In today's digital age, where data is the lifeblood of business operations, protecting sensitive financial information has never been more critical. The Payment Card Industry Data Security Standard (PCI DSS) was established to ensure the secure handling of card data, and compliance with this standard is mandatory for any organization that processes cardholder information. Achieving PCI DSS certification can be a daunting task, but with a simplified approach, it becomes an achievable goal. In this article, we'll break down the process of PCI DSS certification readiness and provide practical guidance to simplify this complex journey.

Understanding PCI DSS

Understanding the basics of PCI DSS is crucial before we begin the certification preparedness process. A set of security regulations called the Payment Card Industry Data Security Standard is intended to safeguard cardholder data. It is applicable to any company that handles, maintains, or sends card data. An organization's dedication to data security and adherence to industry standards is demonstrated by its PCI DSS certification. Twelve high-level requirements make up PCI DSS, which is then broken down into multiple sub-requirements. These specifications address a number of data security-related topics, such as access control, network security, encryption, and routine testing and monitoring. It takes a methodical and thorough approach to meeting these requirements in order to achieve compliance.

---

Is it only credit card or any card data? all card data. High-Level or just 12 requirements make it up? These are not 12 control requirements but an overall breakdown of the certification into 12 phases. 

Steps Towards PCI DSS Certification Readiness

1. Know Your Scope

Determining the extent of your cardholder data environment is the first step toward being prepared for PCI DSS certification. This entails figuring out which people, systems, and procedures have access to card data. Knowing your scope is important since it determines how much work you have to put into complying with regulations.

Your scope can be restricted to particular web servers and payment processing apps, for instance, if your company solely handles card payments online and doesn't keep track of cardholder information. However, your scope will be wider and include data handling and storage systems if you keep cardholder data for recurrent transactions.

2. Identify Applicable Requirements

Determine the precise PCI DSS criteria that apply to your organization after determining your scope. Depending on your scope and how you manage cardholder data, the rules could change.

For example, you will need to concentrate on encryption, access control, and routine security testing if your scope involves storing cardholder data. Certain criteria might not apply if your scope is restricted to processing card transactions without data storage.

3. Conduct a Gap Analysis

A gap analysis is a critical step in assessing your organization's current state of compliance with PCI DSS requirements. This involves comparing your existing security practices and policies to the standard's requirements.

During the gap analysis, identify areas where your organization is already in compliance and areas where improvements or adjustments are needed. This analysis serves as a roadmap for prioritizing compliance efforts.

4. Develop a Compliance Plan

Based on the results of your gap analysis, create a compliance plan that outlines the specific actions needed to address non-compliance areas. Assign responsibilities and set deadlines to ensure that everyone involved understands their role in achieving compliance.

Your compliance plan should include a combination of technical, procedural, and policy changes to align your organization with PCI DSS requirements. It may involve implementing firewalls, encryption measures, access controls, and security policies, among other things.

5. Implement Security Measures

With your compliance plan in hand, begin implementing the necessary security measures. This could involve configuring firewalls, deploying intrusion detection systems, and encrypting sensitive data. Ensure that all changes align with the PCI DSS requirements and secure your cardholder data environment.

6. Regularly Monitor and Test

Continuous monitoring and testing are essential components of PCI DSS compliance. Regularly assess your security controls, conduct vulnerability scans, and perform penetration testing to identify and address any vulnerabilities or weaknesses in your systems.

Monitoring and testing should be ongoing to maintain a high level of security. This ensures that your organization remains vigilant and responsive to emerging threats.

7. Document Your Compliance Efforts

Proper documentation is a fundamental aspect of PCI DSS certification readiness. Maintain records of your compliance plan, security measures, monitoring and testing results, and any security incidents or breaches. Detailed records will be essential during the certification process to demonstrate your organization's commitment to data security.

8. Engage a Qualified Security Assessor (QSA)

To achieve PCI DSS certification, you'll need to engage a Qualified Security Assessor (QSA). A QSA is an independent security firm certified by the PCI Security Standards Council to assess and validate your compliance with the standard.

The QSA will conduct an assessment of your organization's processes, controls, and documentation to determine if you meet the PCI DSS requirements. This assessment includes an on-site visit, interviews with key personnel, and a review of your compliance documentation.

9. Submit a Report on Compliance (ROC)

Following the assessment by the QSA, you'll be required to submit a Report on Compliance (ROC). This report details the results of the assessment and serves as the formal documentation of your PCI DSS compliance.

The ROC includes information about your organization's scope, security measures, monitoring and testing results, and compliance efforts. It provides an overview of how you've addressed each requirement.

10. Maintain Ongoing Compliance

Achieving PCI DSS certification is a significant accomplishment, but it's not a one-time effort. To maintain certification, continue to follow the steps outlined above. Regularly update your security measures, conduct monitoring and testing, and engage with your QSA for annual assessments and ROC submissions.

How can COMPASS help?

COMPASS, a specialized lightweight platform, enhances your Internal Audit and external audit processes and user experience. Some of the benefits of using COMPASS include:

• Comprehensive Standards and Control Libraries featuring 30+ International and Domestic Standards.
• Capability to create and upload personalized Standards for Internal assessments.
• Dedicated modules for Risk Assessment and Standard Assessment.
• Centralized data and documentation for convenient access and review.
• Improved communication and collaboration between auditors and auditees.
• Efficient reporting with instant audit report generation.
• Tracking of issues and exceptions identified during Internal audits.
• Customizable reminders from COMPASS for issue closure and tracking.
• Continuous monitoring and real-time visibility into security risks and compliance.
• Dashboards and analytics facilitating data-driven decision-making.
• Provides users with an auditor’s perspective, enhancing understanding of the audit process.

Simplifying the Journey

PCI DSS certification readiness can seem overwhelming, but by breaking it down into manageable steps and understanding your organization's specific scope and requirements, you can simplify the process. It's essential to engage with experts, maintain a proactive stance on security, and document your efforts throughout the journey. Ultimately, achieving PCI DSS certification is not only a regulatory requirement but also a demonstration of your commitment to protecting sensitive financial information and maintaining trust with your customers.

