Our role: Where a regulation requires the final audit report to come from a CERT-In empanelled auditor, Rakvora delivers pre-audit assessment, VAPT and remediation support ahead of that audit. See the individual audit pages for our role in each.
Banks, NBFCs, payment companies, stockbrokers, depositories and insurers in India must meet detailed cyber security requirements from their regulators — and evidence them through periodic audits.
We assess your controls against the applicable regulatory framework, test your systems technically, and give you a clear, prioritised plan to close gaps before your regulator or statutory auditor does.
Objectives
- Evaluate the effectiveness of cyber security controls
- Assess compliance with RBI, SEBI CSCRF or IRDAI guidelines as applicable
- Identify vulnerabilities through technical testing
- Identify gaps and non-compliances and recommend remediation
Methodology
01
Planning
- Define audit scope and the applicable regulatory framework
- Identify critical systems, applications and data
02
Assessment
- Review of policies, procedures and governance
- Risk assessment of critical systems
- Server, database, network and application security assessment
03
Testing
- Vulnerability assessment and penetration testing
- Verification of controls against regulatory requirements
04
Reporting
- Compliance findings mapped to each requirement
- Prioritised remediation plan and presentation to stakeholders
Deliverables
Audit plan and scope
Risk assessment report
Compliance assessment report
VAPT report
Remediation plan