On this page
RBI IT Governance, Risk, Controls and Assurance Practices Audit
Codec Networks is an Information Security Auditing Organization, providing independent, evidence-based and risk-focused audits to help applicable banks, Small Finance Banks, Payments Banks, specified NBFCs, Credit Information Companies, All India Financial Institutions and foreign banks operating in India to assess compliance with the Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023. The audit evaluates whether the regulated entity has established effective governance, risk management, cybersecurity, IT operations, third-party controls, business continuity, disaster recovery and Information Systems Audit arrangements required as per the RBI Directions.
Codec Networks is a CERT-In empanelled auditing organization mandated to offer this service
Codec Networks assesses the design, implementation and operating effectiveness of controls across Board and management oversight, IT strategy, asset and access management, change and patch management, audit trails, cryptography, cloud and vendor risk, information security governance, SOC operations, vulnerability assessment and penetration testing, cyber-incident response, BCP/DR and regulatory reporting. The engagement applies a risk-based audit approach, focusing additional attention on critical systems, customer-facing applications, sensitive information, high-risk processes, outsourced services and previously unresolved observations. RBI audits are a core component of Codec Networks’ BFSI-focused GRC and regulatory assurance portfolio.
Codec Networks Audits are conducted through qualified and authorised audit personnel using independent, objective and evidence-based practices aligned with applicable RBI requirements and CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines. The service includes audit planning, regulatory control mapping, document and evidence review, stakeholder interviews, technical validation, risk classification, executive reporting, remediation recommendations and follow-up verification, helping regulated entities achieve sustainable compliance and improved cyber resilience rather than checklist-based assurance alone.
RBI IT Governance, Risk, Controls and Assurance Practices Audit
INDUSTRY SIGNIFICANCE AND SERVICE RELEVANCE
Why this service matters to your industry, where it fits in your security
programme, and what your organisation gains from it.
Financial institutions operate highly interconnected digital environments that support payments, customer services, lending, treasury, regulatory reporting and other critical banking operations. Failures in IT governance, cyber controls, third-party oversight, incident response or disaster recovery can result in service disruption, financial loss, customer harm and regulatory exposure. The RBI Directions therefore place direct accountability on Boards and senior management for IT strategy, information security, cyber-risk management, resilience and assurance, while requiring risk-based Information Systems audits and periodic review of critical technology risks.
Codec Networks’ RBI IT Governance, Risk, Controls and Assurance Audit service helps regulated entities independently determine whether their governance framework and technology controls are appropriately designed, implemented and operating effectively. The service is particularly relevant for:
- Scheduled Commercial Banks, Small Finance Banks and Payments Banks
- Foreign banks operating in India
- Applicable Middle, Upper and Top Layer NBFCs
- Credit Information Companies and All India Financial Institutions
- Organizations undergoing digital transformation, cloud migration, outsourcing or major technology change
- Entities preparing for RBI inspection, Board review or regulatory remediation
The audit focuses on areas that materially affect operational resilience, including IT governance, access management, change and patch management, audit logs, cryptography, vendor and cloud risk, VAPT, cyber-incident management, SOC operations, BCP and disaster recovery.
Through an independent, evidence-based and risk-focused assessment, Codec Networks helps management prioritize high-risk gaps, improve control effectiveness, demonstrate regulatory accountability and establish a structured remediation roadmap. The engagement aligns RBI requirements with applicable CERT-In auditing practices, including comprehensive scoping, objective evidence collection, manual and technical validation, risk-based testing, executive reporting and follow-up verification.
Codec Networks’ RBI IT Governance, Risk, Controls and Assurance Audit service is designed for organizations regulated under the Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, Applicable customers include:
- Scheduled Commercial Banks, including foreign banks operating in India
- Small Finance Banks and Payments Banks
- NBFCs classified in the Middle, Upper and Top Layers
- Credit Information Companies
- All India Financial Institutions, including EXIM Bank, NABARD, NaBFID, NHB and SIDBI
- Technology service providers, cloud partners and outsourced service providers supporting RBI-regulated entities, where their controls form part of the regulated entity’s risk and assurance scope
The Directions exclude Local Area Banks and NBFC-Core Investment Companies, while foreign bank branches are permitted a “comply or explain” approach subject to RBI acceptance.
