We’re here to help.

Yes. Many engagements use cloud as the recovery site for on-premises VMware, Hyper-V or physical servers, replicating with AWS Elastic Disaster Recovery, Azure Site Recovery or Google Backup and DR Service, while production remains in the customer’s data centre.

Tier 1 systems should see at least one full failover drill a year and a component-level test each quarter; many regulated entities test every six months. Tabletop exercises with business owners should run at least twice a year, because people and contact lists change faster than infrastructure.

Only if at least one copy is immutable and isolated from production credentials. Attackers routinely delete backup catalogues and snapshots before encrypting. NTSPL designs a locked or logically air-gapped copy, a separate recovery identity and a clean-room restore process so recovery does not reintroduce the infection.

Data localisation rules differ by sector. RBI requires payment system data to be stored in India, and CERT-In requires logs to be maintained within Indian jurisdiction for 180 days. With two AWS regions, four Azure regions and two Google Cloud regions in India, in-country DR is available on every major provider.

For most mid-size Indian estates, a pilot light or warm standby design on cloud costs 15-35% of what a dedicated secondary data centre with idle hardware and colocation fees would. The saving comes from paying for compute only during drills and real events, while storage and replication run continuously.

Start with a backup assessment, then a DR assessment. The first tells you whether your existing copies can actually be restored and how long that takes; the second decides which systems need more than backup. Skipping the audit risks designing DR on top of backups that are incomplete or untested.

Certification is worth pursuing when customers, regulators or tenders demand it, typically for IT services firms, payment processors, data centres and outsourcing providers. For most other Indian enterprises, aligning BCP and DR to ISO 22301 practices without formal certification delivers most of the resilience benefit at lower cost: a BIA, recovery strategies, documented plans, exercises and management review. NTSPL structures the alignment so that certification later is a documentation and audit step, not a redesign. If a key customer has asked for certification in their vendor assessment, start the formal route now.

Yes. The register, BIA, recovery strategies, exercise reports and management review records map to ISO 22301 clauses. NTSPL can prepare evidence and support readiness reviews, while certification itself is performed by an accredited certification body. Gaps found are fixed before the external audit.

Jointly, the business continuity or risk function and IT. BCM owns processes, tolerances and workarounds; IT owns systems, tiers and achieved RTO. A named coordinator keeps the register current and reports to the risk committee. Changes to either side trigger a register review.

The BCP covers premises and people; alignment ensures IT supports them, for example remote access capacity, cloud-hosted contact centre and systems reachable from alternate sites. Joint exercises often use a combined scenario, such as monsoon flooding of an office with simultaneous network failure.

No. Providers are responsible for the resilience of their infrastructure, but your recovery, workarounds, communications and regulatory duties remain yours. Provider audit reports support your supplier assessment; your own region design, backups and drills provide your recovery capability. This is the shared responsibility model applied to continuity.

Cyber incidents must be reported to CERT-In within 6 hours. Personal data breaches must be notified to the Data Protection Board and affected individuals under the DPDP Act 2023. Regulated entities have additional duties to RBI, SEBI, IRDAI, exchanges or depositories. NTSPL builds a matrix specific to your licences.

Typically nine weeks and 30-45 consultant days for 15-40 critical processes, depending on how current the existing BCP and BIA are. Most of the business-side effort is in workaround validation and the joint exercise. NTSPL quotes a fixed fee once the BCP and DR documents have been reviewed.

Both, for different failures. A tabletop tests people: whether leaders know who declares, how the business operates during recovery, how customers and regulators are informed, and how decisions are made under uncertainty. It is cheap and should run twice a year. A live failover tests technology and integrations: whether systems actually start, data is current, partners accept traffic and users can transact. It is expensive and risky, so it runs once or twice a year after isolated tests pass. Organisations that only do tabletops overestimate technical readiness; those that only do failovers often stall on decisions.

