NBFCs are expected to maintain IT governance, information security and cyber resilience proportionate to their size and layer under RBI's scale-based regulation.
We audit your IT environment against the applicable RBI directions, test your systems technically, and give you a practical plan to close gaps before supervisory review.
Objectives
- Assess IT governance, policies and IT risk management
- Evaluate cyber security controls and incident response
- Test critical applications and infrastructure
- Review IT outsourcing arrangements
Methodology
01
Planning
- Define scope, applicable requirements and critical systems
- Agree audit plan, sampling approach and timelines
02
Fieldwork
- Review of policies, procedures and governance
- Testing of technical and operational controls
- Interviews with process owners and evidence verification
03
Technical testing
- Vulnerability assessment and penetration testing where in scope
- Configuration review of servers, databases and network devices
04
Reporting
- Observations rated by risk with recommendations
- Management responses and follow-up review
Deliverables
Audit plan and scope
Audit report with risk-rated observations
VAPT report where in scope
Remediation plan and follow-up review