In the ever-evolving world of IT, security has become a necessity more than a precautionary decision or a luxury that most organizations overlook. With the ever-increasing sophistication of cyberattacks, businesses are constantly seeking ways to safeguard their sensitive information and protect their customers' trust. Two widely recognized information security standards stand out in this arena: ISO 27001 and SOC 2. As a startup looking at certifications from ISO accredited bodies or attestations from CPAs (Certified Public Accountant) will give your organization the head-start it needs in the ever-evolving world of cyberthreats. ISO and SOC2 follow essentially two different paths for certification/attestation respectively, ISO 27001 is an international standard for Information Security Management Systems (ISMS). It provides a systematic approach for managing information security risks. Whereas SOC 2 (Service Organization Control 2) is a framework developed by the American Institute of CPAs (AICPA) specifically for service organizations. It focuses on five trust service principles: security, availability, processing integrity, confidentiality, and privacy. SOC2 is essential for Service providing organizations across all industries, as it focuses on specialization of protection of service organizations that handle customer data. While ISO is a prescriptive standard that can be applied to any organization in any industry, it focuses on developing and maintain an ISMS framework in the organization and how well it is being maintained. The fundamental distinctions have been called out in detail in the Blog: The rudimentary differences between an ISO 27001 Certification and a SOC2 Certification.

As a startup, compliance with either of the standards will help your business in the following ways:

• Increased customer trust: By demonstrating their commitment to information security, startups can build trust with their customers and partners.
• Improved cybersecurity posture: ISO 27001 and SOC 2 compliance can help startups to identify and mitigate information security risks.
• Enhanced competitive advantage: In today's competitive marketplace, information security compliance can be a differentiator for startups.
• Client Trust: ISO 27001 and SOC 2 certifications instill trust in your clients by demonstrating your commitment to protecting their data and providing reliable services.
• Business resilience: Compliance enhances your startup's ability to withstand disruptions, whether they be due to cyberattacks, natural disasters, or other unforeseen events.
• Competitive Advantage: Having these certifications can set your startup apart from competitors and provide a valuable selling point to prospective clients and investors.

For a startup, having either certificate or attestation for ISO 27001 or SOC2 is a task that can be achieved rather easily as the systems, processes and technologies being adopted in the organization are rather nascent and can be molded according to the minimum requirements set by either standards. The certification or attestation can be achieved from scratch by following the below mentioned steps:

1. Establish an Information Security Management System (ISMS):
   • An ISMS is a framework for managing information security risks.
   • It includes policies, procedures, and controls that help organizations to identify, assess, and mitigate information security risks.
2. Conduct a risk assessment:
   • Identify and assess the information security risks that your startup faces. This step is crucial as it forms the basis for establishing controls and security measures. You need to understand the vulnerabilities and potential threats to your data.
   • It is essential to ensure that your risk assessment is metric driven so that you understand the critical risks in your organization
3. Conduct a Business Impact Assessment
   • Identify critical business components, processes and technologies
   • Identify Single Points of Failure (SPOF)Create contingency plans for different scenarios
   • Communicate plans to key stakeholders
   • Conduct tests annually to test the preparedness of the organization
4. Implement Security Controls:
   • For ISO 27001, you'll need to establish a set of controls based on the risk assessment. These controls should cover various aspects of information security, such as access control, data encryption, incident response, and employee training.
   • For SOC 2, you'll need to implement controls that address the specific trust service principles, including security, availability, processing integrity, confidentiality, and privacy. These controls may include data encryption, access controls, monitoring, and incident response procedures.
5. Incorporate Security into your processes:
   • By involving thoughts of Security into any process that happens in your organization you will be able to find opportunities for improvement in every process
   • The thought of risk should be something that is considered for every process being setup by the organization
   • By incorporating security into processes, the risk is significantly reduced
6. Training and Awareness:
   • Ensure that all employees are trained and aware of your information security policies and procedures. They should know their roles and responsibilities in maintaining compliance.
7. Continuously Monitor and Improve:
   • Regularly monitor and review your information security practices identifying areas for improvement.
   • Maintain a continuous improvement tracker to enforce the areas of improvement and also for compliance.
   • Conduct regular reviews of the ISMS framework (monthly) and document the Minutes of the meeting as Monthly Review Meeting
8. Conduct Internal Audits:
   • Conduct regular internal audits to review your security controls to ensure their effectiveness. For ISO 27001, internal audits should be conducted periodically to assess compliance. For SOC 2, engage an independent CPA firm to perform an annual audit.
   • Improve on the gaps and OFIs identified during the Internal audit and continuously improve your information security practices and update your policies and procedures as needed.
9. Seek Certification:
   • Once you feel you are in a good place with your ISMS system, seek certification/attestation as the case may be.
   • For ISO 27001 certification, you will need to engage an accredited certification body to assess your ISMS and grant certification if you meet the standard's requirements.
   • For SOC 2 compliance, you will receive a SOC 2 report after the audit. Share this report with your customers, partners, and stakeholders to demonstrate your commitment to security.
10.  Maintain Compliance:
    • Achieving compliance is not a one-time effort; it's an ongoing process. Regularly review and update your information security measures to adapt to changing risks and regulations.
    • Conduct yearly surveillance audits for ISO and Yearly Attestation Audits for SOC2
    • Based on the findings continuously improve your system
11. Communicate your compliance:
    • Once you achieve ISO 27001 and SOC 2 compliance, make sure your customers and partners are aware of it.
    • Highlight your commitment to data security in marketing materials and on your website.
12. Leverage Compliance for growth:
    • Compliance with ISO 27001 and SOC 2 can be a powerful differentiator in the competitive startup landscape.
    • Use your compliance achievements as a selling point to attract new customers and investors who value data security.

How can COMPASS help?

COMPASS, a specialized lightweight platform developed by CyRAACS, enhances your Internal Audit and external audit processes and user experience. Some of the benefits of using COMPASS include:

• Automation of the audit process, encompassing evidence collection and analysis.
• Standard and Controls Libraries with 35+ International and Domestic Standards including ISO 27001:2022, SOC2 and PCI DSS.
• Easy to setup and use with enhanced auditor and auditee communication.
• Centralized data and documentation for easier access and review.
• Enhanced communication and collaboration between auditors and auditees.
• Streamlined reporting, with instant audit report generation.
• Tracking of issues and exceptions for all issues identified during the audit.
• Continuous monitoring and real-time visibility into security risks and compliance status.
• Dashboards and analytics supporting data-driven decision-making.
• Gives an auditor’s perspective to users and helps understand the process of audits better.

