SECURITY · MFA · GCC INDIA · COMPLIANCE

GCC Security Teams Are Mandating MFA. Are Your Vendors Ready? 

GCC MFA compliance is now a vendor selection criterion, not an internal IT project. Global headquarters are requiring it from Indian GCC partners, most of whom are not yet fully compliant. Here is what the mandate covers, why it is accelerating, and how to close the gap before the next audit. 

Proactive Data Systems Security Practice  |  Cisco Preferred Security Partner, India  |  Last reviewed: May 2026 

GCC mandate observations and compliance gap data verified against Proactive Data Systems client engagements, Bangalore, Hyderabad, Pune, and Chennai, 2024-2026.

Up Front 

• GCC headquarters in the US, UK, and Europe are adding MFA to standard vendor security questionnaires. For Indian GCC teams in Bangalore, Hyderabad, and Pune, this is no longer a future requirement. It is a current audit item. 
• The mandate is not just about logging in with a second factor. It covers privileged access, remote access, VPN authentication, and in many cases, application-level access controls for any system that touches client data. 
• Cisco Duo is the MFA platform most frequently specified by name in GCC security policies -- because it is what most global HQs already run. Deploying Duo closes the compliance gap and eliminates a separate vendor conversation. 
• A GCC vendor that cannot confirm MFA compliance in a security questionnaire risks losing preferred vendor status. This is already happening in Bangalore and Hyderabad. The window to act before the next review cycle is short.

The Phone Call Every GCC IT Head in Bangalore Is Getting Right Now 

It starts with a vendor compliance questionnaire. Twelve to twenty pages, sent from a security team in London, New York, or Tokyo to their Indian GCC partner. The questions are standard: endpoint management, network segmentation, data handling, access controls. 

Then there is Question 14. Or Question 9. Or Section 3, Item 2. The exact position varies. The question does not confirm that multi-factor authentication is enforced for all users accessing corporate systems, VPN, and applications handling client data. 

The GCC IT team in Whitefield, HITEC City or Hinjewadi looks at the question. Looks at their setup. Calls their security vendor. And discovers that 'we use passwords and a VPN client' is not the answer that keeps the contract. 

This is not a hypothetical. It is the most common conversation Proactive Data Systems is having with GCC IT teams in Bangalore, Hyderabad, and Pune in 2025 and 2026. (Proactive Data Systems field observation, GCC security engagements, India, 2024-2026.) 

Why It Is Happening Now, Not Two Years Ago 

The pressure comes from three directions arriving at the same time. 

Global CISO mandates. After a wave of supply chain attacks targeting outsourced IT operations -- several of which originated in Indian delivery centres used by US and European financial services firms, global security teams tightened vendor requirements. MFA moved from recommended to required on most global enterprise security frameworks between 2022 and 2024. The Indian GCC partners are the last link in that chain to be formally audited. BFSI GCCs in Chennai and Bangalore, where Standard Chartered, DBS, and multiple US investment banks operate large delivery centres, are among the first to receive formal compliance mandates from global HQs. 

India's DPDP Act. The Digital Personal Data Protection Act, enacted in 2023, creates legal liability for organisations that fail to protect personal data. MFA is not explicitly named in the Act, but it is the single most effective technical control for preventing unauthorised access to systems holding personal data. Legal teams at GCC operators are now treating MFA deployment as a compliance risk item, not just a security best practice. 

Cyber insurance requirements. Major cyber insurers, including Lloyd's of London syndicates, AIG, and Beazley, began requiring MFA as a policy condition for coverage renewals from 2022 onwards. Organisations that cannot confirm MFA enforcement for remote access and privileged accounts face coverage exclusions or premium loadings. Indian GCC operations that fall under their parent company's global cyber insurance policy are now discovering that the policy conditions travel with the coverage. Non-compliance does not just fail an audit. It creates an uninsured exposure. (Proactive Data Systems GCC engagement observation, 2024-2026; Lloyd's of London cyber underwriting guidelines, publicly available.)

What the questionnaire actually asks 

Most GCC vendor security audits now cover five MFA-related items: (1) Is MFA enforced for all remote access and VPN? (2) Is MFA enforced for privileged accounts and administrator access? (3) Is MFA enforced for access to systems holding client data? (4) Are MFA logs retained and auditable? (5) What is the MFA platform in use, and is it centrally managed? A 'partially deployed' or 'in progress' answer to any of these is a risk flag in most audit frameworks.

What Most Indian GCC Vendors Actually Have -- and Where the Gap Is 

The honest picture, based on Proactive assessments of GCC environments in Bangalore and Hyderabad: most have MFA deployed for some users, on some systems, in some contexts. Almost none have it fully deployed across all the areas the questionnaire covers. 

Across GCC environments assessed by Proactive Data Systems in Bangalore and Hyderabad, privileged administrator access and developer access to production systems are the two areas most consistently uncovered by MFA -- and the two areas auditors check most carefully after confirming VPN protection. (Proactive Data Systems GCC security assessments, 2024-2026.)

Based on Proactive Data Systems GCC security assessments, Bangalore and Hyderabad, 2024-2026.

The gap is never where IT teams think it is. It is not VPN. It is developer access to production systems and on-premises applications that were built before MFA was on anyone's radar. 

Why Cisco Duo Is the Platform Most GCC HQs Are Specifying 

When a GCC security questionnaire specifies an MFA platform by name -- which a growing number now do -- it is almost always Cisco Duo. The reason is straightforward: most global HQs already run Duo for their own workforce, and they want vendor MFA to be auditable from the same management console. 

For Indian GCC vendors, this has a practical implication. Deploying Duo does not just close the compliance gap. It eliminates the conversation about whether the MFA platform meets the parent company's standards, because it is the parent company's standard. 

Cisco Duo integrates with Active Directory, Azure AD, Okta, and most RADIUS-based systems without a rip-and-replace of existing infrastructure. A 500-person GCC operation in Bangalore can be fully deployed in 30 days with no impact to end-user productivity on day one -- because Duo supports a phased rollout that starts with the highest-risk access scenarios and expands from there. 

The 30-Day Path to Compliance 

Most GCC IT teams approach MFA deployment make it harder than it needs to be. The right approach is not a full identity infrastructure overhaul. It is a phased deployment that closes the audit gaps in priority order.

At the end of week four, a GCC vendor can answer every MFA item on a standard security questionnaire with a yes, a platform name (Cisco Duo), and an audit log reference. That is what closes the compliance gap. 

What an Audit-Ready MFA Policy Actually Looks Like 

Deploying MFA and being audit-ready for MFA are not the same thing. Auditors from global HQ security teams -- and increasingly from third-party audit firms hired by GCC clients -- check four specific items beyond whether Duo is installed. 

Cisco Duo generates audit logs in a format most GCC compliance frameworks accept directly. The Duo Admin Panel exports authentication reports that satisfy all four checklist items above. For GCC vendors in Chennai and Bangalore preparing for a BFSI client audit, this is the documentation stack that ends the conversation quickly. 

Source: Cisco Duo documentation (duo.com); India DPDP Act, 2023 (meity.gov.in); GCC security mandate observations: Proactive Data Systems, GCC security engagements, Bangalore, Hyderabad, Pune, 2024-2026.