Fortinet SOC-as-a-Service for India's compliance reality — CERT-In, DPDP, RBI and SEBI, 2026

India's compliance landscape moved from "have a security policy" to "prove that you detected, in time". CERT-In's 28 April 2022 Direction created a six-hour reporting clock. The DPDP Act 2023 turned breach response into a Data Protection Board notification with up to ₹250 crore in financial exposure. RBI's Cyber Security Framework and SEBI's CSCRF both require 24×7 monitoring. None of these obligations start at the breach. They start at detection — and the clock is only fair if you were actually watching. Building a 24×7 SOC in-house is a ₹2.5–₹3.5 crore commitment before the first alert is triaged. The realistic alternative is FortiGuard SOC-as-a-Service, billed by Fortinet's own datasheet as "always-on protection with 24/7 threat monitoring and incident response, without operational complexity." Critically — and this is the part most evaluations miss — SOCaaS monitors both Fortinet Security Fabric devices and a wide range of third-party vendors, with FortiSIEM as the multi-vendor analytics backbone and a defined four-priority escalation SLA topping out at 15 minutes for P1.

The compliance clock starts when you detect — not when you decide to look

The change in Indian regulation over the last four years is not a tightening of penalties — it is a reframing of when the clock starts. CERT-In's 2022 Direction did not change what incidents you have to report. It changed the timer: six hours from becoming aware. The Direction also extended log retention to 180 days, stored within Indian jurisdiction, and added a defined list of incident classes that explicitly include data breaches and ransomware. The combined message is simple: you cannot satisfy a six-hour clock if you take a day to notice.

The DPDP Act reinforces the same theme from a different angle. The Act's reasonable-safeguards obligation runs continuously; the breach notification to the Data Protection Board is triggered the moment the breach is known; and the Schedule penalties — up to ₹250 crore per instance — are calibrated to the failure of safeguards, not just the breach. RBI's Cyber Security Framework and SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) both add sector-specific 24×7 monitoring obligations on the entities they cover.

Detection is now the regulator-visible event. SOC is the function that produces detection. You either have one, you outsource one, or you fail audits.

The four regulators that now require a SOC capability

The IRDAI Information & Cyber Security Guidelines and the various sectoral CERT-Fin advisories layer additional requirements on insurance and financial-services entities. The pattern is consistent across regulators: continuous monitoring, time-bounded reporting, evidence-grade logs. Each of those is an output of a working SOC. None of them is an output of "we have a SIEM".

The math of building this in-house

The 24×7 part is what makes in-house SOC expensive. Three shifts × seven days × leave coverage + tooling + threat intelligence + storage adds up faster than most CFOs expect. The table below is a sober mid-market estimate — your numbers will vary, but the order of magnitude is hard to escape.

Salary ranges reflect Indian SOC analyst CTC levels at the time of writing. Tooling ranges are partner-quoted bands for mid-market deployments and vary widely by vendor and ingest volume. Treat this as an order-of-magnitude estimate, not a quote.

The two monitoring models — Fortinet Fabric and Multi-Vendor

The single most important thing to understand about FortiGuard SOCaaS before scoping it is that it ships two distinct data-collection and monitoring models, documented on page 4 of the official datasheet. Most evaluations focus on one and miss the other.

The mechanical difference: Fabric Monitoring ingests via FortiAnalyzer because the data sources are already speaking the Security Fabric's protocol. Multi-Vendor Monitoring deploys FortiSIEM collectors and agents — on-prem or cloud — that ingest from third-party sources and forward to the SOC. The Ordering Guide is explicit: "FortiSIEM serves as the core security analytics platform used by the Fortinet SOC, supporting a wide range of data sources and connectors for comprehensive monitoring."

Seven monitoring domains — one license covers all of them

Page 3 of the Ordering Guide carries a coverage matrix that quietly settles the multi-vendor question. There are seven monitoring domains the SOC covers. Across the seven distinct SOCaaS licence shapes (Multi-Vendor + six product-bundled licences), only the Multi-Vendor SOCaaS licence covers all seven. Three domains — Application & SaaS, Cloud & IaaS, Identity & Access — are exclusively covered by the Multi-Vendor licence.

Source: FortiGuard SOCaaS Ordering Guide, March 23 2026 (SOCaaS-OG-R3-20260323), p.3 — "Service Offering / SOCaaS License" matrix.

Read it as a buyer: if you have any cloud workload, any SaaS that matters, or any identity provider (Entra ID, Okta, Ping, AD) producing audit logs you need a regulator to see — you need the Multi-Vendor SOCaaS licence in the mix. The product-bundled licences are real, useful and cheaper-per-asset, but they don't reach those three domains.

The four priority escalation SLAs — what Fortinet actually commits to

The most-quoted line from the product page — "as little as 15 minutes" — is the headline number from a defined four-tier ladder. The full SLA structure is on page 6 of the datasheet under Critical Escalation Times.

For an Indian customer mapping to the CERT-In 6-hour clock, this matters: a P1 escalation lands in your customer portal in 15 minutes, which means the regulator-facing decision window — drafting and signing the CERT-In report — has the remaining 5 hours and 45 minutes to play with, not a frantic last-hour scramble.

The MITRE ATT&CK detection catalog

Fortinet publishes the SOCaaS detection catalog as a Q2 / 2026 reference guide (the SOCaaS Threat Detection Reference Guide). Every detection is mapped to a MITRE ATT&CK Tactic and Technique, and each row names the Fabric or third-party source required to fire it. The published catalog covers both IT and OT, structured along the cyber kill chain.

The detection catalog is the most concrete answer to "what does the SOC actually look for?". It's authored, versioned, and mapped to MITRE — not a marketing fly-over. The same guide also covers OT-specific detections (Industrial-protocol exploit, Hardcoded Credentials T0891, Denial of Service T0814) for customers running OT estates under SOCaaS coverage.

What runs inside the customer portal

How a CERT-In 6-hour ticket actually clears

The most useful way to evaluate any SOC is to walk a representative incident from detection to regulator. The timeline below is what a well-run FortiGuard SOC engagement looks like on a textbook ransomware-precursor case — credential theft, lateral movement attempt, attempted exfiltration. Times are illustrative but consistent with the service-level commitments these engagements carry.

The contrast with the unmanaged case is stark. Without a SOC, the LSASS alert sits on an EDR console nobody is watching. The first sign is the ransom note. The 6-hour clock has long since started, but nobody knows what to put in the report because nobody preserved the forensic state. The fine is the same regardless.

What gets logged, what gets retained, where it sits

180 days is the CERT-In Direction's minimum for ICT-system logs. Most regulated entities — and most audit programmes — require longer for case records and forensic evidence. The defaults above carry that without re-architecting at audit time.

Five use-cases the SOC handles on day one

What stays your responsibility, what the SOC takes

The boundary is deliberate. The SOC does the work that needs continuous attention and specialist tooling. You keep the decisions that need business context and legal accountability. Every action is logged in the cloud customer portal, both sides — auditable end-to-end.

A 30-day onboarding plan

An anonymised India engagement

FAQ

Related: ZTNA replacing VPN — what GlobalProtect, AnyConnect and FortiClient users need to know in 2026 · How FortiSASE shrinks your AWS / Azure cloud bill · Fortinet Partner India · Talk to Ogma