Conclusion

In conclusion, ISO 27001 and SOC 2 compliance are achievable for startups with the right approach and commitment. ISO 27001 and SOC 2 compliance are achievable goals for startups, even with limited resources. These certifications not only bolster your information security but also provide a competitive edge and instill trust in clients and investors. By following the steps outlined in this guide and maintaining a commitment to continuous improvement, your startup can successfully navigate the path to compliance and reap the associated benefits.

In today's dynamic business landscape, internal audit plays an even more critical role due to the complexities and the increased emphasis on cybersecurity. It goes beyond mere compliance and extends to strategic contributions for enhancing governance, risk management, and security. This comprehensive guide delves into the realm of internal audit, covering its definition, objectives, scope, procedures, best practices, and its impact on information security (infosec) and overall organizational performance.

What Is Internal Audit?

Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps organizations accomplish their objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Internal auditors are responsible for providing insights, recommendations, and assurance on the organization's operations.

Objectives of Internal Audit

The primary objectives of internal audit are as follows:

Important Internal Audit Procedures

• Organizing: Understanding the objectives and hazards of the company is the first step for internal auditors. After that, they draft an audit strategy including the necessary resources, goals, and scope.
• Fieldwork: This stage involves gathering data. Auditors evaluate controls and compliance by gathering data, running tests, and examining procedures.
• Reporting: Following the fieldwork, the auditors provide management with a thorough report that includes their findings, conclusions, and suggestions. These suggestions may result in process enhancements or remedial measures.
• Follow-up: Auditors can check in to make sure that the suggested courses of action have been followed and that the problems found during the audit have been fixed.
• Risk Assessment: Identify and assess cybersecurity risks and vulnerabilities, considering the potential impact and likelihood of security incidents.
• Security Controls Evaluation: Evaluate the effectiveness of security controls, including access management, network security, and data protection measures.
• Compliance Review: Ensure compliance with cybersecurity laws, regulations, and industry standards, such as GDPR, HIPAA, or ISO 27001.
• Security Incident Review: Assess how the organization handles security incidents, including incident response plans, communication strategies, and mitigation efforts.
• Security Awareness and Training Assessment: Review the organization's efforts to educate employees about cybersecurity threats and best practices.
• Third-Party Vendor Security Audit: Examine the security practices of third-party vendors to ensure they meet cybersecurity standards and do not pose risks to the organization.

Best Practices in Internal Audit

To conduct effective internal audits, consider the following best practices:

• Independence: To preserve objectivity, internal audit services should be separate from the sectors they examine.
• Risk-Based Approach: To efficiently deploy resources, rank audit areas according to risk.
• Constant Learning: Internal auditors should keep abreast of market developments, legal requirements, and new threats.
• Data Analytics: To improve the audit process and spot patterns and abnormalities, use data analytics technologies.
• Collaboration: Foster collaboration between internal audit, IT, and cybersecurity teams to ensure a holistic approach to security.
• Continuous Learning: Keep internal auditors updated on the latest cybersecurity threats, trends, and regulatory changes.
• Data Analytics: Utilize data analytics tools to identify anomalies and patterns in security data, aiding in the detection of security breaches and vulnerabilities.
• Clear Communication: Ensure that findings and recommendations from security audits are communicated clearly to management for prompt action.

How can COMPASS help?

COMPASS, a specialized lightweight platform, enhances your Internal Audit and external audit processes and user experience. Some of the benefits of using COMPASS include:

• Built-in library of more than 30 international and domestic standards, plus the ability to create and upload custom standards for internal assessments.
• Dedicated modules for risk and standard assessment.
• Centralized data storage and access for easy review and collaboration.
• Enhanced communication and collaboration tools between auditors and auditees.
• Instant report generation for real-time risk and compliance insights.
• Issue and exception tracking for identified issues during internal audits.
• Customizable reminders for tracking and closure of issues.
• Continuous monitoring for real-time visibility into security risks and compliance status.
• Interactive dashboards and analytics for data-driven decision-making.
• Provides an auditor’s perspective to users and helps understand the process of audits better.

Conclusion

Internal audit is a crucial function that contributes to an organization's success by ensuring effective governance, risk management, and compliance. By following best practices, adopting a risk-based approach, and using data analytics, internal auditors can provide valuable insights and recommendations for process improvements. Whether you are an internal auditor, a member of senior management, or simply interested in understanding the inner workings of organizations, this guide provides a comprehensive overview of the significance and processes involved in internal audit. Embracing internal audit as a strategic asset can lead to better governance and ultimately improved organizational performance.

One of the key reasons for vulnerabilities in the applications are lack of secure design,

development, implementation, and operations. Insecure application development is a primary cause of cyberinfrastructure vulnerabilities. Relying solely on post-development audits for security is insufficient. Security should be an integral part of the application's design and development process, with built-in measures to guard against security breaches and exploitation.

Once secure application design and development guidelines are implemented, the application can undergo source-code reviews and black-box testing by a CERT-In empaneled auditing organization to detect any shortcomings or vulnerabilities in security practices. 

As per the guidelines issued by the Indian Computer Emergency Response Team (CERT-In), organizations involved in application development, especially government entities, need to establish a strong and secure application security foundation during the development process. 

Applications lacking secure design and development practices are not suitable for assessments and audits. Both auditee and auditor organizations must ensure that the application adheres to secure practices before starting any assessments. 

This method is essential for guaranteeing the security of the application from the very beginning and progressively enhancing each stage of the application development lifecycle.

The guidelines have been divided into four phases

Phase 1: Establish the Context of the Security in Designing of Application

The main aim is to create systems that are inherently secure, resilient, and resistant to security

threats, vulnerabilities, and attacks. Organizations should incorporate security as a key component of the development process ensuring compliance with global standards. This reduces the likelihood of security breaches by protecting sensitive data and delivering secure and reliable software. 

The secure software development life cycle (SDLC), an approach that integrates security practices throughout the life cycle, encompasses various models and frameworks, including -

• "Microsoft Secure Development Lifecycle (SDL)" is a widely known and adopted SDLC framework with seven phases.
• "Open Web Application Security Project (OWASP) Software Assurance Maturity Model (SAMM)" helps build mature software security programs with four levels and multiple security practices.
• "Agile Secure Development Lifecycle" integrates security practices within agile methodologies, including security grooming, security testing, continuous integration & deployment, security feedback loop.
• "NIST Secure Software Development Framework (SSDF)" is a comprehensive guide for developing secure software.

