The Compliance Imperative
The India Digital Personal Data Protection Act (DPDPA) 2023 came into full enforcement in 2025, joining GDPR, SOC 2 Type II, and ISO 27001 as mandatory compliance frameworks for Global Capability Centres operating in India. The penalty for a data breach now reaches ₹250 crore per incident.
Zero-Trust Architecture (ZTA) is the only proven model that satisfies all four frameworks simultaneously because it assumes breach by default and enforces verification at every layer.
The Five-Layer Zero-Trust Model
- Identity & Access (Layer 1) — Every service, user, and device authenticates via short-lived certificates (SPIFFE/SPIRE) and per-request JWTs. No long-lived credentials. MFA mandatory for all human actors.
- Network Segmentation (Layer 2) — Microsegmentation via service mesh (Istio/Linkerd). East-west traffic is mTLS-encrypted by default. North-south traffic routes through a Web Application Firewall with L7 inspection.
- Workload Security (Layer 3) — Container images signed via Sigstore/Cosign. All pods run as non-root with read-only filesystems. Kernel-level eBPF monitoring detects anomalous syscalls in real time.
- Data Classification (Layer 4) — Automated data discovery tags PII, PHI, and financial data at the column level. Column-level access policies enforced at the query layer via Apache Ranger.
- Continuous Compliance (Layer 5) — Automated SAST/DAST in every CI pipeline. Daily compliance score dashboards against SOC 2 and ISO 27001 control frameworks. Automated evidence collection for audit readiness.
Key 2026 Benchmarks for GCCs
| Metric | Industry Average | CogFocus ZTA Baseline |
|---|---|---|
| Mean Time to Detect (MTTD) | 197 days | Under 4 hours |
| Critical vulnerability patch SLA | 21 days | Under 72 hours |
| Audit evidence preparation | 6–8 weeks | Automated, continuous |