Home / Cybersecurity
Cybersecurity
Cybersecurity that protects your students’ data and your institution’s reputation
Practical, plain-language security for colleges and universities, delivered by a Tiruchirappalli team. Formal audits are performed by independent CERT-In empanelled auditors.
Why it matters
Colleges hold sensitive data, often with small IT teams
Admission files, Aadhaar details, community certificates, marks, fee records and bank details sit in the same few systems. Attackers know that these institutions are often under-resourced, and a single incident can interrupt examinations, expose students and damage public trust.
What we do
Eight areas of campus cybersecurity, handled by one accountable team
Each area ends in something your Principal, IQAC coordinator or auditor can see: a report, a log, a tested backup or a signed procedure.
Free security assessment
A non-intrusive review of your campus, agreed in writing and scheduled around your timetable.
- Networks, servers, backups, websites and applications
- Vendor-neutral findings, ranked by risk
- A 90-day action plan for the Principal
Network and Wi-Fi security
Separation and monitoring that stops one infected computer from reaching everything else.
- Separate administrative, laboratory, hostel and guest networks
- Firewall configuration and review
- Individual Wi-Fi logins, with connection logs kept as required
Computers and servers
Systems that are updated, protected and hardened, not left to chance.
- Monthly patching of computers, servers and network devices
- Licensed endpoint protection with named responsibility
- Hardening of laboratory machines
Backups and ransomware recovery
The most reliable defence against ransomware is a backup that has been proven to restore.
- Automatic backups with an offline or off-site copy
- Restore tests on a fixed schedule
- A written recovery procedure for the exam and fee servers
Website and application security
College websites and portals that protect student documents and withstand common attacks.
- HTTPS with HSTS, and no exposed upload folders
- Testing against the OWASP Top 10 before launch
- Removal of personal documents from public pages and search results
Logins and access control
Most breaches begin with a shared, weak or forgotten login.
- Individual logins and two-step verification
- Role-based access to student records
- A same-day exit checklist when staff leave
Monitoring and incident response
Early warning, and a clear plan for the first hours after an incident.
- 24-hour alert for critical incidents
- Incident playbook and an annual breach drill
- Support in reporting to CERT-In and the Data Protection Board
Awareness and training
Staff and students are the first line of defence, and the most frequent target.
- Short sessions for office, exam, hostel and placement staff
- Phishing and password practice for students
- Attendance records for your governance file
What the rules expect
Security duties that apply to your institution
Technical safeguards are also legal duties. The table summarises the main obligations; the sections cited are those of the Act and Rules themselves.
| Requirement | Source | What it means on campus |
|---|---|---|
| Reasonable security safeguards to prevent a personal data breach | DPDP Act, s.8(5); DPDP Rules, 2025, r.6 | Access control, encryption or masking where suitable, logging and monitoring, backups and continuity measures, and written contracts with processors. |
| Notice of a breach to the Board and affected persons | DPDP Act, s.8(6); DPDP Rules, 2025, r.7 | Intimation without delay, a detailed report within 72 hours, and notice to every affected student, parent or staff member. |
| Retention of logs | DPDP Rules, 2025, r.6; CERT-In Directions, 28 April 2022 | Access logs kept for at least one year; network and system logs retained for 180 days within India. |
| Reporting of cyber incidents | CERT-In Directions, 28 April 2022 | Specified incidents, such as ransomware or data breaches, reported to CERT-In within 6 hours of noticing them. |
This summary is for general information and is not legal advice. Please read the official texts: Digital Personal Data Protection Act, 2023, DPDP Rules, 2025 and CERT-In.
How an engagement works
From a free assessment to independent assurance
A free, non-intrusive review of your networks, systems, backups and websites, with the scope agreed in writing.
A vendor-neutral report that ranks findings by risk and sets out a 90-day plan with quick wins first.
Remediation by our engineers or by your chosen supplier, using specifications written as “or equivalent”.
Patching, backups and alerts maintained all year, with a quarterly posture report to the Principal.
Where a formal audit is required, an independent CERT-In empanelled auditor performs it. We prepare your campus, coordinate the audit and fix what it finds.
Start today
Ten actions every college can take this month
Most of these cost little or nothing. Together, they close a large share of the exposures that attackers rely on.
Switch off shared office accounts on the ERP, fee and exam systems.
Begin with official email and the administrator accounts of your ERP.
A backup that stays connected to the server can be encrypted by ransomware as well.
Check routers, CCTV recorders, biometric devices and printers first.
Keep accounts, exam and administrative systems on their own network.
Name one person, set a monthly date and keep a log.
Search for your own domain and file types such as PDF to see what is exposed.
Disable email, ERP, exam and Wi-Fi access on the last working day.
Publish the name and email address on your website and in every privacy notice.
Record who decides, who contains the incident and who informs the authorities.
Questions
Cybersecurity: frequently asked questions
Is Cretowin a CERT-In empanelled auditor?
No. Formal audits are performed by an independent CERT-In empanelled auditing organisation engaged for your project. We prepare your campus beforehand, coordinate the audit and fix what it finds.
Can you guarantee that we will never be attacked?
No service can give that guarantee. Our work reduces the likelihood and the impact of an incident, and helps your team detect it, respond quickly and meet its reporting duties.
Will the assessment disrupt classes?
No. It is a non-intrusive review, scheduled around your timetable. We agree its scope with you in writing before we start.
Where should we start on a limited budget?
Begin with the free assessment and the ten actions above. Individual logins, two-step verification, a tested offline backup and the removal of public documents cost little and have a high impact.
Cybersecurity services are included in the subscription plans described on the home page and in plan features. Each quote is scoped after a free assessment.
Find out where your campus stands
Our free assessment covers your network, systems and websites in one visit. You keep the report and may act on it with any supplier.