you mainly pay for replicated storage and run full compute only during drills or a real disaster. With AWS Elastic Disaster Recovery or Azure Site Recovery, you pay a per-server replication fee plus low-cost staging storage, while target servers stay off until needed. A physical DR site needs duplicate hardware, space, power and connectivity all year. Warm standby and active-active designs narrow the gap, since their compute runs continuously.
Read the full page →AWS Elastic Disaster Recovery (DRS) continuously replicates block-level data from source servers, on premises or in another AWS region, into a low-cost staging area in your target region. During a drill or real event it launches recovery instances from the latest state or a chosen point in time, giving RPOs of seconds and RTOs of minutes. Non-disruptive drills can run at any time, and after the incident you fail back to the original site. It supports most common Windows and Linux servers.
Read the full page →Both regulators expect regulated entities to maintain documented business continuity and DR plans, test them regularly and report results to senior management or the board. RBI's directions on IT governance and outsourcing require DR drills and set expectations for recovering critical systems, while SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) and circulars for market infrastructure institutions specify DR sites, periodic live drills and recovery targets. Frequencies differ by entity class, so map your obligations with compliance before designing the plan.
Read the full page →Start with a business impact analysis that ranks applications by the cost of downtime, then set RPO and RTO per tier and choose a recovery strategy to match. Document dependencies such as DNS, Active Directory, licence servers and third-party APIs, which are often forgotten. Write step-by-step runbooks with named owners, automate failover where possible using Azure Site Recovery recovery plans or AWS DRS, and run a drill at least twice a year. ISO 22301 offers a recognised framework for the whole programme.
Read the full page →Azure Backup protects data by keeping restorable recovery points for days to years, while Azure Site Recovery replicates running VMs to another region so you can fail over in minutes. Backup suits recovery from deletion, corruption and ransomware; Site Recovery suits regional outages where downtime must be short. Many organisations use both on critical VMs, for instance replicating Central India production to South India with Site Recovery while also keeping 30 to 90 days of backups. Both are managed through Azure Business Continuity Center.
Read the full page →FinOps is an operating practice that brings finance, engineering and business teams together to manage cloud spending so that every rupee spent produces business value. The FinOps Foundation organises it into three iterative phases: Inform, where costs become visible and allocated; Optimize, where waste is cut and rates improved; and Operate, where governance and continuous improvement are embedded. It's less about a one-off cost cut and more about making cost a routine engineering metric, like performance or uptime.
Read the full page →Organisations that haven't optimised before often find 20-30% savings in the first few months, mostly from removing idle resources, rightsizing and buying commitments. Typical findings include oversized VMs running below 10% CPU, non-production environments left on overnight and at weekends, unattached disks and old snapshots, and on-demand rates on steady workloads. Commitment discounts alone can reduce compute rates by up to 72% on AWS and Azure. Results vary, so measure baseline unit costs before and after.
Read the full page →Reserved Instances commit to a specific instance family and region for one or three years, while Savings Plans commit to an hourly spend amount and apply flexibly across instance types and services. On AWS, Compute Savings Plans give up to 66% off and cover EC2, Fargate and Lambda, whereas EC2 Instance Savings Plans and Reserved Instances reach up to 72% with less flexibility. Azure offers both Reservations and a savings plan for compute, and Google Cloud uses committed use discounts.
Read the full page →Yes, Indian customers can be invoiced in rupees through the providers' Indian entities or partners, and GST at 18% applies to cloud services. AWS invoices Indian accounts through Amazon Web Services India Private Limited, Microsoft bills Azure through its Indian entity or local Cloud Solution Provider partners, and Google Cloud also invoices Indian customers locally. Adding your GSTIN to the billing account lets you claim input tax credit. Buying through a partner like NTSPL can add consolidated INR invoicing and local payment terms.
Read the full page →Allocation relies on a consistent tagging standard, a sensible account structure and an agreed method for shared costs. Apply mandatory tags such as cost-centre, application, environment and owner, enforced through AWS tag policies, Azure Policy or checks in the deployment pipeline, and activate them as cost allocation tags. Separate accounts or subscriptions per business unit give cleaner splits than tags alone. Shared costs like networking or support plans are then distributed by formula, for example in proportion to each team's direct spend.