Designers and developers involved in application development must possess a comprehensive understanding of the cyber security fundamentals and practical knowledge of the security principles governing secure application development. 

Phase 2: Implement and Ensure Secure Development Practices

Effective data protection and privacy require a comprehensive strategy. This includes integrating -

• Secure authentication, authorization, and session management
• Cryptographic practices
• Version control and change management
• Secure coding methods
• File and memory management
• Software technology specific security checklist
• Security Test Driven Development (STDD)
• Threat modeling in application development
• Secure environment for application development
• Secure use of environment variables
• Stored procedures over SQL statements
• Handling of error messages, commented code and exceptions
• Linear data structure and multiple inheritances
• Third party and open-source libraries, components and APIs
• Build trust boundaries
• Principle of least privileges
• Enhancing maturity of software security

Phase 3: Provision of Detection of Errors and Vulnerability in Application Design and Development

• Source Code Review: It's a procedure that reviews the source code of an application to detect security issues or weaknesses.
• Conduct Security Vulnerability Assessment: Organizations should hire CERT-In empanelled auditors for security assessments of the developed application and its components.
• Penetration Testing: It replicates real cyberattacks to reveal potential vulnerabilities.
• Logging and Audit Trails: The application should incorporate logging and audit trail features to address troubleshooting needs and meet compliance standards 
• Precondition for Assessment and Audit: Applications lacking secure design and development should not undergo assessment without confirmation of secure practices by both auditee and auditor organizations.

Phase 4: Ensure Secure Application Deployment and Operations

• Secure Deployment and Configuration: No alterations should occur in the audited application's code or configurations, and the application must be hosted within a secure and thoroughly tested environment.
• Provision for Patch and Update: Thorough documentation outlining the security features incorporated within the application's architecture, codebase, APIs, and data interactions should be compiled.
• Secure Development of Update, Patch and Release to Mitigate Against Supply Chain Risk from Developers: Ensuring secure development of updates, patches, and releases is crucial for safeguarding against supply chain risks that may originate from developers. 

Conclusion

Adhering to these guidelines is paramount in our ever-evolving digital landscape. They fortify our applications against cyber threats by embedding security from project inception to the application's lifecycle. This commitment safeguards data, upholds user trust, and enhances digital security. Let these guidelines lead us to a safer digital future, laying the foundation for secure and resilient applications in a security-conscious world.

Application Programming Interface or API serves as a data connection that facilitates the sharing of data with other applications. In today's rapidly evolving digital landscape, Application Programming Interfaces (APIs) are pivotal in connecting various software applications, enabling seamless data exchange, and powering countless online services. 

While APIs offer unparalleled efficiency and flexibility, they also introduce a significant security challenge. The importance of securing APIs cannot be overstated, as they serve as gateways to your digital assets and sensitive information. 

API Landscape

APIs can simplify app development and integration of multiple product functionalities, saving time and money while providing a seamless user experience. While designing new tools and products, APIs provide flexibility, ease of usage and they play a central role in both mobile commerce and the Internet of Things (IoT). 

Usage of APIs has increased significantly in the past few years. Akamai estimates that roughly 83% of internet traffic is being driven by APIs. Further, according to the Slashdata survey, which offers several granular insights into how developers use APIs, nearly 90% of developers are using APIs in some capacity. 

With an exponential growth in the number of API calls, there is an aggressive increase in abuse of these APIs. Gartner predicts that 90% of web-enabled applications will have broader attack surfaces due to exposed APIs. The latest study from Imperva claims that vulnerable APIs are costing organizations between $40 and $70 billion annually.

Due to their direct access to extremely sensitive data and functionality, APIs are frequently cited as one of the primary security concerns that organizations face. APIs are changing the landscape of financial services and playing a critical role in the rise of Fintech and Open Banking. banks are in a position to provide better customer experience and develop new revenue streams by relying on banking APIs. APIs have opened doors to technologies such as P2P payments and cryptocurrency exchanges. However, with this rise of digitization and API usage in the financial sector along with the availability of sensitive customer information, the financial industry is also becoming a preferred target for API attacks. Indian Financial Sector since 2021 has observed a consistent rise in API attacks.

API Attacks and Its Various Kinds

The most common API attacks can be listed as follows:

• Broken Access Control: It is a security vulnerability that occurs when an application does not properly enforce access controls. The attack involves an attacker bypassing or manipulating access controls within an API to gain unauthorized access to data or functionality. 
• Cross Site Scripting: This security vulnerability occurs when an attacker injects malicious scripts into web content that is then viewed by other users. The attack is associated with web applications and can affect APIs when they return or display user-generated content.
• SQL Injection Attacks: A malicious technique that uses SQL code to manipulate the backend database to exploit vulnerabilities in APIs, allowing attackers to manipulate an application's database queries. It leads to unauthorized data access, data manipulation, and potentially even complete database compromise.
• Excessive Data Exposure: This occurs when sensitive or excessive information is inadvertently exposed through an API response. An API provides more data than necessary, potentially revealing sensitive information like user credentials, personal data, or system details to unauthorized users. 
• DDoS (Distributed Denial of Service) Attack: It is a malicious assault on an application's API infrastructure with the goal of overwhelming it with an excessive volume of traffic. They are intended to disrupt the availability and functionality of the API, rendering it inaccessible to legitimate users.
• Man in the middle (MITM): Here, the attacker intercepts and potentially manipulates the communication between two parties. This attacker secretly sits between the communicating entities, eavesdropping on the data exchange or altering it without the knowledge of either party.
• Security Misconfiguration: It occurs when an API or its components are not configured securely, leaving them vulnerable to exploitation. Security misconfigurations can range from default passwords and open ports to excessive permissions on resources.

Conclusion

With the exponential growth in API usage, there has been a corresponding rise in API abuse. The transition from monolithic architectures to cloud-based microservices and containers has brought about a paradigm shift in development cycles but has also expanded the surface area of vulnerabilities exposed to the internet. 

In the present day, APIs grant access to functionalities that were once confined within monolithic structures, resulting in a greater number of potential vulnerabilities to exploit. Additionally, the proliferation of endpoints available for interaction has amplified the attack surface. By following best practices for web application security and API security, you can significantly reduce the risk of attacks and enhance the overall security of your systems.

Lok Sabha passed the Digital Personal Data Protection Act – India (DPDP Act) - August 2023, India’s 2nd attempt in framing privacy legislation.

