29 security controls for Indian retailers, and what answers each

Endpoint detection and response, or a managed service that watches it 24×7.

Central log collection with retention matched to the law: 180 days for CERT-In, a year under DPDP from May 2027.

Single sign-on with strong multi-factor authentication for head office, warehouse and store-manager accounts.

Filter phishing aimed at staff; publish DMARC so no one can mail as you; find and take down fake stores and apps using your brand.

Immutable and offline backups of ERP, POS and storefront data, tested by restore; daily backups of the books on servers in India.

Continuous scanning of what faces the internet — storefront, APIs, VPNs — with critical fixes on a clock.

Encryption at rest and in transit, tokens in place of card and identity data, and discovery of where customer data actually sits.

Capture and record consent at every sign-up and checkout, honour withdrawals, and erase on schedule.

An inventory of every agency, SaaS tool and processor that touches customer data, with security checks proportionate to what they hold.

Data loss prevention and least-privilege access for customer-service, store and warehouse staff who see customer records.

Application allow-listing and hardening on POS terminals and store back-office PCs, so only approved software runs.

Mobile device management with kiosk lockdown for scanners, mPOS, self-checkout and delivery-partner devices.

Branch firewalls or SD-WAN/SASE that keep POS, guest Wi-Fi, CCTV and back office apart — so the card environment stays small.

DNS and web filtering on store networks and devices, blocking known-bad sites and lookalikes.

Privileged access management and recorded, time-boxed remote sessions for POS vendors, IT contractors and franchise support.

A WAF or WAAP in front of the storefront and its APIs, with DDoS protection for sale days.

Bot management against credential stuffing, scalping and fake sign-ups, with account-takeover detection on logins.

An inventory, authorisation and integrity check for each payment-page script, with alerts when one changes — PCI DSS 6.4.3 and 11.6.1.

Customer identity (CIAM) with passwordless or risk-based multi-factor login for shoppers and loyalty members.

Identity verification and KYC for marketplace sellers, delivery partners and new merchants.

Real-user monitoring, synthetic checks and a CDN that see a checkout slowdown before customers do.

A help-desk procedure that proves who is calling before a password or MFA reset — especially for admin accounts.

Choose how card data flows — redirect, iframe, or your own form; P2PE terminals or not — knowing what each puts in scope.

Who tells CERT-In, the gateway, Amazon, ONDC and customers — in what order, inside which clock.

Know the notice windows, audit rights and data rules in your gateway, marketplace, logistics and agency contracts — and write your own into vendors’.

Return, refund and cash-on-delivery rules that make organised abuse expensive — limits, holds, evidence and pattern checks.

A yearly review of sign-up, checkout and consent screens against the 13 dark patterns — required for e-commerce entities from 2027.

A security baseline in the franchise agreement — terminals, POS access, patching, who their IT vendor is — and a way to check it.

Card terminals validated under PCI P2PE, and PIN pads approved under PCI PTS — supplied through your payment provider.