Read the full page →Each provider includes free native tools that cover most needs: AWS Cost Explorer, Budgets, Cost Optimization Hub and Compute Optimizer; Azure Cost Management and Azure Advisor; and Google Cloud Billing reports, budgets and Recommender. For multi-cloud reporting, the FinOps Open Cost and Usage Specification (FOCUS) defines a common billing format that all three can now export. Third-party platforms add anomaly detection, unit economics and commitment management. Start with budgets and anomaly alerts, which take minutes to set up.
Read the full page →Spot capacity is safe for production workloads that tolerate interruption, but not for single stateful servers such as a primary database. AWS Spot Instances, Azure Spot VMs and Google Spot VMs offer discounts of up to around 90% on spare capacity that can be reclaimed at short notice: two minutes on AWS and 30 seconds on Azure and Google Cloud. Stateless web tiers behind load balancers, Kubernetes worker pools, CI runners and batch jobs work well, especially when mixed with on-demand capacity across several instance types.
Read the full page →Showback reports each team's cloud costs to them without moving money, while chargeback actually bills those costs against the team's budget. Showback is the usual starting point in the FinOps Inform phase, because it builds awareness without disputes over accuracy. Chargeback works once tagging coverage is high, with many teams aiming for over 90% of spend allocated, and shared costs have an agreed split. Indian groups with several business units or subsidiaries often move to chargeback to tie cloud spend to each unit's P&L.
Read the full page →A data lakehouse combines the low-cost open-file storage of a data lake with the transactions, schema management and fast SQL of a data warehouse. Data sits in object storage in open table formats such as Apache Iceberg, Delta Lake or Apache Hudi, and several engines query the same copy. Examples include Databricks on any cloud, Microsoft Fabric with OneLake, Google BigQuery with BigLake Iceberg tables, and Amazon S3 Tables queried by Athena or Redshift. It avoids maintaining separate lake and warehouse copies.
Read the full page →Choose largely by your existing cloud and how your team works: BigQuery is serverless with no clusters to manage, Redshift fits AWS-centric estates with provisioned and serverless modes, Microsoft Fabric bundles warehousing, data engineering and Power BI on one capacity, and Snowflake runs on all three clouds with strong data sharing. Each offers pay-per-use or capacity pricing. Benchmark on your own queries and data volumes, because cost differences depend more on workload pattern than on list price.
Read the full page →BigQuery charges separately for storage and for query compute, either on-demand per TiB scanned or through capacity-based editions billed per slot-hour, and on-demand includes the first 1 TiB of queries each month free. Costs are controlled by partitioning and clustering tables so queries scan less, avoiding SELECT *, setting per-user or project query quotas, and moving steady workloads to editions with autoscaling slots. Long-term storage pricing applies automatically to tables unmodified for 90 days, roughly halving their storage cost.
Read the full page →Migrations usually run in four steps: assess and inventory, convert schemas and SQL, move historical data, then run old and new systems in parallel until reports match. Google's BigQuery Migration Service translates Teradata, Oracle and other SQL dialects; the AWS Schema Conversion Tool and DMS support moves to Redshift; Microsoft provides a migration assistant for bringing SQL-based warehouses into Fabric. Most of the effort sits in ETL jobs and reports, not tables, so inventory those first and retire unused reports instead of migrating them.
Read the full page →ETL transforms data before loading it into the warehouse, while ELT loads raw data first and transforms it inside the warehouse using its compute. Cloud warehouses made ELT the norm because BigQuery, Redshift, Snowflake and Fabric scale cheaply enough to transform in place, often with dbt managing the SQL models. ETL still fits when data must be masked or reduced before landing, for instance stripping personal data to limit DPDP exposure. AWS Glue, Azure Data Factory and Google Dataflow support either pattern.
Read the full page →Collect only what the stated purpose needs, record the consent or legitimate use behind each dataset, and de-identify personal data before it reaches broad analytics users. Techniques include tokenising phone numbers and PAN, masking or hashing identifiers, and applying column- and row-level security in BigQuery, Redshift, Fabric or AWS Lake Formation. Track data lineage so a person's records can be located and erased when consent is withdrawn. Keep analytics stores in Indian regions where sector regulations require it.