The Journey of the Bill 

Aug 2017: Privacy as a fundamental right reaffirmed in Justice KS Puttaswamy vs Union of India by SC Justice Srikrishna Committee constituted to examine data protection issue 

July 2018: Committee released a draft of the DPDP Bill and report 

Dec 2017: The Joint Parliament Committee (JPC) released its report and new version of the law as the Data Protection Bill 

Dec 2019: Revised draft bill sent to JPC

Aug 2022: Draft DPB Withdrawn 

Nov 2022 Meity released a draft DPDP Bill for Public Consultation 

July 2023: Union Cabinet approves the draft 

Aug 2023: The Digital Personal Data Protection Act – India (DPDP Act) was passed and a law was initiated 

Introduction to DPDP Act – August 2023 

🔒 Introducing the Digital Personal Data Protection Act (DPDP) – Safeguarding Privacy in India 🇮🇳

In a significant stride towards bolstering digital privacy, India has unveiled the groundbreaking Digital Personal Data Protection Act (DPDP) in August 2023. This landmark legislation aims to empower individuals with greater control over their personal data while establishing stringent regulations for its collection, storage, and utilization by businesses and organizations.

Under the DPDP Act, entities collecting personal data are mandated to obtain explicit consent from users, outlining the purpose and duration of data usage. The Act also encompasses provisions for data localization, ensuring that critical personal data remains within Indian borders.

Furthermore, the DPDP Act introduces a Data Protection Authority (DPA) responsible for monitoring and enforcing compliance with the law. Non-compliance could result in substantial fines, emphasizing the government's commitment to fostering a responsible data ecosystem.

As the DPDP Act comes into effect, it heralds a new era of digital privacy, giving citizens greater control and confidence in their online interactions. 

What are the key features of the bill?

• Applicability- The Bill applies to the processing of digital personal data within India where such data is
  • Collected online, or
  • Collected offline and is digitised. 
• It will also apply to the processing of personal data outside India if it is for offering goods or services in India.   
• Consent- Personal data may be processed only for a lawful purpose after obtaining the consent of the individual.
• For individuals below 18 years of age, consent will be provided by the parent or the legal guardian.
• Consent may be withdrawn at any point in time.
• Rights of data principal- Data principal is an individual whose data is being processed. He/She will have the right
  • To obtain information about processing
  • To seek correction and erasure of personal data
  • To nominate another person to exercise rights in the event of death or incapacity and
  • Grievance redressal
• Duties of Data Principals- Data Principals must not
  • Register a false or frivolous complaint.
  • Furnish any false particulars or impersonate another person in specified cases
  • Violation of duties will be punishable with a penalty of up to Rs 10,000.
• Obligations of data fiduciaries- Data fiduciary is the entity determining the purpose and means of processing.
• Data fiduciary must
  • Make reasonable efforts to ensure the accuracy and completeness of data
  • Build reasonable security safeguards to prevent a data breach
  • Inform the Data Protection Board of India and affected persons in the event of a breach
  • Erase personal data as soon as the purpose has been met and retention is not necessary for legal purposes
• In case of government entities, storage limitation and the right of the data principal to erasure will not apply.
• Personal data outside India- It allows the transfer of personal data outside India, except to countries restricted by the central government through notification. 
• Exemptions- Rights of the data principal and obligations of data fiduciaries will not apply in specified cases such as
  • Prevention and investigation of offences
  • Enforcement of legal rights or claims
• The Central government may exempt certain activities
  • In the interest of the security of the state and public order
  • Research, archiving, or statistical purposes
• Data Protection Board of India- It is established by the Central Government. Key functions of the Board include
  • Monitoring compliance and imposing penalties
  • Directing data fiduciaries to take necessary measures in the event of a data breach
  • Grievance redressal
• Appeal- The decisions of the board can be appealed to Telecom Dispute Settlement and Appellate Tribunal.

Penalty	Reason
Rs 200 crore	Non fulfilment of obligations for children
Rs 250 crore	Failure to take security measures to prevent data breaches

India's digital payment ecosystem has witnessed exponential growth in recent years, providing convenience and accessibility to millions of users. However, as the digital landscape expands, so does the need for robust cybersecurity measures. To address this critical aspect, the Reserve Bank of India (RBI) has introduced a draft master direction that covers various domains of cyber resilience and digital payment security. This blog explores the key areas emphasized in the draft and the significance they hold in developing a secure digital payment ecosystem in India.

Applicability:

Regulated Entity	Entities applicable for	Timeline for implementation
Large non-bank PSOs	Clearing Corporation of India Limited (CCIL), National Payments Corporation of India (NPCI), NPCI Bharat Bill Pay Limited, Card Payment Networks, Non-bank ATM Networks, White Label ATM Operators (WLAOs), Large PPI Issuers, Trade Receivables Discounting System (TReDS) Operators, Bharat Bill Payment Operating Units (BBPOUs) and Payment Aggregators (PAs)	1st April 2024
Medium non-bank PSOs	Cross-border (in-bound) Money Transfer Operators under Money Transfer Service Scheme (MTSS) and Medium PPI Issuers	1st April 2026
Small non-bank PSOs	Small PPI Issuers and Instant Money Transfer Operators	1st April 2028

The draft directions aim to provide a comprehensive framework for the governance, risk management, security controls, incident response, audit and compliance of the PSOs with respect to cyber resilience and digital payment security. They also specify baseline security measures for ensuring safe and secure digital payment transactions, such as encryption, authentication, access control, monitoring and reporting.

Governance:

To effectively manage information security risks, PSOs must establish a proactive approach at the highest level of governance. The Board of Directors assumes the responsibility of overseeing information security risks, including cyber risk and cyber resilience. A board-approved Information Security (IS) policy should be formulated, covering all applications and products related to payment systems. This policy will serve as a roadmap for managing potential risks and addressing any materialized threats.

Risk Management:

PSOs need to develop a robust risk management framework to identify, assess, monitor, and manage cybersecurity risks. Periodic risk assessments should be conducted to identify the sources and magnitude of cyber threats and vulnerabilities. These assessments will enable PSOs to implement appropriate risk mitigation measures, thereby reducing the potential impact of security incidents.

Security Controls:

Implementing adequate security controls is crucial for protecting the confidentiality, integrity, and availability of information assets and payment systems. PSOs must establish a comprehensive set of security controls covering various aspects, such as physical security, network security, application security, data security, endpoint security, cloud security, cryptography, identity and access management, malware protection, patch management, backup and recovery. These controls work in tandem to create multiple layers of defense against potential threats.

