Insolvency's Cybersecurity Blind Spot: How CIRP Creates Critical GRC Gaps

A silent crisis is unfolding within India's corporate insolvency framework, one that cybersecurity and compliance professionals can no longer afford to ignore. The Corporate Insolvency Resolution Process (CIRP), designed to rescue financially distressed companies, is inadvertently creating massive blind spots in cybersecurity governance, data protection, and regulatory compliance. Recent cases involving companies like Baron Infotech Limited, JCT Limited, and Tijaria Polypipes Limited reveal a systemic pattern where critical security functions are deprioritized or completely overlooked during the transition to resolution professionals and creditors' committees.

The Governance Vacuum: When Oversight Shifts

Under the Insolvency and Bankruptcy Code (IBC), once a company enters CIRP, the board of directors is suspended, and control transfers to an Insolvency Resolution Professional (IRP). This IRP, often a chartered accountant or lawyer, is tasked with preserving the company's value, managing operations, and facilitating a resolution plan for creditors. Their mandate is overwhelmingly financial. Cybersecurity, unless it directly impacts asset valuation, rarely features as a priority. As seen with Baron Infotech's corporate office lease agreement under CIRP, operational decisions are made to maintain business continuity, but the security implications of new premises, network setups, and data access for new personnel are seldom part of the due diligence.

Similarly, JCT Limited's tenth Committee of Creditors (CoC) meeting exemplifies the focus. Creditors, primarily concerned with recovering their dues, review financial viability and resolution plans. Cybersecurity risks—like the integrity of IT systems holding financial data, the security of intellectual property being valued, or compliance with data protection laws—are not standard agenda items. This creates a governance vacuum where no single entity is accountable for the cybersecurity posture of a company holding potentially vast amounts of sensitive corporate and customer data.

The Technical Debt and Compliance Time Bomb

The CIRP period, which can extend for months or even years as seen with Tijaria Polypipes' NCLT hearing scheduled for 2026, is a period of extreme vulnerability. Key technical risks emerge:

1. Stagnant Security Posture: Security tools and software licenses often come up for renewal during CIRP. With frozen accounts and spending under creditor scrutiny, these essential renewals for firewalls, endpoint protection, and threat intelligence feeds may be deferred or denied, leaving systems exposed to known vulnerabilities.
2. Knowledge Drain and Access Chaos: The departure of the original IT and security teams leads to a critical loss of institutional knowledge about system architecture, security configurations, and incident response plans. The IRP may grant system access to various advisors (legal, financial, operational) without proper access controls or monitoring, exponentially increasing the attack surface.
3. Data Asset Fragmentation and Loss: The process of identifying and valuing assets for resolution can lead to data being copied, transferred, or accessed on insecure devices. Sensitive datasets—customer PII, financial records, trade secrets—may be handled by parties without adequate data security protocols, risking breach and non-compliance with regulations like India's upcoming Digital Personal Data Protection Act (DPDPA).
4. Third-Party Risk Amplification: As seen in cases where assets are leased or operations are maintained, new third-party vendors enter the ecosystem. Their security posture is rarely vetted to the standard required pre-insolvency, creating new supply chain vulnerabilities.

The High-Impact Consequences

The impact of these blind spots is not theoretical; it is high and multifaceted. A cybersecurity incident during CIRP can:

• Destroy Enterprise Value: A data breach or ransomware attack can decimate the remaining value of the company, making it unattractive to potential resolution applicants and harming creditor recovery.
• Trigger Regulatory and Legal Liability: Non-compliance with data protection, sectoral regulations (like RBI guidelines for financial data), or mandatory breach disclosure laws can result in significant penalties, which become claims against the already distressed estate.
• Erode Stakeholder Trust: Breaches affecting customer or employee data can lead to class-action lawsuits and irreparable reputational damage, complicating any future revival of the business.

A Call for Integrated Cyber-GRC in Insolvency Frameworks

Addressing this black hole requires a paradigm shift. The cybersecurity community, legal professionals, and regulators must collaborate to embed cyber-GRC (Governance, Risk, and Compliance) into the insolvency resolution fabric. Concrete steps include:

• Regulatory Mandates: The Insolvency and Bankruptcy Board of India (IBBI) should issue guidelines making cybersecurity due diligence and maintenance of a minimum security baseline a mandatory duty of the IRP.
• Creditor Committee Education: Cybersecurity risks must be framed as direct financial risks to recovery. Creditors should demand cyber-risk assessments as part of resolution plan evaluations.
• IRP Training and Panels: IRP training programs must incorporate cybersecurity fundamentals. Furthermore, panels of certified cybersecurity professionals could be appointed to advise IRPs in complex cases, similar to the appointment of valuers.
• Standardized Protocols: Developing standardized checklists for IRPs covering system access review, license renewal, data inventory and classification, and vendor security assessments during CIRP.

The cases of Baron Infotech, JCT, and Tijaria Polypipes are not isolated incidents; they are early indicators of a systemic risk. As economic cycles continue, more companies will enter resolution processes. Proactively closing this cybersecurity blind spot is not just about protecting data—it's about preserving the integrity and success of the corporate rescue mechanism itself. The time for action is now, before a major breach turns a corporate rescue into a corporate catastrophe.