Read the full page →Streaming analytics processes events within seconds of their creation, rather than in nightly batches, for uses such as fraud detection, IoT monitoring and live dashboards. Ingestion services include Amazon Kinesis Data Streams and Amazon MSK for Kafka, Azure Event Hubs, and Google Pub/Sub. Processing runs on Amazon Managed Service for Apache Flink, Microsoft Fabric Real-Time Intelligence or Azure Stream Analytics, and Google Dataflow. Results land in a warehouse or time-series store for querying. Design for late and duplicate events from the start.
Read the full page →Start with one business question that has a clear owner, such as daily sales by region or plant downtime, and build a small pipeline end to end before designing an enterprise platform. Land source data from ERP, CRM or Tally into a cloud warehouse, model it with simple SQL, and publish a dashboard in Power BI, Looker Studio or Amazon Quick. Prove value within six to eight weeks, then add data quality checks, governance and more sources. NTSPL's data analytics team runs exactly this kind of pilot.
Read the full page →DevOps unites development and operations to ship software faster through automation, CI/CD and shared ownership, and DevSecOps builds security into every stage of that pipeline instead of checking at the end. In practice, DevSecOps means static analysis (SAST), dependency scanning (SCA), secret detection, container image scanning and infrastructure-as-code checks running automatically on each commit, with dynamic testing (DAST) before release. Developers fix issues while the code is fresh, which is far cheaper than after deployment.
Read the full page →DORA metrics are the software delivery measures developed by Google's DevOps Research and Assessment programme: deployment frequency, lead time for changes, change failure rate and failed deployment recovery time, recently joined by rework rate. Top performers in DORA's research deploy on demand, often several times a day, and recover from failed changes in under an hour. Tracking these numbers before and after a CI/CD or platform change shows whether delivery genuinely improved, instead of relying on anecdote.
Read the full page →Terraform, or its open-source fork OpenTofu, is the usual choice for multi-cloud estates because one language covers AWS, Azure, Google Cloud and many SaaS providers. AWS CloudFormation and the AWS CDK are native to AWS with no state file to manage, and Bicep is Azure's native language with day-one support for new resource types. Google Cloud's Infrastructure Manager runs Terraform as a managed service. Terraform moved to the Business Source License in 2023, which mainly affects vendors building competing products.
Read the full page →A typical pipeline triggers on each pull request, builds and tests the code, scans code and dependencies, builds a container image, pushes it to a registry, and deploys automatically to staging and, after approval, to production. GitHub Actions, GitLab CI and Azure Pipelines are the most common orchestrators, with AWS CodePipeline and CodeBuild, or Google Cloud Build and Cloud Deploy, as native alternatives. Authenticate pipelines to the cloud with OIDC federation rather than stored keys, and use blue-green or canary releases to limit risk.
Read the full page →A Software Bill of Materials (SBOM) is a machine-readable inventory of every component and library in an application, usually in SPDX or CycloneDX format, used to find affected systems quickly when a flaw like Log4Shell appears. In India, CERT-In published technical guidelines on SBOMs in 2024, and SEBI's Cybersecurity and Cyber Resilience Framework expects regulated entities to obtain SBOMs for core and critical systems. Tools such as Syft, Trivy and GitHub's dependency graph generate SBOMs automatically in CI pipelines.
Read the full page →Block secrets before they're committed, scan continuously for any that slip through, and store real credentials only in a managed vault. Pre-commit hooks and push protection in GitHub or GitLab secret detection catch API keys and passwords, and tools like Gitleaks scan repository history. Applications then fetch values at runtime from AWS Secrets Manager, Azure Key Vault or Google Secret Manager. If a secret is exposed, rotate it immediately; deleting the commit doesn't help because clones and forks keep a copy.
Read the full page →A small team can run a capable pipeline at low cost, since most tools have free tiers and charge mainly for build minutes and advanced security features. GitHub and GitLab free plans include a monthly allowance of CI minutes, Azure DevOps includes five free Basic users, and AWS CodeBuild and Google Cloud Build bill per build minute with small free allowances. Paid security add-ons from GitHub are priced per active committer. Self-hosted runners on Spot instances cut minute costs for heavy builds.
Read the full page →Platform engineering is building a self-service internal platform that gives developers paved paths, such as approved templates, pipelines and environments, so each team doesn't assemble its own toolchain. An internal developer platform often uses Backstage as a portal, Terraform modules for infrastructure, and Kubernetes or a serverless container service as the runtime. It pays off once several product teams are repeating the same setup work; a company with one or two teams usually gains more from simply standardising its CI/CD templates.