You cannot fail them over, but you can test your degraded mode: queuing transactions, switching to a backup provider or manual workarounds. Ask providers for their own DR test reports and include their contractual RTO in your drill assumptions. Their gaps go on the findings list.

Yes, as its own drill. Test restoring from locked or isolated backups into a clean room, choosing a recovery point before a simulated intrusion, and getting security sign-off. It typically takes much longer than failover, and leadership should see the realistic number.

Finding problems. First drills commonly exceed RTO by 50-200% because of missing dependencies, slow decisions or stale runbooks. The value is the fix list. By the second or third drill, most teams reach their targets, and the focus shifts to keeping them as systems change.

Mostly, through isolated failover and component tests, which run while production continues. Live failover does involve customers, but in a low-traffic window with tested rollback, impact is usually a few minutes of reconnects. Many teams also use the live drill to validate planned maintenance procedures.

Yes. RBI expects regulated entities to test BCP and DR periodically and report outcomes to the board or its committees. SEBI expects market participants to conduct DR drills, and market infrastructure institutions have specific drill and live-from-DR requirements. NTSPL formats evidence for your sector’s inspection expectations.

Setting up the programme and running the first cycle of drills takes about 12 weeks and 30-50 consultant days for 5-10 Tier 1 services. Each later drill costs a few consultant days plus cloud run cost of the DR environment during the test, often INR 10,000-80,000 per drill depending on scale.

For most enterprise systems, runbook-driven failover with heavy automation and a few human gates is safer than fully automated failover. Automatic failover triggered by health checks reacts fastest, but it can fail over on a partial or transient issue, cause split-brain on databases, or flip traffic back and forth. Runbook-driven failover lets a person confirm the situation, then runs automated modules for the heavy lifting, typically adding only 10-20 minutes. Reserve fully automated failover for stateless tiers and for platforms such as active-active designs where the data layer arbitrates and failover is just traffic shift.

The team that operates each system owns its runbook, with a DR coordinator owning the overall set, the declaration tree and the review calendar. Ownership is recorded in the runbook header and checked at each quarterly review. Gaps go to the DR coordinator.

A structured document in version control, such as Markdown or a wiki page generated from it, with step numbers, owners, durations, commands and checks. Automation lives alongside in code. NTSPL avoids long prose and screenshots that go stale quickly. Each step is short.

Yes, as a separate runbook. Ransomware recovery differs from failover: it uses isolated backups, a clean-room environment, a choice of recovery point before the intrusion and security sign-off before reconnecting. Mixing it into the failover runbook causes dangerous shortcuts. It needs security sign-off.

Regulators such as RBI, SEBI and IRDAI expect documented, tested BCP and DR procedures with defined roles. CERT-In’s 6-hour incident reporting rule also means the runbook should include the reporting step and who owns it. Runbooks with execution logs provide that evidence.

Yes. Many recoveries involve both, such as on-premises production failing over to cloud, or cloud applications depending on on-premises identity. Runbooks call automation on each side and list manual steps for systems without APIs. The on-premises steps are tested in the same drills as the cloud steps.

For 5-10 business services, plan five to six weeks and 25-40 consultant days, including automation and walkthroughs. Effort depends most on how much existing automation can be reused and how many partner or manual steps are involved. Ongoing upkeep is typically a few hours per runbook per quarter.

Both can be effective if done properly, but locked cloud vaults in an isolated account are now the better default for most Indian enterprises. Tape is truly offline but restores slowly, is hard to test frequently and depends on physical handling and off-site logistics. A locked vault with separate identity and keys cannot be deleted by a compromised admin, restores in hours and can be tested monthly. Keep tape if a regulator or policy requires it, or for very long-term archives. Otherwise, a logically air-gapped cloud copy plus a clean-room process gives faster, more testable recovery.

The attacker exercise uses a dedicated test role granted the same rights a compromised production admin would have, and attempts deletions against test recovery points and policies. It proves blocks and alerts work without touching production copies. Results go into the evidence pack.

