Cyber & Information Security Assessments

It includes technical vulnerability assessment (similar in method to what a penetration testing vendor performs), but goes further — access control review, policy and governance review, incident response readiness, and a regulatory gap analysis mapping findings to the IT Act 2000, CERT-In directions, and where applicable SEBI CSCRF or RBI guidelines. A pure penetration test report is written for your IT team; our assessment is written to also be usable by your Board, your statutory auditor, and your cyber insurer.

Often yes, if a real trigger exists — you process customer payment data, you are applying for cyber insurance, an enterprise client's vendor security questionnaire now requires evidence of an assessment, or you are raising a funding round. For a genuinely early-stage business with minimal technology footprint and no customer data at risk, a lighter-touch security hygiene review may be more proportionate, and we will recommend that scope rather than oversell a larger engagement.

CERT-In (the Indian Computer Emergency Response Team) is the national nodal agency for cyber security incident response, operating under Section 70B of the Information Technology Act, 2000. Its directions issued in 2022 require reporting of specified categories of cyber security incidents to CERT-In within 6 hours of detection or being brought to notice, and mandate that service providers, intermediaries, data centres, body corporates, and government organisations maintain and securely store specified ICT system logs for a rolling period of 180 days, within Indian jurisdiction. Specific incident categories covered are set out in the directions and include events such as data breaches, ransomware attacks, and unauthorised access to critical systems, among others.

The DPDP Act, 2023 establishes a framework for the processing of digital personal data in India, with obligations on 'Data Fiduciaries' (broadly, entities that determine the purpose and means of processing personal data) around consent, purpose limitation, data security safeguards, and breach notification. Applicability and the detailed compliance timeline depend on the rules and notifications issued to bring specific provisions into force, and businesses should verify current applicability rather than assume a fixed effective date. Where the Act's provisions apply to your data processing, the security safeguards required overlap substantially with the control areas our cyber security assessment already covers — access control, data governance, incident response, and breach notification readiness.

SEBI's CSCRF applies to specified categories of SEBI-regulated entities, including listed companies (in specified categories), market infrastructure institutions, and various intermediaries, and sets out structured requirements around governance, identification of critical systems, protection, detection, response, and recovery, along with reporting obligations. Applicability varies by the specific category of regulated entity, so the first step in our engagement for any SEBI-regulated client is confirming exactly which CSCRF requirements apply to your specific entity category. We map our assessment findings directly against the applicable CSCRF requirements so your Board and compliance officer can demonstrate structured compliance.

RBI has issued cyber security frameworks and guidelines applicable to banks and, separately, to NBFCs, covering governance (Board-level oversight, often through an IT Strategy Committee), risk management, IT outsourcing due diligence, and incident reporting expectations. The specific requirements and thresholds vary by the category and scale of the regulated entity. Our assessment for RBI-regulated clients maps findings against the applicable RBI framework and helps prepare the documentation your Board and RBI examination process will expect to see.

A full assessment — scoping, technical testing, access and governance review, regulatory gap analysis, and a prioritised remediation roadmap — typically takes 5–8 weeks for a mid-sized single-entity business. A narrower, specifically scoped assessment (for example, addressing a single insurer's questionnaire) can be completed faster. Multi-entity engagements, or those layering in SEBI CSCRF or RBI-specific requirements, typically take longer. Remediation verification is a separate follow-on phase after the initial report.

We benchmark against internationally recognised frameworks — principally ISO/IEC 27001 control domains, the NIST Cybersecurity Framework, and CIS Controls — while layering in the specific statutory and regulatory obligations that actually apply to your entity under Indian law (IT Act 2000, CERT-In directions, SEBI CSCRF, RBI guidelines as applicable) and, for UAE entities, relevant UAE cybersecurity and data protection requirements. The framework blend is scoped to your sector and regulatory profile rather than applied as a single fixed checklist.

Yes, this is a common and specific trigger for engaging us. Cyber insurers increasingly request evidence of a structured security assessment, documented policies, and defined incident response readiness before underwriting or renewing a policy, and a demonstrably lower-risk posture can support more favourable terms. We scope the assessment to directly address the specific questionnaire or evidentiary requirements your insurer or broker has requested, where that is the driving trigger.