Read the full page →Generative AI refers to models that create new text, code, images or audio from a prompt, based on patterns learned from large datasets. Common business uses include drafting emails and reports, summarising documents and calls, answering employee or customer questions from company knowledge, generating code, and extracting data from invoices. Enterprises usually reach models such as OpenAI GPT, Anthropic Claude, Google Gemini or Meta Llama through Amazon Bedrock, Microsoft Foundry or Gemini Enterprise Agent Platform rather than consumer apps.
Read the full page →All three give enterprise access to multiple foundation models with security controls, so the choice usually follows your primary cloud and preferred models. Amazon Bedrock offers Anthropic Claude, Amazon Nova, Meta Llama, Mistral and others; Microsoft Foundry is the main route to OpenAI's GPT models on Azure, alongside a large model catalogue; Gemini Enterprise Agent Platform, formerly Vertex AI, hosts Google's Gemini models plus partner models such as Claude. Each bundles agent-building, evaluation and guardrail tooling.
Read the full page →Yes, but residency depends on the specific model and deployment option, so check it per use case. Amazon Bedrock runs in the Mumbai region, though some models are served through cross-region inference that can route requests outside India; Microsoft Foundry offers regional deployments in Indian regions for selected models; and Google Cloud has announced in-country processing for some Gemini models. Where strict localisation applies, open-weight models such as Llama or Mistral hosted on your own Indian-region GPUs give full control.
Read the full page →Most generative AI services charge per token processed, with separate rates for input and output, so cost depends on prompt length, response length, model size and volume. Output tokens typically cost several times more than input tokens, and the largest models can cost many times more per token than small ones. Savings come from routing simple tasks to smaller models, prompt caching on Bedrock, Foundry and Gemini, discounted batch inference, and trimming retrieved context. Provisioned throughput suits predictable high volumes.
Read the full page →The main risks are data leakage, prompt injection, over-permissive AI integrations and inaccurate outputs being trusted without review. Employees may paste confidential data into consumer chatbots; attackers may hide instructions in documents or web pages that an AI then follows; and an assistant wired into email or databases can expose information the user shouldn't see. The OWASP Top 10 for LLM Applications catalogues these. Mitigations include approved enterprise tools, Bedrock Guardrails or Azure AI Content Safety, least-privilege connectors and prompt logging.
Read the full page →Pick two or three high-volume, low-risk tasks where an AI draft saves real time, such as summarising support tickets or answering HR policy questions, and run a time-boxed pilot with measurable targets. Set a usage policy first, provide an approved enterprise tool so staff stop using personal accounts, and involve legal and security early. Measure time saved, accuracy and adoption over four to eight weeks before scaling. NTSPL runs these pilots on Bedrock, Microsoft Foundry or Gemini Enterprise Agent Platform.
Read the full page →Start with prompt engineering, add retrieval-augmented generation (RAG) when the model needs your company's current facts, and consider fine-tuning only when you need a consistent style, format or narrow skill that prompts can't achieve. RAG keeps knowledge up to date without retraining and can cite sources; fine-tuning bakes behaviour into the model but must be repeated as data changes. Bedrock, Microsoft Foundry and Gemini Enterprise Agent Platform support all three, and most enterprise assistants succeed with RAG alone.
Read the full page →Yes, leading models handle Hindi and major Indian languages such as Bengali, Tamil, Telugu, Marathi and Gujarati reasonably well, though quality is usually below English and varies by language. Gemini, GPT and Claude models support many Indic scripts, while India-focused efforts such as Sarvam AI's models and the government's Bhashini platform target Indian languages and speech specifically. Test with real customer queries, including Hinglish and transliterated text, and measure accuracy per language before launching a multilingual assistant.
Read the full page →Retrieval-augmented generation is a technique where an AI system first searches your own documents or data for relevant passages and then hands them to a language model to write an answer grounded in that content. It lets a model answer from current, private knowledge, such as policies, manuals or contracts, without retraining, and lets it cite sources. A RAG pipeline has three parts: ingesting and chunking documents, indexing them for search, and composing a prompt with the retrieved passages at query time.
Read the full page →A vector database stores numerical embeddings of text or images and finds the items most semantically similar to a query, which is the core of most RAG search. You often don't need a separate product: Azure AI Search, Agent Search on Google Cloud, Amazon OpenSearch Service, Amazon S3 Vectors, PostgreSQL with pgvector, AlloyDB and Azure Cosmos DB all support vector search. Dedicated databases such as Pinecone or Milvus make sense at very large scale or with specialised filtering needs.