Ideally yes. NTSPL commonly places the locked vault in the second Indian region, such as Hyderabad, South India or Delhi, combining protection against both region loss and admin compromise. Both copies remain in India for data residency. Region separation adds a little inter-region transfer cost.

It stops existing recovery points from being deleted or altered. New backups taken after encryption will contain encrypted data, which is why you need retention long enough to step back past the attack and anomaly alerts that flag sudden backup size or change-rate jumps.

Not if designed with them. We baseline existing findings so teams are judged on new risk, budget pipeline checks to a few minutes, use just-in-time access with approval times under ten minutes, and automate safe fixes. Most teams find fewer interruptions once guardrails replace ad-hoc reviews.

RBI’s IT governance and cyber security frameworks expect regulated entities to maintain and test backups and recovery. CERT-In requires cyber incidents, including ransomware, to be reported within 6 hours. A documented clean-room recovery and locked backups give the evidence regulators and insurers ask for after an incident.

Individual capabilities usually run INR 6-28 lakh each over six to twelve weeks. A combined programme covering assessment, foundations and operations for a mid-size regulated firm commonly totals INR 60 lakh to 1.5 crore over six to nine months, plus native tool run costs.

The DPDP Act requires reasonable security safeguards and breach notification. Data discovery and encryption show where personal data is and how it is protected, identity and network work restrict access, detection and incident readiness enable timely notice, and control mapping documents it all for the Data Protection Board or auditors.

Once a vault lock in compliance mode is in effect, AWS states that the lock becomes immutable and cannot be changed or deleted by any user or by AWS, and recovery points cannot be deleted before retention expires. Azure locked immutable vaults behave similarly. Only retention expiry or account closure ends them.

No. This family designs and builds the controls, pipelines, playbooks and evidence that a SOC depends on. A managed security operations team then monitors and responds 24×7. Building first means your SOC receives fewer, better alerts with the context needed to act.

The build typically takes six to eight weeks and 30-45 consultant days. Run cost is mostly the extra copy’s storage in the recovery account, often 30-60% on top of existing backup storage depending on the retention ladder. NTSPL models this before locking, because locked retention cannot be shortened later.

Yes. Many of our clients run two clouds, often Azure for corporate systems and AWS or Google Cloud for digital products. We use each cloud’s native controls and connect them through one severity model, one tagging standard and, where it makes sense, a single SIEM or posture console.

Start with the Cloud Security Assessment. In three to five weeks it shows what is exposed, who holds privilege and where logging is missing, and ranks fixes by risk. Most organisations then move into identity and network foundations, because those close the most attack paths per rupee spent.

No. Replicas, availability groups and multi-zone deployments protect against infrastructure failure by copying every change within seconds, including deletes, bad updates and ransomware encryption. Backups with transaction logs let you go back to a time before the damage. You need both: replicas for availability, backups and PITR for recoverability. A delayed replica that applies changes a few hours late sits in between and can be useful for very large databases, but it is not a substitute for backups with retention, because its window is short and it is still writable by the same administrators.

Choose one unified framework. RBI, SEBI CSCRF, IRDAI, PCI DSS, ISO 27001 and the DPDP Act overlap heavily on access control, logging, encryption, vulnerability management and incident response; running them separately means collecting the same evidence several times and risking different answers to the same question. A unified library defines each control once, maps it to every clause, and generates framework-specific packs from shared evidence. Keep framework-specific controls only where a requirement is genuinely unique, such as PCI DSS payment page script controls. The usual result is roughly half the audit effort and fewer contradictory observations.

Yes. A restore that opens can still contain corruption. NTSPL runs engine-native consistency checks on a restored copy, not production, at least monthly for Tier 1 databases and quarterly for others, which also avoids loading production during business hours. Failures are escalated to the DBA lead the same day.

Most auditors accept system-generated reports and query outputs with timestamps and scope, and often prefer them to screenshots because they cover the full period. We agree evidence formats with your auditor before the audit, and keep a sample of manual evidence where they require it.