The service is especially valuable for institutions preparing for RBI inspection, annual IS audit, Board or Audit Committee review, regulatory remediation, major technology transformation, cloud migration, outsourcing, new product implementation or post-incident control validation. Codec Networks assesses whether the organisation’s governance, technology, cybersecurity, resilience and assurance controls are adequately designed, implemented and operating effectively.
Key customer benefits include:
- Independent validation of compliance with RBI requirements
- Identification and prioritization of critical IT and cyber risks
- Improved Board, Audit Committee and senior-management visibility
- Stronger governance, accountability and control ownership
- Better protection of customer data, critical applications and digital services
- Enhanced vendor, cloud and supply-chain risk management
- Improved incident response, SOC monitoring, BCP and disaster-recovery readiness
- Practical remediation plans with risk-based timelines and follow-up validation
- Reduced likelihood of regulatory observations, service disruption and repeat audit findings
- Evidence-based reports supporting RBI supervision, internal audit and management decision-making
The engagement follows a comprehensive, evidence-based and risk-focused audit approach aligned with RBI requirements and CERT-In audit practices. It helps customers move beyond checklist compliance by strengthening operational resilience, control effectiveness and long-term cyber maturity.
Financial institutions operate highly interconnected digital environments that support payments, customer services, lending, treasury, regulatory reporting and other critical banking operations. Failures in IT governance, cyber controls, third-party oversight, incident response or disaster recovery can result in service disruption, financial loss, customer harm and regulatory exposure. The RBI Directions therefore place direct accountability on Boards and senior management for IT strategy, information security, cyber-risk management, resilience and assurance, while requiring risk-based Information Systems audits and periodic review of critical technology risks.
Codec Networks’ RBI IT Governance, Risk, Controls and Assurance Audit service helps regulated entities independently determine whether their governance framework and technology controls are appropriately designed, implemented and operating effectively. The service is particularly relevant for:
- Scheduled Commercial Banks, Small Finance Banks and Payments Banks
- Foreign banks operating in India
- Applicable Middle, Upper and Top Layer NBFCs
- Credit Information Companies and All India Financial Institutions
- Organizations undergoing digital transformation, cloud migration, outsourcing or major technology change
- Entities preparing for RBI inspection, Board review or regulatory remediation
The audit focuses on areas that materially affect operational resilience, including IT governance, access management, change and patch management, audit logs, cryptography, vendor and cloud risk, VAPT, cyber-incident management, SOC operations, BCP and disaster recovery.
Through an independent, evidence-based and risk-focused assessment, Codec Networks helps management prioritize high-risk gaps, improve control effectiveness, demonstrate regulatory accountability and establish a structured remediation roadmap. The engagement aligns RBI requirements with applicable CERT-In auditing practices, including comprehensive scoping, objective evidence collection, manual and technical validation, risk-based testing, executive reporting and follow-up verification.
Codec Networks’ RBI IT Governance, Risk, Controls and Assurance Audit service is designed for organizations regulated under the Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, Applicable customers include:
- Scheduled Commercial Banks, including foreign banks operating in India
- Small Finance Banks and Payments Banks
- NBFCs classified in the Middle, Upper and Top Layers
- Credit Information Companies
- All India Financial Institutions, including EXIM Bank, NABARD, NaBFID, NHB and SIDBI
- Technology service providers, cloud partners and outsourced service providers supporting RBI-regulated entities, where their controls form part of the regulated entity’s risk and assurance scope
The Directions exclude Local Area Banks and NBFC-Core Investment Companies, while foreign bank branches are permitted a “comply or explain” approach subject to RBI acceptance.