Read the full page →Each cloud has a managed path that handles ingestion, embedding and retrieval: Amazon Bedrock Knowledge Bases on AWS, Azure AI Search with Microsoft Foundry on Azure, and Agent Search (formerly Vertex AI Search) or the RAG engine within Gemini Enterprise Agent Platform on Google Cloud. They connect to sources such as S3, SharePoint, Google Drive or Confluence, chunk and index content, and return passages with citations. Managed services shorten build time, while custom pipelines give finer control over chunking and ranking.
Read the full page →AI enterprise search lets employees find information across email, file shares, intranet, ticketing and business systems in one query, ranking results by meaning rather than keywords and often adding a generated summary. Products include Microsoft 365 Copilot Search, Gemini Enterprise and Agent Search from Google, Amazon Quick on AWS, and Glean as an independent option. The hardest part is permissions: results must respect each user's existing access in SharePoint, Google Drive or Confluence, or the tool will surface confidential files.
Read the full page →Most poor RAG answers come from retrieval, not the model: the right passage was never found or never indexed. Common causes are chunks that split tables or lists, scanned PDFs without OCR, missing metadata filters for version or department, and pure vector search that misses exact terms like product codes. Fixes include hybrid keyword-plus-vector search, a reranking step, chunking by document structure, and evaluating retrieval separately using a test set of real questions with their expected source documents.
Read the full page →Enforce document-level permissions at retrieval time, so the index only returns content the asking user can already open in the source system. Managed connectors in Amazon Quick and Agent Search, and Azure AI Search with security trimming, can carry access control lists from SharePoint, Google Drive or Confluence into the index. Keep those ACLs synchronised as permissions change, never rely on the prompt to hide content, and test with accounts from different departments before launch. Log queries and retrieved sources for audit.
Read the full page →Running costs come from four parts: the search or vector index, embedding documents, model tokens per query, and application hosting. Index services such as Azure AI Search or Amazon OpenSearch carry a monthly cost by tier or capacity, embedding is a one-time cost plus updates, and per-query token costs depend on how many passages you send to the model. A department-scale assistant over tens of thousands of documents often runs from a few hundred to low thousands of US dollars a month; build effort usually exceeds that in year one.
Read the full page →Yes, provided the embedding model, index and language model all support the languages involved and are deployed in Indian regions. Multilingual embedding models from Cohere, Google and OpenAI handle Hindi and several other Indian languages, though retrieval accuracy should be tested language by language. Host the index in AWS Mumbai, Azure Central India or Google Cloud Mumbai and confirm the model endpoint processes data in India, which matters for government, BFSI and healthcare content under localisation rules. Scanned documents need Indic-capable OCR first.
Read the full page →An AI agent is software that uses a language model to plan steps and take actions with tools, such as querying a database, updating a CRM record or raising a ticket, to reach a goal, whereas a chatbot mainly answers questions in conversation. Agents decide which tool to call next, observe the result and continue, often over several steps. That autonomy makes them useful for workflows like invoice reconciliation or IT triage, and also means they need tighter permissions and human approval for consequential actions.
Read the full page →Amazon Bedrock AgentCore provides runtime, memory, identity, gateway and observability services for agents built with any framework; Microsoft Foundry Agent Service hosts agents on Azure with connections to Microsoft 365 and Azure services; and Gemini Enterprise Agent Platform on Google Cloud includes the Agent Development Kit and a managed runtime for deploying agents. Open-source frameworks such as LangGraph, CrewAI and Strands Agents run on all three. Choose based on where your data, identity and business systems already sit.
Read the full page →The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in 2024, that defines how AI applications connect to external tools and data sources through a common interface. Instead of writing a custom integration for each model, you expose a system such as a database, ticketing tool or file store as an MCP server, and any MCP-compatible agent can use it. AWS, Microsoft and Google support MCP in their agent platforms, and Google's Agent2Agent (A2A) protocol complements it for agent-to-agent communication.
Read the full page →Limit what an agent can touch, require human approval for consequential actions, and record everything it does. Give each agent its own identity with least-privilege access instead of borrowing a user's admin rights, restrict tools to the specific operations needed, and set spending or volume limits. Require a person to confirm payments, deletions or external emails. Treat content the agent reads, such as emails or web pages, as untrusted input that may carry prompt injection, and log every tool call for audit.