DPDP obligations such as reasonable security safeguards, breach notification and data retention limits are mapped as clauses like any other. Many are already satisfied by sector controls; the mapping shows where DPDP adds requirements, for example notifying affected individuals and handling children’s data.

Keep at least one backup copy in a locked or logically air-gapped vault that database administrators cannot delete, encrypted with keys outside the production account. Combine this with the Immutable & Protected Backup design so a compromised DBA account cannot erase recovery points.

Only for what the provider operates. AWS, Microsoft and Google publish ISO, SOC and PCI attestations covering their data centres and services, which you cite for inherited controls. Your identity configuration, data handling, logging and incident processes remain your responsibility and need your own evidence.

Yes. The 2022 revision has 93 Annex A controls in four themes: organisational, people, physical and technological, and adds controls such as information security for use of cloud services and threat intelligence. Most technological controls map directly to cloud configurations, while physical controls are largely inherited from the provider.

Yes. Regulated entities must retain records for periods set by their sector rules and the PMLA, often five to ten years, and RBI expects tested backups. NTSPL maps retention per data class and ensures long-term copies stay in India and are restorable.

That depends on your licence and data. RBI master directions apply to banks, NBFCs and payment entities; SEBI’s CSCRF to regulated market entities; IRDAI’s information and cyber security guidelines to insurers and intermediaries; CERT-In directions and the DPDP Act broadly to most organisations processing digital personal data.

For two to five frameworks over one or two clouds, NTSPL typically delivers the library, mappings and evidence automation in about ten weeks for INR 12-24 lakh. Native evidence tools add modest running costs, mostly AWS Config rule evaluations and Security Hub CSPM checks.

You need both, and readiness comes first. A retainer gives you forensic specialists and surge capacity, but they arrive hours later and depend on what your team has done in the meantime: whether evidence was preserved, logs exist, access is ready and decisions were taken. In-house readiness covers the first hours, which decide most outcomes and the CERT-In deadline. Build roles, playbooks, forensic tooling and reporting internally, then sign a retainer with cloud forensics capability and pre-agreed access so the external team can start work in minutes when they join, not after a day of onboarding.

Usually by restoring the whole database side-by-side, then copying or merging the needed tables or rows. Most managed engines restore at instance or database level. NTSPL keeps reconciliation scripts ready so table-level recovery takes hours, not days. Restoring the full database to a separate instance also keeps production online during the recovery.

Providers help within the shared responsibility model: they secure the underlying platform, and offer services such as AWS Security Incident Response or Mandiant retainers. Investigating your accounts, identities, workloads and data, and reporting to regulators, remains your responsibility. Pre-agree how provider support will be engaged.

A compromised account cannot be trusted for analysis, and evidence must be protected from tampering. A dedicated forensic account, subscription or project with read-only access to evidence and no trust from production keeps snapshots and logs safe and lets analysts start immediately.

Amazon RDS and Aurora support PITR up to 35 days. Azure SQL Database and Managed Instance support 1-35 days with long-term retention up to 10 years. Cloud SQL and AlloyDB also support PITR windows that can be configured; beyond them, keep scheduled long-term backups.

Leaders and responders walk through a realistic scenario, such as ransomware spreading from a compromised vendor account, as injects arrive over two to three hours. Each decision is recorded, gaps in roles, information and authority surface quickly, and we produce a report with prioritised fixes.

The DPDP Act 2023 requires a data fiduciary to notify the Data Protection Board and each affected data principal of a personal data breach. Your playbooks therefore need a track for assessing whether personal data was affected, gathering facts and preparing notices alongside the CERT-In report.

For 10-30 databases across two or three engines, expect six to seven weeks and 30-45 consultant days. Run cost changes are mostly longer PITR retention and long-term backup storage, often INR 10,000-60,000 a month per large database. NTSPL prices the retention design before changes are applied.