Increasingly, yes — technical and security due diligence is now a standard component of institutional investor diligence, particularly for businesses handling customer data, payment information, or operating in regulated sectors. A documented, structured cyber security assessment with an accompanying remediation roadmap materially improves the diligence experience and reduces the risk of last-minute findings that delay or reprice a term sheet.

Fees depend on scope — the number of systems and data flows in scope, the depth of technical testing required, whether SEBI CSCRF/RBI-specific mapping is needed, and whether policy drafting and remediation verification are included. We provide a written scope and fee proposal before any engagement begins; there is no fixed published price because the right scope varies significantly with business size, sector, and regulatory profile.

Our engagement combines PNPC-led scoping, business/regulatory translation, governance and policy review, and reporting, together with technical vulnerability testing performed to recognised methodology — either by our own technical resources or through a vetted technical testing partner, depending on the depth and specialisation the engagement requires (for example, specialised mobile application or IoT testing may call in a particular specialist). Regardless of who performs the technical testing component, PNPC leads the engagement, owns the regulatory mapping, and presents the final report and roadmap.

A vulnerability assessment identifies and catalogues known weaknesses (misconfigurations, unpatched software, weak access controls) typically using automated scanning tools supplemented by manual review. A penetration test goes further — actively attempting to exploit identified vulnerabilities to demonstrate real-world impact, typically performed manually by a skilled tester. Our standard assessment includes a vulnerability assessment as a core component; deeper penetration testing (including exploitation) is scoped as an additional layer where the engagement's risk profile and budget justify it — we recommend the right depth rather than defaulting to the most expensive option.

We scope technical testing to minimise disruption risk — typically scheduling any testing likely to have production impact during low-traffic windows, and using non-destructive testing methodologies for production systems by default. Where deeper, potentially disruptive testing (such as certain exploitation techniques) is in scope, we agree this explicitly with you in advance, including timing and rollback expectations, rather than running it without prior agreement.

If we identify evidence of an active, ongoing compromise during the assessment — as opposed to a theoretical vulnerability — we notify you immediately, outside the normal reporting timeline, so you can begin incident response without waiting for the full assessment report. Where the incident meets CERT-In's reportable categories, we advise on the reporting obligation and timeline immediately.

Yes — a written report structured in layers: an executive summary for the Board/leadership in plain business language, a regulatory gap analysis mapped to applicable frameworks, a detailed technical findings section for your IT team, and a prioritised remediation roadmap with realistic sequencing and cost guidance. The report is designed to be usable directly with your statutory auditor, your cyber insurer, or an investor's due diligence team without requiring translation.

We rank findings by business materiality, not technical severity score alone — factoring in what data or system the vulnerability exposes, how easily it could realistically be exploited, what regulatory or contractual obligation it relates to, and the realistic cost and effort to remediate. A technically 'critical' finding on an isolated test environment with no sensitive data may be deprioritised below a 'medium' finding on a system processing customer payment data.

We do not perform hands-on technical remediation ourselves (patching servers, rewriting code, reconfiguring infrastructure) — that work is typically done by your in-house IT team or a technical implementation partner. What PNPC does provide is the prioritised roadmap, guidance on what 'good' looks like for each finding, drafting or updating of the policy and governance documents the assessment identifies as missing, and independent re-testing to verify that reported remediation actually closes the gap.

We generally recommend an annual reassessment as a baseline, with an additional review triggered by significant change events — a new major SaaS vendor or cloud environment, a new UAE or overseas entity, a funding round or acquisition, or a relevant regulatory update (new CERT-In direction, SEBI CSCRF revision, DPDP Act rules coming into force). A one-time assessment that is never repeated becomes stale as your technology environment and the regulatory landscape both evolve.

Yes, frequently — an independent, external assessment provides a second opinion that internal teams, however skilled, cannot fully replicate for themselves, both because of genuine blind spots and because Boards, auditors, investors, and insurers generally place more evidentiary weight on an independent assessment than on an internal team's self-assessment. In these engagements, PNPC often works collaboratively with the internal team rather than duplicating their day-to-day work — validating their existing controls and identifying gaps they may not have prioritised.

With offices in Chennai, Bangalore, Hyderabad, and Dubai, we assess both the Indian entity's obligations (IT Act, CERT-In, SEBI CSCRF or RBI guidelines where applicable, and the DPDP Act as it comes into force) and the UAE entity's cybersecurity and data protection obligations, plus the cross-border data flow between them, as a single coordinated assessment rather than two disconnected reviews handled by unrelated firms in each jurisdiction.

