Cybersecurity for SaaS Companies in India: SOC 2 & Beyond

A Bengaluru SaaS founder once told me his product was enterprise-ready. It had SSO, role-based access, a shiny status page. Then his first big US retailer sent over a 312-line security questionnaire and asked for his SOC 2 Type II report. He had none. The deal, worth roughly forty lakh a year in ARR, stalled for seven months while he scrambled. By the time he had a report, the champion who wanted to buy had changed jobs.

That is the quiet tax on Indian SaaS. Your product can be excellent and your security can still cost you the deal — not because you were breached, but because you could not prove you were safe on the buyer's timeline. This is a practitioner's roadmap for getting that proof, in the right order, without setting fire to your runway.

For a bank or an NBFC, the pressure comes from the RBI. For SaaS, it comes from your customer's procurement and vendor-risk team. That is a different animal, and founders keep misreading it. There is no single Indian law that says a B2B SaaS company must hold SOC 2 or ISO 27001. What forces your hand is the contract clause your enterprise buyer drops into the Master Services Agreement, and the third-party risk assessment (TPRM) their security team runs before signing.

So the agenda is set by whoever you sell to. Sell to US enterprises and mid-market? SOC 2 is the currency. Sell to European or global-regulated firms? ISO 27001 travels better and often sits alongside SOC 2. Sell to Indian banks, insurers or fintechs? Now the regulator does show up — through your customer — via CERT-In empanelled VAPT, RBI's outsourcing guidelines, and the master directions on IT governance. And if you touch personal data of Indian users, the Digital Personal Data Protection Act, 2023 (DPDP) applies to you as a Data Fiduciary regardless of which certification you chase.

These three get lumped together in pitch decks and they should not be. They answer different questions for different audiences.

The trap is treating SOC 2 as a certificate you buy. It is not. SOC 2 is an attestation report an auditor writes after examining evidence of five Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is mandatory; the other four you scope in only if you make claims about them. A Type I report says your controls were designed correctly on one day. A Type II says they actually worked across a window. Enterprise buyers want Type II. A Type I buys you goodwill and a foot in the door, nothing more.

Across dozens of readiness assessments, the same five gaps appear again and again. None of them are exotic. All of them are boring, and boring is exactly why they get skipped until a buyer's auditor finds them.

Your engineers have production database access because they needed it once in 2023. There is no quarterly review, no removal on offboarding, no ticket trail. When a SOC 2 auditor samples five leavers and asks you to show their access was revoked within your stated SLA, you have nothing. This single control failure — logical access — accounts for a large share of exceptions in first-year reports.

Code ships to production without a reviewed pull request, without a linked ticket, without evidence someone other than the author approved it. The auditor asks: show me ten changes and prove each was reviewed and tested before release. If your answer is trust me, our engineers are careful, you have a finding.

You have CloudWatch or an ELK stack. Nobody has defined what an alert-worthy event is, who responds, or how fast. Detection is a control only if someone is on the other end of it.

You run on AWS, use a payments gateway, a support tool, an analytics SDK. Each is a sub-processor. Under SOC 2, ISO 27001 (Annex A 5.19-5.23) and DPDP alike, you are accountable for them. If you cannot produce your critical vendors' own SOC 2 or ISO reports, you own their risk by default.

A policy PDF is not incident response. CERT-In's 2022 directions require reporting cyber incidents within six hours of noticing them, and require you to keep logs for 180 days within Indian jurisdiction. If you serve regulated Indian customers, a plan you have never run is a plan that will fail at 2 a.m. on the day it matters.

Picture the vendor-risk call. Their security lead shares a spreadsheet — call it the SIG Lite, a standardised questionnaire of a couple of hundred controls. Your CTO is answering live. Question forty asks: do you encrypt data at rest, and how do you manage the keys? He says yes, AES-256. Then: show me the KMS key rotation policy and evidence of last rotation. Silence. He knows the disk is encrypted because AWS does it by default, but he has never touched key management, cannot say who can access the keys, and has no rotation record.

That pause tells the buyer's team more than the answer. They are not looking for perfection. They are looking for whether you operate your security or merely inherited it from your cloud provider. The deals that survive are the ones where the founder says: here is our access-review log, here is our change-management evidence, here is our sub-processor list with their attestations, and here is our SOC 2 Type II report covering the last nine months. That founder closes. The one improvising loses the technical win to procurement.

Founders often try to do everything at once and burn cash on the wrong thing first. There is an order that respects both your runway and your sales pipeline.

The reuse point in Phase 4 is the single biggest cost saver most founders miss. SOC 2's Security criterion and ISO 27001's Annex A controls overlap heavily — access control, cryptography, change management, supplier security, incident response all map across. Build the control once, evidence it once, and let two frameworks lean on it. Doing them sequentially with two separate teams is how you spend double.

Numbers, because vagueness here helps nobody. These are practical India ranges for an early-to-growth SaaS company; they move with headcount, cloud complexity and how much you outsource.

Two honest cautions. First, the audit fee is the visible cost; the hidden cost is engineering time spent building and evidencing controls, and that dwarfs the invoice. Second, beware anyone quoting a flat all-in price with a guaranteed pass in thirty days. A legitimate auditor cannot guarantee your controls will operate effectively — that depends on your operation, not their signature.

SOC 2 and ISO tell a buyer you have a system for security. They do not deeply test whether your actual code is exploitable. That is why serious buyers, and every regulated Indian one, want VAPT on top. For a multi-tenant SaaS product, the failure modes are specific and worth naming.

Get application and cloud VAPT done by a CERT-In empanelled auditor, fix what they find, and keep the report. When a bank or NBFC buyer asks — and under RBI's outsourcing and IT governance expectations they will — that report is what they want to see, not a general certificate.

The Digital Personal Data Protection Act, 2023 is not optional and it is not the same as SOC 2. If you process personal data of individuals in India, you are a Data Fiduciary with real obligations: process only on a lawful basis, honour data-principal rights (access, correction, erasure), notify the Data Protection Board and affected users of breaches, and bind your processors — your sub-processors — with contractual terms. Penalties in the Act run to substantial figures, up to 250 crore for certain failures.

The good news for a well-run SaaS shop: much of your SOC 2 and ISO control base already supports DPDP. Access control, encryption, breach response, vendor contracts — you built them anyway. What DPDP adds on top is data mapping (know exactly what personal data you hold and where), lawful-basis and consent handling, a data-principal rights workflow, and DPDP-aware Data Processing Agreements with every processor. Layer it on the same foundation rather than treating it as a separate empire.

Come back to that Bengaluru founder. His product never got worse during those seven lost months. What changed the outcome was proof — the ability to answer a buyer's security team on their timeline, with evidence rather than assurances. Security for Indian SaaS is not a compliance chore you bolt on before an IPO. It is a sales enabler you build early, in the right order, so it is ready the day a big logo asks for it.

If you want a second set of eyes from people who have sat on the auditor's side of that table, our team at CyberSigma are senior CERT-In empanelled auditors and PCI QSAs who run SOC 2, ISO 27001, VAPT and DPDP readiness hands-on — pragmatically, and in the order that protects your runway.