CERT-In’s April 2022 directions require service providers, intermediaries, data centres and body corporates to report specified cyber incidents to CERT-In within six hours of noticing them, and to provide logs and information on request. The list includes data breaches, unauthorised access and ransomware.

For almost all Indian enterprises, cross-region on the same provider is the better choice. It reuses the same services, IAM model, tooling and skills, replication is native, and both regions are in India. Cross-cloud DR protects against a provider-wide event or a commercial dispute, but doubles the platform skills needed, forces lowest-common-denominator designs and makes data replication, keys and identity much harder. Consider cross-cloud only for a small set of systems where a regulator or board explicitly requires provider diversity, and then usually as backup copies in the second cloud rather than a running DR stack.

NTSPL’s eight-week readiness engagement, including playbooks, forensic tooling for one or two clouds and two exercises, typically costs INR 8-15 lakh. An external incident response retainer is separate and usually priced as pre-paid hours. Forensic environment running costs are low because analysis instances start only when needed.

Put automated controls in the pipeline first; keep human review for what tools cannot judge. Scanners catch known-vulnerable dependencies, leaked secrets, IaC misconfigurations and common code flaws in minutes on every change, which no review team can match at weekly release cadence. Human application security effort is better spent on threat modelling new features, reviewing authentication and payment flows, and penetration testing before major launches. Teams that rely only on periodic reviews find issues months after release; teams that rely only on tools miss business logic flaws. Use both, in that order.

Yes, but dependencies must be complete. If the application recovers in Hyderabad but authentication still calls a Mumbai-only service, recovery fails. The dependency register is designed to catch exactly these partial setups. Partial DR is fine as long as every dependency of the recovered part is also available in the second region, or has a documented fallback.

Yes. Regulators expect secure software development practices, including code review, vulnerability testing before release and change control. Pipeline logs showing scans, approvals, signed artefacts and exceptions give auditors continuous evidence across every release instead of samples. CERT-In and DPDP investigations also benefit from this trail.

Developers can mark a finding as a false positive or request an exception through a documented flow, reviewed by security within one business day. For urgent production fixes there is a logged break-glass override that creates a follow-up ticket automatically.

If users, plants or partners reach the application privately, yes, or at least an SD-WAN or VPN path that can be redirected to the DR region. A cloud DR that users cannot reach is not recovery. For internet-facing apps, global DNS or load balancing is enough.

GitHub Actions, GitLab CI and Azure DevOps can present OIDC tokens that AWS IAM, Microsoft Entra workload identity federation and Google Cloud Workload Identity Federation trust. Each repository and environment receives a narrowly scoped role, and tokens last minutes, so there is no key to leak.

Increasingly, yes. Banks and large enterprises in India now ask software vendors for SBOMs in procurement and audits, and SBOMs let you answer within minutes whether a newly disclosed vulnerable library is in any production image. We generate SPDX or CycloneDX for every image automatically.

Logs must remain available for 180 days within Indian jurisdiction. NTSPL replicates the central log archive to the DR region and configures the DR stack to write to an in-region log sink immediately, so there is no gap in coverage after failover.

Not noticeably if designed well. Pull request scans are diff-aware and budgeted at about three minutes per stage, heavier full scans run nightly, and only a narrow set of high-confidence issues blocks a merge. Most teams see total pipeline time rise by two to four minutes.

For 20-80 repositories on one CI platform, NTSPL’s engagement typically costs INR 9-18 lakh over 12 weeks. Open-source scanners add no licence cost; commercial code security platforms are licensed per committer, so for 50 developers expect several lakh a year.

For most regulators and boards, yes. The cities are several hundred kilometres apart in different seismic and flood zones and on different power grids. Distance also keeps asynchronous replication lag low, typically seconds for databases, which is why it is the default AWS pair for Indian workloads.