The service is especially valuable for institutions preparing for RBI inspection, annual IS audit, Board or Audit Committee review, regulatory remediation, major technology transformation, cloud migration, outsourcing, new product implementation or post-incident control validation. Codec Networks assesses whether the organisation’s governance, technology, cybersecurity, resilience and assurance controls are adequately designed, implemented and operating effectively.
Key customer benefits include:
- Independent validation of compliance with RBI requirements
- Identification and prioritization of critical IT and cyber risks
- Improved Board, Audit Committee and senior-management visibility
- Stronger governance, accountability and control ownership
- Better protection of customer data, critical applications and digital services
- Enhanced vendor, cloud and supply-chain risk management
- Improved incident response, SOC monitoring, BCP and disaster-recovery readiness
- Practical remediation plans with risk-based timelines and follow-up validation
- Reduced likelihood of regulatory observations, service disruption and repeat audit findings
- Evidence-based reports supporting RBI supervision, internal audit and management decision-making
The engagement follows a comprehensive, evidence-based and risk-focused audit approach aligned with RBI requirements and CERT-In audit practices. It helps customers move beyond checklist compliance by strengthening operational resilience, control effectiveness and long-term cyber maturity.
AUDIT FEATURES AND DELIVERY FRAMEWORK
Cybersecurity at Codec Networks means comprehensive features,
scalable offerings, effective delivery methods, performance-driven
Codec Networks provides independent, risk-based Information Systems and cybersecurity audit services to assess an RBI-regulated entity’s alignment with the Reserve Bank of India Directions, the engagement evaluates the design and operating effectiveness of relevant governance, technical, operational and resilience controls within the mutually agreed audit scope. It is structured as an evidence-based, point-in-time assessment and does not replace the auditee’s continuing responsibility for regulatory compliance, cybersecurity operations or risk management.
Key Service Features
- RBI clause-based compliance assessment: Mapping and assessment of applicable requirements , including IT governance, technology operations, information security, cyber-risk management, business continuity, disaster recovery and IS audit.
- Board and management governance review: Evaluation of Board-approved strategies and policies, IT Strategy Committee oversight, IT Steering Committee responsibilities, senior-management accountability, Head of IT responsibilities and information-security governance .
- IT infrastructure and service-control assessment: Review of IT service management, third-party arrangements, capacity, project governance, change and patch management, data migration, audit trails, cryptography, access control, teleworking and performance metrics
- IT and information-security risk assessment: Assessment of risk governance, critical-system identification, information-security controls, CISO oversight, vulnerability management, incident response and recovery .
- Vulnerability assessment and penetration-testing review: Verification of the organisation’s VA/PT governance, scope, periodicity, independence, production-environment coverage, remediation and vulnerability-scoring practices . Where technical testing forms part of the engagement, the scope, environment, permissions and rules of engagement are agreed in writing before testing.
- Cyber-incident and SOC control review: Assessment of incident classification, escalation, communication, forensic analysis, corrective action, reporting and lessons learned .
- Business continuity and disaster-recovery assurance: Review of BCP/DR governance, recovery objectives, backup restoration, DR drills, DC–DR configuration consistency, vendor resilience and recovery preparedness.
- Risk-based IS audit planning: Audit coverage and testing depth are determined using business criticality, asset sensitivity, threat exposure, regulatory significance, previous observations, change history and control maturit .
- Evidence-based reporting: Findings are supported by relevant and verifiable evidence, with clear identification of the applicable requirement, observed condition, associated risk, management response and recommended corrective action.
- Executive and Board-level reporting: Management summaries translate technical observations into business, operational, regulatory and resilience risks to support informed decision-making.
- Remediation and revalidation support: Follow-up verification may be performed within the agreed engagement to assess whether reported observations have been addressed. Closure is based on evidence available at the time of revalidation and does not constitute a continuing guarantee of future compliance or security.