Digital Transformation Advisory is broader — it covers technology roadmap planning, ERP/accounting software selection, and finance/compliance process design, with basic access-control and data-governance hygiene addressed as one component of that broader control design. Cyber & Information Security Assessment is a focused, deeper review specifically of your security posture, technical vulnerabilities, and regulatory cyber obligations. In practice, the two are complementary — a Digital Transformation Advisory engagement will often flag the need for a dedicated cyber assessment, and a cyber assessment's findings frequently inform a subsequent technology roadmap.

Yes — cloud environment configuration is a core component of the assessment for any business using cloud infrastructure, given how common cloud misconfiguration (overly permissive storage bucket access, exposed management consoles, weak identity and access management configuration) is as a real-world breach cause. We review cloud configuration against the relevant cloud provider's security best practices and the same regulatory framework applied to the rest of the assessment.

Yes — this is a common and specific trigger. Enterprise and institutional clients increasingly require vendor security questionnaires or SOC 2/ISO 27001 evidence before onboarding a new supplier. We can scope the assessment specifically to generate the evidence and documentation your counterparty's questionnaire requires, rather than a full generic assessment, where that is the actual driving need.

The engagement is led by a practising Chartered Accountant with governance, risk, and compliance experience, working alongside technical security resources (in-house or a vetted technical partner) who perform the hands-on vulnerability testing. The distinguishing feature of our approach is that the same governance and regulatory lens applied to your statutory audit and compliance work is applied consistently to the cyber assessment — not handed off between disconnected teams that never reconcile their findings.

This varies enormously depending on the number and severity of findings and whether remediation requires new tooling, additional headcount, or simply configuration changes to existing systems — there is no single realistic figure that applies broadly. What we commit to is giving you a specific, itemised, and honestly sequenced remediation roadmap with cost guidance per item, so you can make an informed prioritisation decision within your actual budget rather than facing an undifferentiated wall of findings.

No. We provide our professional assessment, a documented gap analysis against the frameworks and regulations applicable to you, and a remediation roadmap — this is not equivalent to a formal ISO/IEC 27001 or SOC 2 Type II certification, which must be issued by an accredited certification body following its own separate, formal audit process. Where certification is the ultimate goal, our assessment is a strong preparatory step — closing the gaps we identify meaningfully improves your readiness for that formal certification audit.

Yes. Post-incident, our role shifts to incident response coordination (including CERT-In reporting support within the applicable window where the incident is reportable), root-cause analysis of how the breach occurred, and a revised remediation roadmap informed by the actual incident rather than a hypothetical assessment. We also advise on any onward notification obligations to affected individuals or regulators that may apply depending on the nature of the data involved and applicable law.

A basic assessment of human-factor risk — whether staff have received any security awareness training, and whether policies like acceptable use and password practices are actually communicated and enforced, not just documented — is included as part of our governance review. Structured, ongoing phishing-simulation and security-awareness training programmes are typically scoped as a separate, recurring engagement (often delivered by a specialist training provider we can help you select), since that is an ongoing programme rather than a point-in-time assessment activity.

A structured cyber security assessment, with documented findings and evidence of remediation, can materially support your statutory auditor's evaluation of IT general controls and, where relevant, their assessment of going-concern and risk factors — auditors increasingly consider cyber risk as part of overall enterprise risk assessment. We design our report to be directly usable as supporting evidence in that context, since PNPC's assessment methodology applies the same rigour and documentation discipline as our audit work.

It can be genuinely useful even at a small scale if a real trigger exists — handling customer payment data through a payment gateway integration, applying for cyber insurance, or facing a first enterprise client's vendor questionnaire. For a very small team with no sensitive data and no near-term trigger, we would likely recommend a lighter security hygiene review rather than the full structured assessment, and we say so rather than defaulting to the larger, more expensive engagement.

Both models are available. Many clients begin with a one-off structured assessment and then move to a periodic retainer — typically an annual reassessment cycle plus advisory availability when a new vendor, system, or regulatory question arises in between. We scope whichever structure fits your situation and are transparent about the trade-offs of each before you commit.