Read the full page →Agents usually cost more per task than a single chatbot answer because each task involves several model calls, tool invocations and a growing context. A workflow that plans, calls four tools and summarises might consume five to ten times the tokens of one question. Platform charges add runtime, memory and gateway fees on services like Bedrock AgentCore. Control costs by using smaller models for routine steps, capping iterations, caching prompts, and measuring cost per completed task against the manual effort it replaces.
Read the full page →Good candidates are repetitive, multi-step processes with clear rules, digital inputs and an easy way to check the result, where a mistake is recoverable. Examples include triaging IT or customer support tickets, matching purchase orders with invoices and GRNs, drafting first versions of RFP responses, watching cloud costs and opening tickets for anomalies, and collecting KYC documents. Avoid starting with processes that need nuanced judgement, have poor data or carry high financial or legal risk; begin with agents that recommend, then let them act.
Read the full page →Indian enterprises should treat agents as digital workers subject to the same data protection, audit and accountability rules as staff. If an agent processes personal data, DPDP Act duties on purpose limitation, security safeguards and breach notification apply, and regulated entities must also meet RBI, SEBI or IRDAI outsourcing and audit expectations. MeitY's AI governance guidance emphasises accountability and human oversight rather than prescriptive rules. Keep an inventory of agents with their owners, data access and approval thresholds.
Read the full page →A multi-agent system splits a complex job across several specialised agents, such as a researcher, a planner and a reviewer, coordinated by an orchestrator or by agents handing tasks to each other. Frameworks like LangGraph, CrewAI, Microsoft Agent Framework and Google's Agent Development Kit support this pattern, and the A2A protocol lets agents built on different platforms cooperate. It can improve quality on long tasks but adds latency, cost and debugging difficulty, so a single well-designed agent is often the better first step.
Read the full page →Intelligent document processing uses OCR, machine learning and language models to read documents such as invoices, forms, contracts and ID cards, extract the data into structured fields, and route it into business systems. Unlike basic OCR, it understands layout, tables, key-value pairs and context, and can classify document types. Cloud services include Amazon Textract and Bedrock Data Automation, Azure AI Document Intelligence in Microsoft Foundry, and Google Document AI. Typical gains are faster processing and fewer manual entry errors.
Read the full page →Each performs well on clean printed forms, so the choice depends on document types, languages and your cloud. Amazon Textract is strong on forms and tables and offers AnalyzeExpense and AnalyzeID APIs, but supports only a few European languages besides English; Azure AI Document Intelligence offers prebuilt invoice, receipt and ID models plus custom models trained from a handful of samples; Google Document AI has specialised processors and broad OCR language coverage. For Indian scripts, test Azure and Google first.
Read the full page →Yes, general invoice and ID models extract most fields from Indian GST invoices, PAN cards and similar documents, though accuracy improves with custom training on your formats. Fields like GSTIN, HSN or SAC codes and the CGST, SGST and IGST split often need a custom extraction model or a language model prompt to capture reliably. For Aadhaar, UIDAI rules require masking the first eight digits on stored copies and restrict storage of full numbers, so build masking into the pipeline before data reaches any archive.
Read the full page →Document AI services charge per page processed, with prices rising from basic OCR to prebuilt models and custom extraction models. Plain text reading is typically the cheapest tier, while invoice, form or custom models cost noticeably more per page, and volume discounts apply at higher monthly volumes on all three clouds. Using a large language model for extraction adds token costs instead. Classify documents first and send each one only to the model it needs, rather than running every page through the most expensive processor.
Read the full page →Accuracy on clean, typed documents is often above 95% per field but drops on poor scans, handwriting, stamps and unusual layouts, so a review step is essential. Each service returns a confidence score per field; set thresholds so low-confidence values go to a human reviewer, for example through a review queue built on Step Functions or the platform's own human-review tooling. Add business rule checks such as totals matching line items and GSTIN format validation. Track accuracy over time and retrain custom models on corrected samples.
Read the full page →Start with one high-volume document type, usually vendor invoices, collect a few hundred real samples across your main suppliers, and measure current manual time and error rates. Pilot a prebuilt invoice model, add a custom model for fields that fail, validate against purchase orders and vendor masters, and push approved data into SAP, Oracle or Tally. A working pilot typically takes four to eight weeks, after which you can extend to receipts, delivery notes or contracts.
