Business
Inspections now test security controls. Be ready before the letter arrives.
The RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, the RBI cyber security framework for NBFCs, SEBI's Cybersecurity and Cyber Resilience Framework and the IRDAI guidelines each set out specific controls, governance structures, reporting timelines and audit requirements. We translate the applicable framework into a control-by-control position for your organisation, close the gaps and build the evidence inspectors ask for.
- Control-by-control mapping to the framework that applies to your licence and size
- Board and committee governance set up the way the direction describes, without ceremony
- Incident reporting timelines (RBI six hours, SEBI and CERT-In) built into one process
- Returns, audit reports and evidence organised for inspection
Fixed price for the framework gap assessment; remediation support and periodic compliance on a retainer scoped after it.
Typical engagement
- Applicability review
- Gap assessment
- Remediation
- Sustain
Who this is for
- NBFCs at every tier, including those newly brought under the IT Governance direction
- Fintechs, payment aggregators, prepaid instrument issuers and lending service providers
- Stock brokers, depository participants, investment advisers and other SEBI-regulated intermediaries
- Insurers, insurance intermediaries and TPAs under IRDAI guidelines
- Technology partners and outsourced service providers to regulated entities, facing pass-through requirements
- Entities that have received inspection observations and need a remediation plan
What is included
Applicability and gap assessment
Which direction, framework or guideline applies to you and at what tier, then a control-by-control assessment with gaps rated by inspection risk and effort.
Governance
IT strategy committee, information security committee, CISO role, board reporting and policy hierarchy as the framework describes, sized for your organisation and documented so it is actually operated.
Technical controls
Access management, network segmentation, patching, logging and monitoring, data protection, application security and VAPT cadence, specified against the framework's requirements and verified.
Incident and reporting process
One incident process that meets the RBI six-hour reporting expectation, SEBI reporting and CERT-In directions, with templates and roles.
Third-party and outsourcing
Outsourcing policy, vendor risk assessments and contract clauses that meet the direction on outsourcing of IT services.
Audit and inspection readiness
Information system audit scoping, remediation tracking for audit and inspection observations, and an evidence file arranged in the order inspectors ask.
How we work
Applicability review
Licence, scale and activities reviewed to settle which framework and which tier applies, with a written note.
Gap assessment
Interviews, document review and technical checks against each control, with a report and plan presented to management or the board.
Remediation
Policies, governance and technical changes implemented by your team with our support, each closed with evidence.
Sustain
Periodic reviews, returns and audit coordination on a retainer, or a handover to your own team.
What you walk away with
- A documented position against every applicable control, with evidence
- Governance that satisfies the direction and is light enough to keep running
- One incident process that meets all the regulators and CERT-In
- Fewer and smaller inspection observations, and a plan for the ones that remain
What we do not do
We would rather lose an enquiry than mislead you.
- We do not provide legal opinions on applicability where the regulation is ambiguous; we document a reasoned position for your counsel and compliance officer
- We do not conduct the statutory information system audit where independence rules require a separate firm; we prepare you for it
- We do not guarantee an inspection outcome
Frequently asked questions
We are a small NBFC. Does the full IT Governance direction apply to us?
The RBI Master Direction on IT Governance applies to NBFCs in the middle layer and above and to certain others, with lighter expectations for base-layer NBFCs that still follow the earlier cyber security framework and baseline controls. The applicability review settles this for your licence before any other work starts.
What is SEBI CSCRF and does it apply to a small broker?
The Cybersecurity and Cyber Resilience Framework applies to SEBI-regulated entities in graded categories based on size and activity, with different compliance timelines and audit requirements for each. Smaller intermediaries have reduced but real obligations. We map your category and the timeline you are on.
Our core systems are run by a vendor. Who is responsible?
You are, for the regulator's purposes. Outsourcing directions require risk assessment, contractual rights to audit, incident notification and exit planning for material arrangements. We review your vendor contracts and controls against these and help you obtain the evidence from the vendor.
Can one assessment cover RBI, CERT-In and DPDP?
Yes, and it should. The technical and governance controls overlap substantially across the RBI and SEBI frameworks, the CERT-In directions and the DPDP Act; what differs is reporting timelines, governance structures and some specific requirements. We build a single control set mapped to each framework so evidence is collected once and reused across inspections, audits and customer due diligence.
Tell us your licence and your deadline
Entity type and tier, which regulator, any inspection or audit date, and what has been done so far. We reply with an applicability note and a fixed price within two working days.