Security duties continue after adoption
For company statutory records kept electronically within the applicable framework, Rule 28 prescribes maintenance and security duties. The responsible person is the managing director, company secretary or another director or officer as the Board may decide. Outsourcing storage is not evidence that these duties have been fulfilled. Notified Companies (Management and Administration) Rules: Rule 28.
Check current adoption language separately
Current Rule 27 uses permissive language for its specified company population after the 24 July 2014 amendment. Older compilations can show the superseded mandatory wording. This article addresses security after electronic adoption; it does not instruct every company to migrate every paper record. Apply other record-specific provisions independently.
Authenticate daily backups and validate systems
Rule 28(2)(i) requires at least one backup of updated records at periodicity not exceeding one day. Every backup must be authenticated, dated and securely kept at places decided by the Board. Retain run dates and covered-record inventories. The rule also addresses system validation, unauthorised access, alteration, invalid-record detection, loss prevention and reproducibility. A PDF extension alone does not establish a non-rewritable, non-erasable implementation.
Test full records and authorised access
Limit access to the specified personnel or persons doing company work as authorised by the Board. Reproductions of paper records must be complete, authentic, true and legible on retrieval. Check annexures, signatures and indexing, while preserving confidentiality. Restore tests are practical evidence for loss prevention and retrieval duties; no universal testing frequency, capacity or sample tolerance is prescribed here. The examples are internal controls, not new statutory retention periods.
Applicable primary references
Notified Companies (Management and Administration) Rules: Rule 28 ICSI current Rule 27 and adoption-language amendment
Six worked illustrations
All facts and amounts below are fictional. Assumptions describe the model, not additional statutory rules.
Illustrative example 1: Backup interval
Assume a 20:00 backup on consecutive dates: 24 hours apart. A missed run followed by the next day’s 20:00 run leaves 48 hours. This tests the chosen elapsed-time schedule.
Illustrative example 2: Access list
Of twelve active accounts, nine have evidenced authority. Three need investigation. The 75% authorised measure is not a legal tolerance.
Illustrative example 3: Restoration inventory
A manifest has 240 records but recovery produces 237. Three are missing. Recovery of 98.75% does not establish complete restoration.
Illustrative example 4: Page completeness
An original has eighty pages including annexures; the scan has seventy-six. Four pages need explanation or recovery, even if the first page is legible.
Illustrative example 5: Capacity model
Assume 2 GB per daily backup and an internal seven-copy rotation: baseline storage is 14 GB before overhead and redundancy. Seven days is not a statutory retention period.
Illustrative example 6: Index coverage
135 of 150 required references retrieve the correct files. Fifteen require correction; 90% retrieval coverage does not establish a complete repository.
Ten-step verification table
| Step | Action | Evidence |
|---|---|---|
| 1 | Confirm scope | Records and governing provisions. |
| 2 | Identify officer | Board decision where applicable. |
| 3 | Inventory versions | Signed originals and attachments. |
| 4 | Restrict access | Authority for every account. |
| 5 | Validate alteration controls | Actual format and system behaviour. |
| 6 | Schedule daily backup | Updated-record coverage and timestamps. |
| 7 | Authenticate backups | Dated authentication. |
| 8 | Test restoration | Complete readable output. |
| 9 | Verify index | Specific files and annexures. |
| 10 | Close deficiencies | Remediation and validation evidence. |
Sixteen practitioner FAQs
1. Does Rule 28 mandate universal digitisation?
Establish scope under the relevant provisions first.
2. Who is responsible?
The managing director, company secretary or another director or officer as the Board may decide.
3. Does cloud storage prove compliance?
No. Validate the implemented controls.
4. What backup periodicity is specified?
Not exceeding one day.
5. Must every backup be dated?
Yes, and authenticated.
6. Who decides secure backup locations?
The Board under sub-rule (2)(i).
7. Is a PDF filename conclusive?
No. Validate protection against alteration and tampering.
8. Are software and hardware controls relevant?
Yes. Security and validation are specified.
9. Must altered records be detectable?
The rule calls for systems that discern invalid and altered records.
10. Can all staff have unrestricted access?
Access must correspond to the specified persons and Board-authorised company work.
11. What must paper reproductions preserve?
Completeness, authenticity, truth and legibility.
12. Why inspect annexures?
The main file can open while required pages remain missing.
13. Is one restore-test frequency mandated here?
No universal frequency is asserted.
14. Does a seven-copy rotation allow deleting statutory history?
No. Apply actual preservation duties separately.
15. Is 98.75% recovery automatically sufficient?
Not where required records remain missing.
16. What should the closing file contain?
Accountability, inventory, access authority, dated backups and resolved retrieval exceptions.
Conclusion
Test authenticated daily backups, authorised access, resistance to alteration and readable retrieval of company electronic statutory records under Rule 28.