Managed Office for Global Capability Centre: The Parent-Company Security and Compliance Checklist

1. Perimeter and entry control

A parent’s first question is who can physically reach its people and systems. Ask how the operator verifies identity at each entry point, how access is granted and revoked, how after-hours entry works, and whether every entry is logged in a form the GCC can audit. Weak entry control undermines every other control on this list.

Evidence to request: Access control policy, entry-point list, sample audit log, after-hours process

What Synq.Work lists: 24/7 access and 24/7 security at the centres. The Synq.Work smart office page describes facial recognition as the primary entry method, replacing card and fingerprint systems, with a central admin console that lets a client add or remove people, issue temporary access and pull audit logs.

2. Visitor management and audit trail

Visitors are a common route into a secure site. Ask how visitors are pre-registered, how hosts are notified, how check-in is recorded and how long that record is kept. Then ask the question most reviewers miss: where the visitor data lives, and which third-party software, if any, sits in the chain.

Evidence to request: Visitor flow, data retention period, storage location, deletion and export terms

What Synq.Work lists: A visitor management and meeting room booking system built in-house, with visitor and booking data held first-party on Synq.Work’s own servers rather than with an outside software vendor.

3. CCTV and monitoring

CCTV matters when something goes wrong. Ask which areas the cameras cover, how many days of footage are kept, who can view it, and how the GCC requests footage after an incident. Because footage and logs are personal data, the retention period also feeds the data protection check below.

Evidence to request: Coverage plan, retention period, access rules for footage, incident request process

What Synq.Work lists: 24/7 security and CCTV surveillance are listed on the centre pages. Coverage plans and footage retention are not published, so confirm them during the review.

4. Server rooms, AV and secure areas

Network, AV and security equipment needs a locked, access-restricted room that is not shared with other tenants or with building maintenance. ISO/IEC 27001:2022 groups 14 physical controls under Annex A theme 7, including perimeters, physical entry, securing rooms, monitoring and working in secure areas, which gives reviewers a ready structure for site visits (DataGuard summary of Annex A theme 7).

Evidence to request: Rack and room access list, environmental controls (power, cooling, fire), clear desk rules

What Synq.Work lists: The MO-GCC page lists access control systems, server rooms and AV setup within the managed scope.

5. Network ownership and segregation

The GCC should know whose network its people are on. Ask whether the connection is dedicated or shared, whether the GCC can bring its own carrier, firewall or SD-WAN, and whether other tenants can ever share a network segment with the GCC. Shared Wi-Fi for core GCC systems is usually a red flag.

Evidence to request: Network diagram, carrier details, segregation approach, right to bring your own carrier or firewall

What Synq.Work lists: A high-speed leased line is listed at most centres (the WTC Delhi page lists high-speed WiFi instead), and the MO-GCC scope includes secure internet. Dedicated versus shared design and carrier diversity are for the review.

6. Connectivity and power resilience

A GCC runs shifts, customer processes and parent deadlines, so downtime is a business event. Ask about carrier redundancy, power backup, failover time and how the operator tests continuity. Ask for the site’s business continuity plan and the SLA remedies when it is not met.

Evidence to request: Redundancy design, power backup specification, SLA and failover test records

What Synq.Work lists: Power backup is listed at every centre. Redundancy design and failover records are for the review.

7. Logging and incident response

India’s CERT-In Directions, issued on 28 April 2022 and effective from 27 June 2022, require covered entities, which include body corporates, to report specified cyber incidents within 6 hours of noticing them, keep ICT system logs for a rolling 180 days and synchronise system clocks to NIC or NPL time sources (AZB & Partners summary). A GCC should therefore agree early which logs the workspace provider keeps for network and access systems, and how fast the provider will alert the GCC to an incident on its side.

Evidence to request: Log types and retention, time-sync approach, incident notification timeline and contact

What Synq.Work lists: IT support is listed at the centres. Log types, retention and the incident notification timeline are for the review.

8. Support access and the vendor chain

Most incidents involve people with legitimate access. Ask who holds administrative rights over the GCC’s systems and on-site equipment, how on-site staff are vetted, which tasks are subcontracted (security, housekeeping, IT support) and what confidentiality terms bind each subcontractor. A single accountable partner makes this chain easier to audit.

Evidence to request: Admin access list, staff vetting policy, subcontractor list, confidentiality undertakings

What Synq.Work lists: Design, build, IT and operations under one partner and one contract, as described on the MO-GCC page. Staff vetting and subcontractor lists are for the review.

9. Data protection readiness

India’s Digital Personal Data Protection Rules were notified on 13 November 2025 with a staggered start. The main obligations on data fiduciaries, including reasonable security safeguards, personal data breach notification and retention and erasure timelines, take effect on 12 May 2027 (AZB & Partners timeline). Under the Rules, a detailed breach notification to the Data Protection Board is due within 72 hours of becoming aware of a breach, and rule 8(3) requires certain personal data, traffic data and logs to be kept for at least one year (Khaitan & Co analysis). A workspace operator handles personal data of its own, in visitor records, access logs and CCTV footage, so ask how that data is processed, retained, deleted and reported on in a breach. Whether the GCC or the provider is the data fiduciary or processor depends on the structure, so take legal advice.

Evidence to request: Data map for visitor, access and CCTV data, retention schedule, breach notification process

What Synq.Work lists: In-house visitor data on Synq.Work’s own servers simplifies the data map. Retention schedules and breach notification terms are for the review.

10. Cross-border data transfers

If the parent is in the EU or EEA, personal data it sends to the GCC needs a lawful transfer mechanism. India holds no EU adequacy decision, so transfers need an Article 46 safeguard, usually Standard Contractual Clauses with a documented transfer impact assessment that addresses government access powers (Legiscope, July 2026). One supplementary measure parents consider is encryption with keys held outside India. The workspace should not undermine that design, so ask whether the provider has any access to GCC content and how support access is controlled.

Evidence to request: Encryption and key-control model, sub-processor list, support for transfer impact assessments

11. Building and statutory compliance

A secure workspace still has to be a lawful one. Ask for the fire safety and building approvals that apply to the premises, the landlord’s written consent to the managed arrangement, and records of evacuation drills. These documents are inexpensive to request and expensive to discover missing after go-live.

Evidence to request: Fire safety and building approvals, landlord consent, evacuation drill records

What Synq.Work lists: Fire safety is listed at every centre. The approval documents themselves are for the review.

12. Audit rights, SLAs, term and exit

Controls only count if the contract lets the GCC verify them. Look for a right to inspect the site and request evidence, service levels with remedies, clear notice and lock-in terms, and an exit plan that covers handover of the fit-out, return or deletion of visitor and access data, and transition support. Sign the security schedule with the commercial terms, not after them.

Evidence to request: Audit clause, SLA schedule with remedies, notice and lock-in terms, exit and data-return plan

What Synq.Work lists: One contract for design, build and operations under the MO-GCC model. Audit clauses and exit terms are negotiated per engagement (MO-GCC).