For workloads on one cloud, use the native manager. AWS Secrets Manager, Azure Key Vault and Google Secret Manager integrate with platform identities, managed rotation, KMS and audit logs with no servers to run. HashiCorp Vault is the better fit if you run several clouds plus on-premises and want one secrets API, need dynamic short-lived database credentials across many engines, or already operate Vault well. Vault Enterprise or the HCP-managed offering adds licence cost, and self-hosted Vault becomes a critical service you must patch, back up and keep highly available. Do not adopt it just to avoid three consoles.

AWS: Mumbai and Hyderabad. Azure: Central India (Pune), South India (Chennai), West India (Mumbai) and India South Central (Hyderabad), with Central India and South India as the formal pair. Google Cloud: Mumbai and Delhi. All pairs keep data in India, which satisfies RBI’s payment data storage direction and most sector localisation expectations.

Pre-commit hooks and pipeline scanning block commits and builds containing secrets, platform secret scanning watches repositories continuously, and developers get vault paths and SDK patterns that make the right approach easier than hard-coding. Any blocked secret is treated as exposed and rotated.

Yes, if the pattern is right. Managed database rotation and our rotation functions create a new credential while the old one stays valid, applications refresh from the vault within minutes, and the old credential is revoked only after all instances use the new one.

The shared foundation, including connectivity, replicated registries and keys, usually costs INR 1-4 lakh a month for a mid-size estate. Data replication adds inter-region transfer and second-region storage. Workload compute cost depends on the DR pattern chosen. NTSPL itemises each so finance sees what the second region costs regardless of pattern.

With BYOK you generate key material in your own HSM and import it into the cloud KMS, which then holds and uses it. With hold-your-own-key or external key management, key material stays outside the provider and each use is a call to your key manager, so revocation is immediate but availability depends on you.

Regulators generally require strong key management and protection of cryptographic keys rather than naming a specific product. Card scheme rules, PCI requirements and some contracts with banks call for HSM-protected or dedicated hardware for certain keys. We map each requirement to the minimum control that satisfies it.

Multi-zone deployment protects against a data centre or zone failure and should be the baseline for every production system. It does not protect against a regional control-plane issue, a bad configuration pushed region-wide, a regional networking event or a provider-side incident affecting several zones. Active-active across regions covers those, at roughly double the cost and with real application changes. If your platform loses more than INR 25-50 lakh per few minutes of outage, or you already need two regions for latency, multi-region active-active is justified. Otherwise, multi-zone plus a warm standby in a second region is the better balance.

Rotate the credential immediately; deleting the commit does not help because forks and scrapers copy it within minutes. Then check access logs for use of that credential since the commit time, scope the impact and, if personal data or financial systems were reachable, assess CERT-In and DPDP reporting duties.

Payment initiation uses an idempotency key tied to the order reference, so a retry in the other region is recognised. Gateway callbacks are registered to a global hostname reachable in both regions. In-flight payments are reconciled against the gateway’s status API after the switch.

For 20-60 applications, NTSPL’s engagement typically runs INR 10-20 lakh over 10-12 weeks. Vault charges are modest, usually a small monthly fee per secret plus API calls, so most estates spend INR 10,000-60,000 a month. Dedicated HSMs are a significant addition, often several lakh a month per cluster.

Start with internal users on a test cell, then drain a small production cell, then a whole region during a normal business period. Each drain is reversible in under two minutes. NTSPL recommends monthly cell drains and a full region evacuation each quarter.

Native threat detectors are essential but not sufficient once you have more than a handful of accounts or any compliance obligation. They detect known bad patterns well, such as crypto-mining, malicious IPs and credential exfiltration, but cannot correlate a suspicious sign-in in Entra ID with a key creation in AWS and a bulk download from GCP, and they do not hold your 180-day searchable trail. A small single-cloud start-up can begin with native detectors plus central log retention. Anyone regulated by RBI, SEBI or IRDAI, or running two clouds, should add a SIEM with custom rules.

