Cybersecurity is no longer a back-office concern for Indian businesses. From managed security operations centres (SOCs) and penetration testing to vulnerability assessments, threat monitoring, and incident response, demand for these services is rising sharply. If you provide or purchase cybersecurity services, you need clarity on how Goods and Services Tax (GST) applies. This 2026 guide explains the GST rate, the correct SAC codes, registration thresholds, export treatment, reverse charge on foreign tools, and how input tax credit works.<\/p>\n
Cybersecurity services are treated as information technology (IT) services under GST and attract a standard rate of 18% GST<\/strong> (either 9% CGST + 9% SGST for intra-state supplies, or 18% IGST for inter-state supplies and exports). There is no concessional rate and no composition scheme for this sector.<\/p>\n Whether you sell managed detection and response, security audits, SOC-as-a-service, penetration testing, or security consulting, the applicable rate is the same 18%.<\/p>\n Cybersecurity services are classified under Heading 9983 (other professional, technical & business services). The two codes most relevant to security work are:<\/p>\n Related IT codes you may also use depending on the exact scope include SAC 998314 (IT design and development, e.g. building security tools) and SAC 998315 (hosting and cloud infrastructure). All of these carry the same 18% rate, so classification mainly affects reporting accuracy rather than the tax payable.<\/p>\n Registration is not always optional. You must obtain GST registration if any of the following apply:<\/p>\n Even below the threshold, many cybersecurity providers register voluntarily so they can pass on input tax credit to business clients and claim refunds on exports.<\/p>\n Indian security firms frequently serve overseas clients. Where the service qualifies as an export of services<\/strong> — broadly, the supplier is in India, the recipient is outside India, the place of supply is outside India, and payment is received in convertible foreign exchange (or INR where permitted by RBI) — the supply is zero-rated<\/strong>.<\/p>\n You can export in one of two ways:<\/p>\n The LUT route is generally preferred because it avoids blocking working capital. An LUT is filed at the start of each financial year.<\/p>\n If your cybersecurity offering is delivered as an automated, largely no-human-intervention online product — for example, a self-service SaaS security scanner, an automated threat-intelligence feed, or an online vulnerability-scanning subscription — it may fall within OIDAR<\/strong> (Online Information and Database Access or Retrieval) services.<\/p>\n OIDAR classification matters mainly for cross-border supplies to non-business (B2C) customers. A foreign provider supplying automated security services to Indian consumers is required to register and pay GST in India. Conversely, where the service involves meaningful human effort — a consultant running a manual penetration test or an analyst investigating an incident — it is a normal service, not OIDAR.<\/p>\n Most cybersecurity teams rely on foreign tools and platforms — cloud security suites, SIEM subscriptions, threat-intel feeds, and code-scanning services billed from outside India. When an Indian business (B2B) imports such services, GST is payable by the recipient under the Reverse Charge Mechanism (RCM)<\/strong>.<\/p>\n In practice this means:<\/p>\n Being liable under RCM triggers a registration obligation even if your turnover is below the threshold, so factor this in before subscribing to overseas platforms.<\/p>\n A registered cybersecurity provider can claim ITC on GST paid on genuine business inputs — office rent, hardware and lab equipment, internet and cloud costs, software licences, subcontractor invoices, and professional fees. Valid ITC reduces the effective tax burden well below the headline 18%.<\/p>\n To claim ITC you need a valid tax invoice, the supplier must have reported the supply, the invoice must appear in your GSTR-2B, and the input must be used for business (not blocked-credit) purposes. Keep clean records to avoid mismatches.<\/p>\n A compliant tax invoice for cybersecurity services should include:<\/p>\n For exports under LUT, mark the invoice “Supply meant for export under LUT without payment of IGST”.<\/p>\nCorrect SAC codes for cybersecurity services<\/h2>\n
\n
Who must register for GST?<\/h2>\n
\n
Export of cybersecurity services: zero-rated with LUT<\/h2>\n
\n
OIDAR nuance where the service is automated<\/h2>\n
Reverse charge on services imported from foreign vendors<\/h2>\n
\n
Input tax credit (ITC)<\/h2>\n
Invoicing requirements<\/h2>\n
\n
\n Field<\/th>\n Requirement<\/th>\n<\/tr>\n \n Supplier details<\/td>\n Name, address, and GSTIN<\/td>\n<\/tr>\n \n Invoice number & date<\/td>\n Unique serial number and issue date<\/td>\n<\/tr>\n \n Recipient details<\/td>\n Name, address, GSTIN (if registered)<\/td>\n<\/tr>\n \n SAC code<\/td>\n 998313 \/ 998316 (as applicable)<\/td>\n<\/tr>\n \n Taxable value<\/td>\n Value of service before tax<\/td>\n<\/tr>\n \n GST rate & amount<\/td>\n 18% split as CGST+SGST or IGST<\/td>\n<\/tr>\n \n Place of supply<\/td>\n Especially important for inter-state and export supplies<\/td>\n<\/tr>\n<\/table>\n