Incident Response:

PSOs should establish an effective incident response mechanism to detect, contain, analyze, respond to, and recover from cyber incidents. Swift detection and containment of incidents can help minimize their impact. PSOs must also adhere to prescribed timelines and formats to report cyber incidents to regulatory authorities, such as the RBI. Conducting thorough root cause analysis enables PSOs to identify vulnerabilities and implement corrective and preventive measures to prevent similar incidents in the future.

Audit:

Regular internal and external audits are essential to assess the adequacy and effectiveness of a PSO's cyber resilience and digital payment security framework. Audits should encompass all aspects of the framework, including policies, procedures, processes, systems, controls, and compliance. The findings and recommendations from these audits serve as valuable inputs for the Board and senior management to take necessary actions and strengthen the security posture further.

Compliance:

Adhering to applicable laws, regulations, standards, and guidelines is a fundamental aspect of cyber resilience and digital payment security. PSOs must ensure compliance and proactively monitor changes in the regulatory landscape. Regular updates to the framework based on evolving requirements will help maintain a robust security posture. PSOs should submit periodic compliance reports to regulatory authorities, such as the RBI, as per the prescribed frequency and format.

RBI aims to mitigate cyber risks and promote a culture of cyber resilience among PSOs. Implementing these measures will help safeguard customer data, prevent cyber incidents, and foster trust in digital payment systems, contributing to the nation's digital transformation journey.

Establishing a strong cybersecurity framework is imperative for Payment System Operators to ensure cyber resilience and protect digital payment systems. By implementing effective governance, robust risk management practices, comprehensive security controls, efficient incident response mechanisms, thorough audits, and strict compliance measures, PSOs can mitigate risks and enhance the security of payment systems. This comprehensive approach strengthens the trust of customers and stakeholders in the digital payment ecosystem, paving the way for secure and seamless transactions in the digital era.

Please reach out to us to know more about this at [email protected]

What is a Passkey?

• Passkey is a new way to sign in to websites and apps that are secure and easier to use than passwords.
• Passkeys use public-key cryptography to create a unique key pair for each user.
  • One key is stored on the user's device and the other key is stored on the service's servers.
  • When the user signs in, the two keys are compared and if they match, the user is logged in.
• Passkeys can be unlocked using the user’s device built-in biometrics or other authentication methods.

Passkeys are a promising new technology that has the potential to make online security much stronger and user experience simpler.

Benefits of Passkey:

• No need to remember anything: Passkeys are very long sequences compared to passwords, which gives them robust security. Your device and the web server keep the passkey pair safe and match them up when necessary with a quick handshake protocol. Then, you'll use biometrics or a similar security to log in to your authentication device.
• More Secure than passwords: Passkeys are never stored on a server. Even if a hacker is able to gain access to a server, they will not be able to steal your Passkeys.
• Resistant to Brute Force Attacks: Passkeys are so long and complex that they are resistant to brute force attacks (would take billions of years to guess them).
• Resilient to Hacking attempts: Passkeys are resistant to hacking attempts because they are stored locally on your device and are not shared with the server. The server challenges your device with a unique code, and your device uses its private key to generate a response. The server then verifies that the response is correct. This process is called a "challenge-response" protocol.
• Protect from Phishing Attacks: A user cannot be tricked into authenticating on a deceptive site because the browser or OS handles verification.
• Reduce Costs: Passkeys reduce costs for sending SMS, making them a safer and more cost-effective means for two-factor authentication

Passkeys are a significant improvement over passwords. They are faster, more secure, and more convenient. Many brands will follow in supporting passkeys. I expect passkeys to become the standard for login security in the near future like how 2FA was adopted in the past.

Designate a specific mobile device with good biometrics as your go-to authenticator using passkeys. Also, you can easily transfer your passkeys to the new device (whenever you upgrade).

Overall, Passkeys are a much more secure and convenient way to sign in to websites and apps. Looks like the future of password-less authentication.

Will passkeys be the future? Let us know: Contact us. We are a CERT-IN Empanelled cyber security company based out of Bangalore. We are a CERT-IN Empanelled cyber security company based out of Bangalore.

The cybersecurity landscape is constantly evolving, and CISOs need to be prepared to defend against increasingly sophisticated attacks. 

Here are five top priorities for CISOs in 2023:

1. Safeguard critical infrastructure from advanced attacks: CISOs must prioritize the protection of vital systems such as power grids, water networks, and transportation infrastructures, which face an escalating risk of cyber attacks.

2. Minimize the attack surface: CISOs should focus on reducing vulnerabilities within their organization by identifying and resolving potential entry points that can be exploited by attackers.

3. Enhance security awareness and training: Recognizing that employees are often the weakest link in security, CISOs need to concentrate on improving security awareness and providing comprehensive training programs to empower employees in identifying and mitigating security threats.

4. Embrace security automation: CISOs can enhance operational efficiency and effectiveness by implementing automation solutions for tasks like vulnerability scanning and incident response. This allows CISOs to dedicate more time to strategic initiatives.

5. Foster a robust security culture: Establishing a strong security culture is imperative for organizations to defend against cyber threats. CISOs should collaborate with leadership and employees to cultivate an environment of heightened security awareness and individual responsibility.

In addition to these five focal areas, CISOs should also remain cognizant of the following trends shaping the cybersecurity landscape in 2023:

a) The increasing prominence of artificial intelligence (AI) and machine learning (ML) technologies.

b) The growing adoption of cloud computing services.

c) The proliferation of Internet of Things (IoT) devices.

d) The escalating frequency of cyber attacks targeting small and medium-sized businesses (SMBs).

By effectively addressing these challenges, CISOs can position their organizations to successfully mitigate cyber threats in 2023 and beyond.

What are your top cybersecurity priorities for 2023? Let us know: Contact us

RBI/2023-24/102

DoS.CO.CSITEG/SEC.1/31.01.015/2023-24                                                                                    10^th April 2023

Summary of the Circular:

Regulated Entities (REs) outsource a substantial portion of their IT activities to third parties, which exposes them to various risks. In order to ensure effective management of such risks, RBI issued a draft Master Direction on Outsourcing IT Services in June 2022. Based on the feedback received, RBI released a finalized version of Master Direction on Outsourcing of Information Technology Services on April 10, 2023.