Read the full page →Use traditional document AI for high-volume, standardised forms where cost per page and consistent output matter, and multimodal language models for varied, unstructured documents where understanding context matters more. Models like Gemini, Claude and GPT can read scanned pages directly and extract fields from contracts or letters with a prompt rather than training. Many production pipelines combine both: OCR and layout extraction first, then a language model to interpret clauses, normalise values or handle exceptions, an approach Bedrock Data Automation packages.
Read the full page →Keep documents in your own cloud account and an Indian region, encrypt them, and make sure the AI service doesn't retain or reuse your content. Azure AI Document Intelligence and Google Document AI don't use customer documents to train their models; for Amazon Textract, apply an AWS Organizations AI services opt-out policy so content isn't stored for service improvement. Add private endpoints, customer-managed keys, automatic deletion of processed files, and redaction of Aadhaar or bank details before documents reach downstream systems.
Read the full page →An industry cloud is a set of cloud services, data models, compliance controls and partner solutions packaged for a specific sector such as banking, healthcare, manufacturing or retail. Instead of assembling generic infrastructure, organisations start from sector-specific capabilities, for example healthcare data APIs that speak FHIR or manufacturing platforms for shop-floor telemetry. In practice it combines a hyperscaler's base services with industry partners and reference architectures, and in India it must also reflect regulators and frameworks such as RBI, SEBI, IRDAI and ABDM.
Read the full page →Banks and NBFCs must follow RBI's directions on IT outsourcing, IT governance and cyber security, which call for board-approved policies, due diligence on providers, localisation of payment data, audit and inspection rights, incident reporting and documented exit strategies. RBI's Master Direction on Outsourcing of IT Services (2023) explicitly covers cloud. Practical controls include Indian-region hosting, customer-managed encryption keys, a security operations centre and DR in a second Indian region. Requirements vary by entity type, so map them with your compliance officer.
Read the full page →Manufacturers use cloud to collect machine and sensor data, analyse it for downtime and quality issues, and connect plant systems with ERP such as SAP. Typical services include AWS IoT SiteWise and IoT Greengrass, Azure IoT Operations with Azure Arc, and Google Cloud's Manufacturing Data Engine with partners, since Google retired IoT Core in 2023. Edge gateways process data at the plant to cope with patchy connectivity, while cloud handles OEE dashboards, predictive maintenance models and multi-plant reporting, the Industry 4.0 stack NTSPL builds.
Read the full page →The Ayushman Bharat Digital Mission (ABDM) is India's national digital health framework, providing ABHA health IDs, registries for facilities and professionals, and consent-based exchange of health records between hospitals, labs and apps. Software integrating with ABDM must follow its standards, including FHIR-based data exchange and consent rules. In cloud, that points to hosting in India, encryption, audit logs and APIs aligned with ABDM specifications, with services like Azure Health Data Services or Google Cloud Healthcare API supporting FHIR.
Read the full page →The deciding factors are MeitY empanelment of the specific cloud offering, the department's procurement route, typically GeM, and data classification, more than the brand. AWS, Azure and Google Cloud, along with NIC's MeghRaj and other MeitY-empanelled Indian providers, can be used where empanelment covers the required service model. Projects handling sensitive government data may require a government community cloud or on-premises deployment. Check the latest MeitY empanelment list and the tender's localisation and audit clauses before shortlisting.
Read the full page →Scale out automatically for the peak and pay for extra capacity only during the sale window, instead of sizing servers all year for Diwali traffic. Use auto scaling groups, Kubernetes autoscalers or serverless containers, put static content and product images on a CDN, and add read replicas or caching with Amazon ElastiCache, Azure Managed Redis or Memorystore. Load test weeks ahead, request quota increases early, and buy commitments only for baseline load, using on-demand or Spot capacity for the spike.
Read the full page →SAP moves to cloud either as a lift-and-shift of the existing ECC or S/4HANA system onto certified cloud infrastructure, or as a conversion to S/4HANA, often under SAP's RISE with SAP offering. AWS, Azure and Google Cloud all run SAP-certified HANA infrastructure in Indian regions. With mainstream maintenance for SAP ECC 6.0 ending in 2027, many Indian companies combine the cloud move with the S/4HANA conversion. Plan sizing, HANA high availability, backups such as AWS Backup or Azure Backup for SAP HANA, and a rehearsed cutover.
