Notes on running a security program.

India's DPDP Rules were notified in November 2025 and most duties apply from May 2027. What the Act asks of startups, the key dates, penalties and a practical plan.

Passing the first audit is a sprint. Staying compliant in year two is where teams slip. What auditors test after year one, which controls drift, and how to keep them running.

SOC 2 is a report on how you run security, not a certificate you buy. What auditors check, Type I vs Type II, what to leave out of scope, and how long it really takes.

A scanner lists what might be wrong. A penetration test proves what an attacker can actually do. Here is how the two differ, what buyers and auditors expect, and a cadence that works for startups.

Security questionnaires are slow because answers and evidence are scattered, not because the questions are hard. Here is how to build one source of truth so each one is faster than the last.

Security leadership moved from the CIO to the CISO, then to fractional and virtual CISOs. The next step runs the security loop continuously, with a person approving the moves that matter.

US buyers usually ask for SOC 2; Europe, India and global enterprises often ask for ISO 27001. How they differ, how the audits work, and how to build the shared work once.

A phased security checklist for startups with no security team: what to do in your first week, month and quarter, who owns each item, and how it doubles as SOC 2 and ISO 27001 groundwork.