Yes. Security logs belong in a dedicated log archive account, subscription or project with restricted access, so an attacker who compromises a workload account cannot delete evidence. Object lock or immutable storage policies add further protection for the 180-day trail.

No. Typically only the customer-facing transaction path qualifies: browse, cart, checkout, login or gameplay. Back-office, analytics and batch services stay single-region with backup or warm standby. Mixing patterns is normal and keeps cost proportionate. Over-applying the pattern is the most common reason active-active budgets overrun, so scope is agreed per service before design starts.

Each rule ships with a test case. We run attack simulations with open-source tools such as Stratus Red Team and Atomic Red Team in a controlled account, confirm the rule fires with the right entities, and repeat monthly so regressions are caught when services or log schemas change.

Yes. Sentinel has connectors for AWS CloudTrail, GuardDuty and other AWS logs through S3 and SQS, and for Google Cloud audit logs through Pub/Sub. It works well for organisations whose identity and endpoints are already in Microsoft, though cross-cloud data transfer costs should be estimated.

AWS Mumbai and Hyderabad, Azure Central India and South India, and Google Cloud Mumbai and Delhi. Round-trip latency between these pairs is low enough for asynchronous replication with lag of around a second, while keeping all data in India for DPDP and sectoral rules.

Identity sign-in logs and control-plane audit logs come first, because most cloud attacks begin with stolen credentials and continue through API calls. Next come threat detector findings, key and secret access logs, WAF logs and DNS logs. Flow logs are valuable for investigation but rarely the first signal.

Conventional single-primary relational databases cannot accept writes in two regions safely. Options are globally distributed SQL databases, partitioning so each region owns a subset of rows, or keeping the relational system as a single writer and moving hot paths to multi-writer stores. Aurora Global Database’s write forwarding still sends writes to one primary.

CERT-In’s directions of April 2022 require organisations to enable logs of ICT systems, maintain them securely for a rolling 180 days within Indian jurisdiction, and provide them when required for incident reporting. They also require clocks synchronised to NIC or NPL NTP servers or traceable sources.

Infrastructure typically runs at 80-120% above a single-region deployment, because each region carries spare headroom and data is stored twice. Engineering effort for a platform of 20-60 services is usually a 4-6 month programme. NTSPL limits scope to the customer-facing paths that need it, which keeps total uplift closer to 60-80%.

NTSPL’s 12-week design and build typically costs INR 14-28 lakh, depending on the number of clouds, SIEM choice and custom rules. Run costs depend on volume; with tiering and filtering, mid-size Indian estates commonly spend INR 1.5-6 lakh a month on ingestion and retention.

For cloud-only estates, native scanners now cover most needs: Amazon Inspector, Defender Vulnerability Management and Artifact Analysis scan VMs, images and functions, integrate with patch tools, and cost less. A commercial scanner remains the better choice when a large share of servers sits on-premises or in colocation, when the security team already runs a mature Qualys or Tenable programme with years of reporting, or when you need authenticated network scanning of appliances and databases. Many Indian enterprises run both: the commercial tool for on-prem and network scanning, native tools for cloud workloads, with findings combined in one priority model.

Warm standby gives minutes of recovery and seconds of data loss for roughly 25-50% of production cost, using conventional single-writer databases. Active-active removes failover time almost entirely but costs 80-120% of production and usually requires application changes: multi-region write data stores, idempotent operations and conflict handling. Justify active-active only when even a few minutes of downtime is unacceptable to customers or regulators, or when you already need two regions for latency or capacity. For most Indian enterprise systems, a well-drilled warm standby with a 10-minute RTO is the better investment.

The key measure is exposure window: how many days a high-priority vulnerability remains open on a reachable asset. We also track scanner coverage, SLA compliance by band, image age and exception counts, published weekly by team so owners see their own numbers.

Containers should not be patched in place. The fix is to update the base image or dependency, rebuild, rescan and redeploy. We automate weekly base image rebuilds and trigger application rebuilds when a P1 or P2 CVE affects a base layer they use.