Zero Trust in Indian business: What SMEs can learn from the IT world
How to ensure that information from your Indian subsidiary reaches you unfiltered.
The compliance measures in your Indian subsidiary are in place: Audit trails, data protection guidelines, employment contracts. But the crucial question is a different one: As the parent company, do you have direct access to this information? Or do you have to rely on someone on site to send you a report?
This question was the focus of our webinar “Zero Trust in Indian Business” on February 24, 2026. In this article, we summarize what we discussed there, which simple IT tools guarantee you sovereignty over important information, and supplement it with background information that had no place in the 45-minute format.
1. why zero trust is not an IT issue
Zero Trust originates from IT security. The principle: do not trust any system automatically, verify every access. Google introduced it in 2009 under the name BeyondCorp, and NIST standardized it as a reference architecture in Special Publication 800-207 in 2020.
But the core of Zero Trust is not a technical concept. It is a control principle:
- Independence from individuals: Building systems so that they work regardless of who quits, falls ill or withholds information.
- Verification instead of trust: Do not assume that information comes automatically. Ensure direct access.
- Least privilege: Knowing who has access to what and why. Rights that are not required are withdrawn.
For German SMEs with subsidiaries in India, this means that enterprise concepts such as NIST Zero Trust or ISO 27001 do not have to be implemented 1:1. But the principles behind them can be transferred to your own organization, pragmatically and cost-efficiently.
2 The cultural dimension: Why control is expected in India
In India, European hesitation when it comes to checks is not seen as trust, but as disinterest. If you don’t ask, you are signaling: “I don’t care.”
This is not a provocation, but a cultural reality that we experience every day at WB across seven locations and 110+ employees:
- Control has different connotations: In Europe often negative (mistrust), in India normal and expected (interest).
- Error culture: Problems are covered up rather than escalated. Loss of face weighs heavily. Bad news comes too late or not at all.
- Political answers: Yes does not always mean “yes”. “No problem” does not mean that there is no problem.
- “Everything is running smoothly” is often a warning signal: our experience shows that Undesirable developments rarely occur suddenly. They almost always follow the same pattern.
Framing is crucial: If you explain to your team why you are introducing certain guard rails and how they work, control is not perceived as mistrust, but as a professional standard.
3. three situations you may be familiar with
Situation 1: The accountant who knows everything
One person administers TallyPrime (an ERP system) alone. Only they know passwords and processes. Reports arrive filtered. At WB, the reality was as follows: Tally exports were created manually and sent to Germany by e-mail. It was not possible to check whether the data was complete, unchanged or up-to-date.
Immediate measures: Set up second admin access at the head office. Introduce a password manager. Retrieve account statements directly from the bank, not via the accountant. Long-term: TallyPrime server with edit logs and dual authorization for transactions above a certain threshold.
Situation 2: The sales subsidiary and the CRM blind spot
Shadow IT arises almost automatically in sales subsidiaries. Sales employees export customer data from the CRM to local Excel files and save them on private devices. Discounts are granted ad hoc, without documented approval.
What happened at a WB customer: An employee exported a customer database from the CRM with all customers of a federal state, saved it as Excel and edited it locally. The computer was later no longer available. Neither was the customer data.
Countermeasure: CRM centralized in M365/SharePoint. Access only via security groups (RBAC). On exit: immediate withdrawal. Discount release from threshold value only with HQ approval, automated with audit trail.
Situation 3: The sudden change of personnel
Key person resigns, often without notice. No replacement, no documentation. Passwords, contacts, process knowledge: gone. After one such incident at a customer, we discovered via the M365 audit logs that an employee had tried to access SharePoint data for months after leaving the company. The cookies were still saved.
Key person risk is the biggest single risk in Indian business. Personal independence is not an option, it is a must.
4 BLUME: Five levers for operational control
BLUME is not a theoretical framework. It is five levers that you can basically touch immediately:
| Lever | Principle | Example |
|---|---|---|
| B – Ban | Prevent dangerous actions | Block cloud storage, block apps, deactivate CRM exports |
| L – Limit | Limit rights and installments | Dual-Auth from threshold value, Least Privilege, max. document views/hour |
| U – Usage | Tying use to conditions | Conditional Access: Role + device + MFA + region |
| M – Monitor | Monitor | Audit logs (Purview/Grafana), automatic alerts for unusual behavior |
| E – Enforce | Enforce | Automatic policies + regular management reviews |
Many of these controls can be implemented with existing Microsoft 365 licenses. Power Automate is included in every M365 business license. You do not need an enterprise budget.
5 Management as Code: Your organization as a declaration
This is where things get exciting for anyone familiar with the Infrastructure as Code principle from software development. The basic idea: instead of configuring infrastructure manually (setting up servers, setting firewalls, setting up access), you describe the desired state in a machine-readable document. The system then creates this state automatically.
Example from the IT world: A DevOps team describes in a YAML file that the web server should have three instances, listen on port 443 and only be accessible from the internal network. Terraform or Ansible read this file and configure the infrastructure automatically. If something changes, you change the file, not the server.
Transferred to your organization: You describe your organizational structure, roles and access rights once centrally. Changes are versioned and each adjustment leaves an audit trail. Access rights, approval processes and reporting structures are automatically derived from this central source.
| You declare | This automatically results in |
|---|---|
| Locations (Delhi, Munich) | Location-based policies |
| Roles (Controller, Sales) | Role-based access rights (RBAC) |
| Persons (role + location) | Assignment to security groups |
| Software licenses | Automatic provisioning |
| Groups (Finance IN, Sales DE) | Inherited rights in Entra/SharePoint |
The advantage for SMEs: when an employee leaves the company, their access is automatically deactivated, not just when someone thinks about it. When a new employee starts, they are given exactly the rights that their role requires. And if you want to know who currently has access to which systems, look at your central authorization matrix, don’t ask your local IT manager.
