--- title: "Only 3 of 10 CSPM vendors document an India region; banks should ask the other 7" summary: "Ten CSPM vendors in TechBag's cloud security guide, checked for an India region and a printed price against RBI's July 2026 cyber Directions, as of September 2026." url: https://www.thetechbag.com/blog/cloud-security-posture-management-cspm-safeguarding-banks format: Note desk: "Security operations" published: 2026-03-03 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["CSPM","CNAPP","cloud security","banks","RBI","data localisation","CERT-In","SEBI CSCRF","BFSI"] cover: https://www.thetechbag.com/blog/covers/cloud-security-posture-management-cspm-safeguarding-banks.png --- # Only 3 of 10 CSPM vendors document an India region; banks should ask the other 7 *Ten CSPM vendors in TechBag's cloud security guide, checked for an India region and a printed price against RBI's July 2026 cyber Directions, as of September 2026.* Note · Security operations · By TechBag · Published 2026-03-03 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/cloud-security-posture-management-cspm-safeguarding-banks The short version - Three of the ten CSPM vendors we track document an India region for their findings: Qualys, SentinelOne and Sophos. A bank should ask the other seven where the data goes.[1] - CSPM produces evidence for 6 of the 24 Level I sections in RBI’s 2026 cybersecurity Directions for urban co-operative banks. It is a control, not a compliance programme.[2] - Only Fortinet prints a starting price; the rest quote, meter in credits or sell through a marketplace. The 2024 version of this piece listed nine things a CSPM tool does for a bank, from asset inventory to open-port alerts, and stopped there. The question an Indian bank’s IT risk team actually brings is different: which product can we put in front of the auditor, and where will it keep what it finds? ## Where the findings live A CSPM tool reads the configuration of every cloud account through the provider’s APIs; several also take disk snapshots of workloads to scan for vulnerabilities and, in data-security modules, sample the data itself. The workloads already sit in a region you chose. The question is where the findings and snapshots are processed and stored.[1] **Figure: Seven of ten CSPM vendors do not yet document an India region for their findings** *CSPM vendors in TechBag's cloud & workload security guide, by documented India region, September 2026* - No India region documented: Wiz, Check Point, Tenable, Trend Micro, Fortinet, Bitdefender6 vendors 60% - Announced, not yet documented live: CrowdStrike, January 20261 vendors 10% - India region documented: Qualys, SentinelOne (Mumbai), Sophos (Mumbai)3 vendors 30% | | Value (vendors) | Share | | --- | --- | --- | | No India region documented: Wiz, Check Point, Tenable, Trend Micro, Fortinet, Bitdefender | 6 | 60% | | Announced, not yet documented live: CrowdStrike, January 2026 | 1 | 10% | | India region documented: Qualys, SentinelOne (Mumbai), Sophos (Mumbai) | 3 | 30% | Source: TechBag cloud & workload security guide, vendor documentation verified 22 August 2026 · as of 30 September 2026 · Kaspersky, in the guide for workload protection, sells no CSPM and is excluded That matters for one rule above all. RBI’s direction on the storage of payment system data, issued on 6 April 2018, requires the entire data relating to payment systems to be stored only in India, and it reaches third-party vendors.[4] Configuration findings are not payment data. A snapshot of a payments server may be. Whether a given scan crosses that line is for the bank’s compliance team to decide from the vendor’s architecture document, not from its datasheet. ## What CSPM proves to an RBI inspector, and what it does not RBI replaced 628 supervisory circulars with 64 consolidated Directions on 31 July 2026; seven cover cybersecurity, one per licence class, and all took effect on issue with no transition period.[3] The urban co-operative bank version lists 24 Level I sections, A to X.[2] TechBag countTechBag mapping The nine 2024 use cases land on six of those 24 sections: inventory of information assets (F), protection of customer and payment information (G), cryptographic controls (H), network management and security (K), secure configuration (L) and user access control (O). Activity logs and vulnerability findings feed Level II sections instead. The other 18 Level I sections, among them the cyber crisis plan, board oversight, awareness, backup, vendor risk and IS audit, no scanner produces. Our view Our view: buy CSPM for sections F, H, K and L, where continuous evidence beats a quarterly spreadsheet. Do not let a posture score stand in for the IS audit; an inspector reads the score as a symptom, not a control. ## Cost, and the India rules that bite Prices are scarce. Fortinet publishes a FortiCNAPP starter pack from about US$25,000 a year; Wiz Essential is reported by resellers at about US$24,000 a year for 100 workloads; Sophos sells pay-as-you-go on AWS Marketplace; Trend Micro meters in Vision One credits; the rest quote.[1] TechBag invoices in INR with 18% GST. Besides the RBI Directions, a bank runs CERT-In’s six-hour incident reporting and 180-day log retention within Indian jurisdiction, in force since 28 April 2022.[5] A bank’s broking or asset-management arm also answers to SEBI’s Cybersecurity and Cyber Resilience Framework, issued on 20 August 2024.[6] How we did this Figures as of 30 September 2026 The vendor counts and prices are TechBag’s cloud & workload security guide as it stood on 30 September 2026: 16 products from 11 vendors, of which 10 sell CSPM. “Documented” means the vendor’s own documentation names an India region for the service; a vendor marked otherwise may still offer one on request. The section mapping is our judgement against the urban co-operative bank Directions, whose chapters TechBag transcribed; the commercial-bank Directions share the framework title but their section letters were not compared here. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, Cloud & workload security (CNAPP) guide: 16 products, India region and pricing per vendor](https://www.thetechbag.com/browse/security/cloud-workload-security) — vendor documentation verified 22 August 2026 2. [RBI, Urban Co-operative Banks: Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (Chapter III, Level I, sections A to X)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=13616&Mode=0) — 31 July 2026 3. [RBI, repeal circular DoS.CO.PPG.66/11.01.005/2026-27 (628 circulars repealed, 64 Directions issued) and Master Directions list](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx) — 31 July 2026 4. [RBI, Storage of Payment System Data, RBI/2017-18/153](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=11244) — 6 April 2018 5. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (6-hour reporting; 180 days of logs within Indian jurisdiction)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 6. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024 Related on TechBag: the [cloud & workload security guide](https://www.thetechbag.com/browse/security/cloud-workload-security) shortlists all 16 products by runtime, agent and region; [BFSI obligations](https://www.thetechbag.com/industries/bfsi/obligations) maps each RBI section to the tools and a cost band. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Cloud & workload security (CNAPP) guide](https://www.thetechbag.com/browse/security/cloud-workload-security) — 16 products by runtime, agent and India region - [BFSI obligations: RBI, SEBI and CERT-In duties](https://www.thetechbag.com/industries/bfsi/obligations) — each RBI section mapped to tools and a cost band