Applicability of the Circular:

These Directions shall be applicable to the following entities, collectively referred to as ‘regulated entities’ or ’REs’:

1. Scheduled Commercial Banks (excluding Regional Rural Banks).
2. Local Area Banks.
3. Small Finance Banks.
4. Payments Banks.
5. Primary (Urban) Co-operative Banks
6. Non-Banking Financial Companies
7. Credit Information Companies
8. All India Financial Institutions (EXIM Bank, NABARD, NaBFID, NHB and SIDBI)
   

Implementation Schedule for the Circular:

The master directions shall be effective from 1st October 2023.

Key Pointers from the Master Direction:

• The Master Direction defines 22 controls which are segregated into 10 chapters:
  • Preliminary
  • Role of the Regulated Entity
  • Governance Framework
  • Evaluation and Engagement of Service Providers
  • Outsourcing Agreement
  • Risk Management
  • Monitoring and Control of Outsourced Activities
  • Outsourcing within a Group / Conglomerate
  • Cross-Border Outsourcing
  • Exit Strategy
    

• Chapter I:
• With respect to existing outsourcing arrangements that are already in force, REs must ensure that the agreements due for renewal before October 1, 2023, must comply with the provisions of these Directions as on the renewal date or 12 months from the date of issuance of this Master Direction. The agreements that are due for renewal on or after October 1, 2023, must comply with the provisions of these Directions as on the renewal date or 36 months from the date of issuance of this Master Direction, whichever is earlier.

• With respect to new outsourcing arrangements, REs must ensure that the agreements that come into force before October 1, 2023, must comply with the provisions of this Direction as on the renewal date or 12 months from the date of issuance of this Master Direction and the agreements that come into force on or after October 1, 2023, must comply with the provisions of these Directions from the date of the agreement itself.

• Outsourcing of IT Services includes outsourcing the following activities:
  • IT infrastructure management, maintenance, and support (hardware, software, or firmware)
  • Network and security solutions, maintenance (hardware, software, or firmware).
  • Application Development, Maintenance, and Testing; Application Service Providers (ASPs) including ATM Switch ASPs
  • Services and operations related to Data Centres
  • Cloud Computing Services
  • Managed Security Services
  • Management of IT infrastructure and technology services associated with the payment system ecosystem.
    

• Chapter II:
  • Board and Senior Management shall be ultimately responsible for the outsourced activity.
  • REs shall evaluate the need for Outsourcing of IT Services based on comprehensive assessment of attendant benefits, risks and availability of commensurate processes to manage those risks.
  • REs shall ensure that the service provider shall not be owned or controlled by any director, or key managerial personnel, or approver of the outsourcing arrangement of the RE, or their relatives
  • All relevant laws, regulations, rules, guidelines and conditions of approval, licensing or registration, shall be considered when performing due diligence in relation to outsourcing of IT services
  • Responsibility for the redressal of customers’ grievances related to outsourced services shall rest with the RE.
  • Outsourcing arrangements shall not affect the rights of a customer against the RE, including the ability of the customer to obtain redressal as applicable under relevant laws
  • REs shall create an inventory of services provided by the service providers (including key entities involved in their supply chains) and map their dependency on third parties and periodically evaluate the information received from the service providers.
    

• Chapter III:
  • REs shall put in place a comprehensive Board approved IT outsourcing policy that includes the roles and responsibilities of the Board, the Senior Management, and the IT function as well as the criteria for the selection of such activities and the service providers.
    

• Chapter IV:
  • Appropriate due diligence shall be performed to assess the capability of the service provider to comply with obligations in the outsourcing agreement on an ongoing basis and a risk-based approach shall be adopted in conducting such due diligence activities.
  • Due diligence shall involve evaluation of all available information, as applicable, about the service provider, including but not limited to past experience and demonstrated competence, financial soundness, business reputation, conflict of interest, external factors, details of the technology, infrastructure stability, capability to comply with the regulatory and legal requirements, information/ cyber security risk assessment.
    

• Chapter V:
  • The terms and conditions governing the contract shall be carefully defined and vetted by the RE’s legal counsel for their legal effect and enforceability.
  • The agreement at a minimum should include:
    • details of the activity being outsourced
    • effective access by the RE to all data, books, records, information, logs, alerts and business premises relevant to the outsourced activity
    • regular monitoring and assessment of the service provider
    • type of adverse events and incidents required to be reported
    • compliance with the provisions of Information Technology Act, 2000
    • the deliverables and Service-Level Agreements (SLAs)
    • storage of data only in India
    • service provider to provide details of data captured, processed and stored
    • controls for maintaining confidentiality of data
    • types of data that the service provider is permitted to share with RE’s customer or any other party
    • specifying the resolution process, events of default, indemnities, remedies and recourse available
    • contingency plans
    • right to conduct audit of the service provider
    • right to seek information from the service provider about the third parties in their supply chain
    • allow RBI or person(s) authorised by it to access the RE's IT infrastructure, applications, data, documents, and other necessary information
    • the service provider is contractually liable for the performance and risk management practices of its sub-contractors
    • obligation of the service provider to comply with directions issued by the RBI
    • requirement of prior approval/ consent of the RE for use of subcontractors by the service provider
    • termination rights of the RE
    • obligation of the service provider to co-operate with the relevant authorities in case of insolvency/ resolution of the RE
    • provision to consider skilled resources of service provider
    • suitable back-to-back arrangements between service providers and the OEMs
    • non-disclosure agreement (NDA).
      

