Fifteen years auditing regulated entities in India, most of it inside the banks being examined rather than outside them. Writes about what the directions actually ask for, as opposed to what the summaries say they ask for.
SEBI's Cyber Security and Cyber Resilience Framework applies different obligations to five categories of regulated entity. Here is how to work out which one you are, and what changes once you know.
What shipped in August: evidence request tracking, bulk policy adoption and scoped external auditor access.
How an urban co-operative bank cut its annual third-party assessment cycle from eleven weeks to nineteen days by fixing the step that was actually failing.
A sourced comparison of three GRC platforms, with the date every claim was last verified and a link to where it came from.
A single reference for every incident reporting deadline an Indian regulated entity is subject to, and the exact point at which each clock starts running.
Third-party risk management, defined — plus what a working programme actually contains and how it differs from vendor management.
A reading order for Indian cyber and data-protection regulation — by regulator, and by what you are likely to need first.
Partner with experts who help businesses stay secure, compliant, resilient, and audit-ready.