Read the full page →Global hyperscalers offer far broader services, managed AI and global reach, while Indian providers can offer simpler pricing, local support and, in some cases, government-specific empanelment or sovereign positioning. With AWS, Azure and Google Cloud each operating multiple Indian regions, residency alone rarely forces the choice. Indian providers such as Yotta, CtrlS, Sify and Tata Communications are common for colocation, private cloud and GPU capacity, including under the IndiaAI Mission. Many enterprises combine a hyperscaler for applications with a local provider for colocation.
Read the full page →Monitoring tells you when known metrics cross thresholds, while observability lets you investigate unknown problems by correlating metrics, logs and traces to understand why a system behaves as it does. Native tools include Amazon CloudWatch and AWS X-Ray, Azure Monitor with Application Insights, and Google Cloud Observability. OpenTelemetry has become the standard way to instrument applications once and send telemetry to any backend, including the managed Prometheus services on all three clouds and managed Grafana on AWS and Azure.
Read the full page →A Service Level Indicator (SLI) is a measured signal of user experience, such as the percentage of requests served under 300 milliseconds; a Service Level Objective (SLO) is its target, such as 99.9% over 30 days; and the error budget is the allowed shortfall, about 43 minutes of downtime a month at 99.9%. Teams spend the budget on releases and experiments, and slow down changes when it runs out. Google Cloud Monitoring, Azure Monitor and CloudWatch Application Signals all support SLO tracking.
Read the full page →Use the provider's patch service to scan servers, apply updates in scheduled maintenance windows and report compliance, instead of patching by hand. AWS Systems Manager Patch Manager, Azure Update Manager and Google Cloud VM Manager OS patch management handle Windows and Linux, including on-premises machines through hybrid agents or Azure Arc. Patch non-production first, wait a few days, then production in rolling batches behind load balancers. For containers, rebuild images regularly from patched base images rather than patching running containers.
Read the full page →Send audit, system, network and application logs from every account and region to a central store in India with at least 180 days of retention, because several native defaults are shorter. AWS CloudTrail event history covers only 90 days, so create an organisation trail to S3; the Azure Activity Log is kept 90 days unless exported to Log Analytics or storage; Google Cloud's _Default logging bucket keeps 30 days unless you change it. Move older logs to archive tiers and protect them with immutability.
Read the full page →Logging costs grow quietly, so control them by ingesting only useful data, routing verbose logs to cheaper tiers and keeping hot retention short. Drop debug logs in production, sample high-volume traces, and filter health-check noise before ingestion. Use CloudWatch Logs Infrequent Access, Azure Monitor Basic or Auxiliary logs, and Google Cloud log exclusion filters or routing to Cloud Storage for logs kept only for compliance. Review the top ten log sources by volume every month, since a few chatty services usually dominate the bill.
Read the full page →A runbook is a step-by-step procedure for handling a specific operational event, such as a disk filling up, a failed deployment or a database failover, written so any on-call engineer can follow it. It should state the triggering alert, impact, diagnostic checks, remediation commands, escalation contacts and rollback steps. The best runbooks are automated with AWS Systems Manager Automation, Azure Automation or Cloud Run jobs and linked directly from the alert, cutting response time and human error at 3 a.m.
Read the full page →AIOps applies machine learning and, increasingly, generative AI to operations data to detect anomalies, group related alerts, suggest root causes and draft incident summaries. Examples include CloudWatch anomaly detection and CloudWatch investigations, Azure Monitor's AI-assisted investigation features, and Gemini Cloud Assist on Google Cloud. It's most useful in large estates suffering alert fatigue, where correlating hundreds of alerts into a few incidents saves real time. It still depends on good telemetry, tagging and service ownership, because AI can't fix missing data.
Read the full page →Follow a defined incident process: declare the incident, assign an incident commander, communicate on a fixed schedule, and restore service before hunting for root cause. Check the provider's status pages, AWS Health Dashboard, Azure Service Health or Google Cloud Service Health, to see whether the fault is theirs, and fail over to another zone or region if your design allows. Afterwards, hold a blameless post-incident review and track the fixes. If it is a cyber incident covered by CERT-In rules, the 6-hour reporting clock applies too.
Read the full page →