• Chapter VI:
  • REs shall put in place a Risk Management framework for Outsourcing of IT Services that shall comprehensively deal with the processes and responsibilities for identification, measurement, mitigation, management, and reporting of risks associated with Outsourcing of IT Services arrangements
  • The risk assessments carried out by the REs shall be documented with necessary approvals in line with the roles and responsibilities as determined by the Board-approved policy.
  • REs shall be responsible for the confidentiality and integrity of data.
  • Access to data at RE’s location / data centre by service providers shall be on need-to-know basis, with appropriate controls to prevent security breaches and/or data misuse
  • Access to data at RE’s location / data centre by service providers shall be on need-to-know basis, with appropriate controls to prevent security breaches and/or data misuse.
  • REs shall seek to ensure the preservation and protection of the security and confidentiality of customer information in the custody or possession of the service provider. Access to customer information by staff of the service provider shall be on need-to-know basis.
  • In the event of multiple service provider relationships where two or more service providers collaborate to deliver an end-to-end solution, the RE remains responsible for understanding and monitoring the control environment of all service providers that have access to the RE’s data, systems, records or resources
  • Cyber incidents must be reported to the RE by the service provider without undue delay, so that the incident is reported by the RE to the RBI within 6 hours of detection by the TPSP
  • The REs shall review and monitor the control processes and security practices of the service provider to disclose security breaches.
  • REs shall adhere to the extant instructions issued by RBI from time to time on Incident Response and Recovery Management.
  • REs shall effectively assess the impact of concentration risk posed by multiple outsourcings to the same service provider
  • REs shall require their service providers to develop and establish a robust framework for documenting, maintaining and testing Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP).
  • REs shall consider the availability of alternative service providers or the possibility of bringing the outsourced activity back in an emergency.
    

• Chapter VII:
  • REs shall have in place a management structure to monitor and control its Outsourced IT activities.
  • RE shall conduct regular audits of service providers as applicable to the scope of Outsourced IT Services.
  • In scenarios where more than one RE may be availing services from the same third-party service provider, they may adopt pooled (shared) audit.
  • The frequency of the audit shall be determined based on the nature and extent of risk and impact to the RE from the outsourcing arrangements.
  • REs, depending upon the risk assessment, may also rely upon globally recognised third-party certifications made available by the service provider in lieu of conducting independent audits
  • The RE shall periodically review the financial and operational condition of the service provider to assess its ability to continue to meet its Outsourcing of IT Services obligations
  • In the event of termination of the outsourcing agreement for any reason in cases where the service provider deals with the customers of the RE, the same shall be given due publicity by the RE so as to ensure that the customers stop dealing with the concerned service provider.
    

• Chapter VIII:
  • A RE may outsource any IT activity/ IT enabled service within its business group/ conglomerate, provided that such an arrangement is backed by the Board-approved policy and appropriate service level arrangements/ agreements with its group entities are in place.
    

• Chapter IX:
  • The engagement of a service provider based in a different jurisdiction exposes the RE to country risk. To manage such risk, the RE shall closely monitor government policies of the jurisdiction in which the service provider is based and the political, social, economic and legal conditions on a continuous basis.
  • The right of the RE and the RBI to direct and conduct audit or inspection of the service provider based in a foreign jurisdiction shall be ensured.
    

• Chapter X:
  • The Outsourcing of IT Services policy shall contain a clear exit strategy regarding outsourced IT activities/ IT enabled services, while ensuring business continuity during and after exit.
  • REs shall ensure that the agreement has necessary clauses on safe removal/ destruction of data, hardware and all records (digital and physical), as applicable.
  • The service provider is prohibited from erasing, purging, revoking, altering or changing any data during the transition period, unless specifically advised by the regulator/ concerned RE.

• The Master Direction also includes three appendices regarding:
• Usage of Cloud Computing Services
• Outsourcing of Security Operations Centre (SOC)
• Services not considered under Outsourcing of IT Services
  

• Appendix – I (Usage of Cloud Computing Services):
  • The business strategy and goals adopted to the current IT applications footprint and associated costs must be analysed
  • The Outsourcing of IT Services policy must address the entire lifecycle of data from generation of the data, its entry into the cloud, till the data is permanently erased/ deleted
  • REs shall consider the factors of multi-tenancy, multi-location storing / processing of data, etc., and attendant risks, while establishing appropriate risk management framework
  • REs shall adopt and demonstrate a well-established and documented cloud adoption policy that provide for appropriate due diligence to manage and continually monitor the risks associated with CSPs
  • REs shall prefer a technology architecture that provides for secure container-based data management, where encryption keys and Hardware Security Modules are under the control of the RE.
  • IAM shall be agreed upon with the CSP and ensured for providing role-based access to the cloud hosted applications
  • Implementation of security controls in the cloud-based application must achieve similar or higher degree of control objectives than those achieved by on-premise application
  • REs shall accurately define minimum monitoring requirements in the cloud environment.
  • Integration of logs, events from the CSP into the RE’s SOC, wherever applicable and retention of relevant logs in cloud shall be ensured for incident reporting
  • REs shall ensure that CSPs have a well-governed and structured approach to manage threats and vulnerabilities
  • Robust incident response and recovery practices including conduct of Disaster Recovery (DR) drills at various levels of cloud services including necessary stakeholders.
    

• Appendix – II (Outsourcing of Security Operations Centre (SOC)):
  • Unambiguously identify the owner of assets used in providing the services
  • Ensure that the RE has adequate oversight and ownership over the rule definition, customisation and related data/ logs, meta-data and analytics
  • Assess periodically all physical facilities involved in service delivery, such as the SOC and areas where client data is stored / processed
  • Integrate the outsourced SOC reporting and escalation process with the RE’s incident response process
    

• Appendix – III (Services not considered under Outsourcing of IT Services):
  • Services / Activities not considered under “Outsourcing of IT Services” for the purpose of this Master Direction:
    • Corporate Internet Banking services
    • External audit such as Vulnerability Assessment/ Penetration Testing (VA/PT), Information Systems Audit, security review
    • SMS gateways
    • Procurement of IT hardware/ appliances
    • Acquisition of IT software/ product/ application on a licence or subscription basis
    • Any maintenance service for IT Infra or licensed products, provided by the OEM
    • Applications provided by financial sector regulators or institutions like CCIL, NSE, BSE, etc.
    • Services obtained by a RE as a sub-member of a Centralised Payment Systems (CPS) from another RE
    • Business Correspondent (BC) services, payroll processing, statement printing

• Vendors / Entities who are not considered as Third-Party Service Provider for the purpose of this Master Direction:
  • Vendors providing business services using IT
  • Payment System Operators authorised by the RBI
  • Partnership based Fintech firms providing co-branded applications, service, products
  • Services of Fintech firms for data retrieval, data validation and verification services such as Bank statement analysis, GST returns analysis, Fetching of vehicle information, Digital document execution, Data entry and Call centre service
  • Telecom Service Providers from whom leased lines or other similar kind of infrastructure are availed and used for transmission of the data
  • Security/ Audit Consultants appointed for certification/ audit/ VA-PT related to IT infra/ IT services/ Information Security services.

• The detailed control requirements for each of the chapters and appendices are described in the Master Directions Circular.