Large corporations use platforms such as Okta, SailPoint or CyberArk for this. For SMEs, Microsoft Entra ID with Security Groups and Conditional Access is often sufficient. The principle is the same, the depth of tooling differs.
6. what Infrastructure as Code has to do with your India subsidiary
Why is this analogy relevant? Because it solves the central problem that many SMEs with international subsidiaries have: Knowledge that is in people’s heads instead of in systems.
In software development, Infrastructure as Code (IaC) has solved a similar problem. In the past, only one system administrator knew how the server was configured. If he resigned, the knowledge was gone. IaC has changed that: The status is declared, versioned and can be reproduced at any time, independent of individual persons.
The parallels with the Indian business are obvious:
| IT world (IaC) | Your organizations |
|---|---|
| Server configuration in code | Roles and rights in central system |
| Only the admin knows what is configured | Only the local accountant knows who has access |
| Changes are versioned (Git) | Changes are documented in the audit trail |
| Status can be reproduced at any time | Onboarding/offboarding runs automatically |
| No single point of failure | No key person risk |
This is not a dream of the future. Platforms such as Drata, Vanta or Kertos are already automating compliance verification for standards such as SOC 2 or ISO 27001. For manufacturing SMEs, these are often overkill, but the mindset is the same: declare instead of improvise.
7. what we have actually done at WB
ERP migration: from flying blind to direct access
Financial data was only stored locally and only one user had access. We migrated the TallyPrime server, activated edit logs and introduced a rights concept with dual authorization. The result: HQ has direct access at all times without having to ask anyone.
Code-of-conduct testing: the 37.7 percent gap
In October 2025, we carried out a comparison: 106 licensed M365 users against the Code of Conduct signatures. Result: 40 out of 106 users had not signed the Code of Conduct, including department heads and the Managing Director India. This was only discovered because active checks were carried out. No one on site had reported it.
Audit forensics: logs as evidence
There was suspicion of data leakage at one customer. By forensically processing the M365 audit logs, we were able to create a complete chain of evidence that supported a criminal complaint in two countries. The data was only available because the systems had been configured correctly beforehand.
Discount release: governance as a productivity gain
Discount approvals used to be done by email, unstructured, without an audit trail. With a Power Automate workflow, the process now takes three hours instead of three days. Discounts of less than 5 percent are approved automatically. Above that, it goes to the country manager. From 15 percent to HQ. Everything is logged, everything is traceable.
8 Where do you stand? From the sales office to the software company
The need for protection depends on your complexity. Not everyone needs everything, but everyone needs the basics:
| Low: Sales Office | Means: Production | High: Software | |
|---|---|---|---|
| Typical | Pure M365 + cloud CRM, no local server | Manufacturing, TallyPrime, ERP local, OT network | SaaS product, code repos, SOC 2 required |
| Governance | Entra ID + Cond. Access, MFA, DLP on SharePoint | Legacy connection (tailscale), network segmentation | Drata/Vanta, code review policies, monitoring |
| Expenditure | Low: M365 on-board funds | Medium: Legacy needs integration | Higher: scalable through automation |
BLUME and Management as Code apply to all three levels. The difference lies in the depth of tooling, not in the principle.
9. typical obstacles and how to overcome them
| Obstacle | Countermeasure |
|---|---|
| That comes across as mistrust | Standard: Control is expected in India. Framing decides. |
| Resistance on the ground | Step by step, quick wins, involve the team. Provide alternatives. |
| Legacy not connectable | Tailscale/Cloudflare + Cloud IAM. Old systems can also be protected. |
| Too expensive or too complex | Power Automate is included in M365. Automation reduces costs. |
| Shadow IT due to lack of alternatives | Approved tools with inherited rights. If you don’t offer alternatives, you shouldn’t be surprised about shadow IT. |
10. three questions you should answer this week
1. is your HQ the single point of truth?
Are rights declared centrally? Test: Request the authorization matrix. If it is not available within a week, this is already important information.
2. do all five BLUME levers engage?
Ban, Limit, Usage, Monitor, Enforce. Go through each letter. Where do you have gaps?
3. where do you stand on the complexity spectrum?
Cloud-only, production or software? This determines which tools you need and which you probably already have.
Your three next steps
- This week: Check your direct system access. Can you access your India unit’s financial data today without asking anyone?
- This month: Carry out a BLUME check and automate a process, for example discount approval.
- This quarter: Create an authorization matrix and determine your complexity level. This will become your governance roadmap.
Free India Governance Health Check
If you have noticed that you are unsure about the questions: That’s normal. We offer a free 30-minute initial consultation, honest feedback and specific recommendations.
Contact: Felix Giessmann | giessmann@wamser-batra.de
Sources and further links
- NIST SP 800-207: Zero Trust Architecture (2020)
- Microsoft Learn: Zero Trust security in Azure
- Google BeyondCorp: A New Approach to Enterprise Security (2014)
- CISA Zero Trust Maturity Model v2.0 (2023)
- ISO/IEC 27001:2022 – Information security management systems
- HashiCorp: Infrastructure as Code in 4 Flavors (terraform.io)
This article is based on the WBinar “Zero Trust in Indian Business” from February 24, 2026. Felix Giessmann is Project Manager Digital Processes & IT at Dr. Wamser + Batra GmbH. He coordinates IT topics across seven locations in India and translates enterprise frameworks into SME-compatible solutions.