Codec Networks follows a structured, independent and risk-based methodology for assessing an organisation’s alignment as per applicable RBI directions and guidelines. The methodology reflects applicable CERT-In cyber security audit principles and is tailored to the auditee’s business profile, technology environment, critical systems, outsourcing arrangements and regulatory obligations
1. Engagement Initiation and Independence Review
Codec Networks begins with confirmation of the engagement objectives, applicable RBI requirements, stakeholder expectations, independence considerations, confidentiality obligations and potential conflicts of interest. Commercial terms are based on the agreed scope, deliverables and timelines. CERT-In principles require independence, objectivity, integrity, professional judgement, professional care, confidentiality and accountability throughout the audit.
2. Scope Definition and Asset-Based Planning
The audit scope is jointly documented with the auditee and derived from the available asset inventory, business processes, critical applications, infrastructure, databases, cloud environments, APIs, outsourced services and relevant third-party dependencies. Scope coverage, exclusions, limitations, testing environments, reporting format, timelines and data-handling requirements are agreed before commencement.
The audit does not imply unrestricted or universal coverage. CERT-In guidance expects the scope to be based on an updated asset inventory and to include development, testing, UAT and production environments where relevant.
3. Risk Profiling and Audit Prioritisation
Codec Networks develops an audit-risk profile considering:
- Criticality of business services and information systems
- Confidentiality, integrity and availability requirements
- Customer-facing and internet-exposed systems
- Sensitive and regulated data
- Previous audit observations and repeat findings
- Cyber incidents, fraud indicators and threat intelligence
- Major technology changes and cloud migration
- Third-party and concentration risk
- Vulnerability, patching and end-of-support exposure
- RTO, RPO and service-resilience requirements
4. Regulatory and Control Mapping
Applicable RBI requirements are converted into an audit programme covering:
- Governance and oversight
- IT infrastructure and service management
- IT and information-security risk management
- BCP and disaster recovery
- Information Systems Audit
Applicable CERT-In directions, advisories, audit baseline requirements and relevant industry frameworks may also be considered where included in the agreed audit criteria. CERT-In guidance requires regulator-issued directions and guidelines to form part of the audit scope by default and discourages reliance on tools alone.
5. Document Review and Stakeholder Walkthroughs
The audit team reviews relevant policies, procedures, committee records, risk registers, asset inventories, architecture documents, system configurations, access records, change tickets, incident records, vendor assessments, DR results and other agreed evidence.
Interviews and walkthroughs are conducted with relevant Board representatives, senior management, IT, information security, risk, internal audit, business owners, SOC personnel, compliance teams and service providers. Audit conclusions are not based solely on documented policies; implementation and operational evidence are also examined.
6. Control Design and Operating-Effectiveness Testing
Controls are assessed at two levels:
- Design effectiveness: Whether the control is appropriately structured to address the identified risk and regulatory requirement.
- Operating effectiveness: Whether the control has been implemented, is consistently performed and produces reliable evidence.
Testing may include inspection, observation, inquiry, walkthroughs, sampling, reconciliation, configuration review, log review, access review and controlled technical validation. Sample sizes and testing depth depend on risk, transaction volume, control frequency, system criticality and evidence availability.
7. Technical Validation and Authorized Security Testing
Where technical security testing is included, Codec Networks defines the target assets, testing environment, permitted techniques, source IP addresses, testing window, escalation contacts and stop conditions in written rules of engagement.
Penetration testing, denial-of-service testing, social engineering, survivability testing or other potentially disruptive activities are not performed without explicit written approval. Critical production environments may be assessed using controlled or passive techniques where availability risk is significant.
8. Finding Validation and Risk Classification
Potential observations are validated with process and control owners before finalization. Each confirmed finding may include:
- Applicable RBI clause or audit criterion
- Observation and supporting evidence
- Affected asset, process or business service
- Risk and potential business impact
- Root cause, where reasonably determinable
- Existing compensating controls
- Risk classification and priority
- Recommended corrective action
- Management response and proposed timeline
Technical vulnerabilities may be assessed using CVSS, EPSS, CWE and CVE references where applicable.
9. Independent Quality Review
Audit work and reports are subjected to an internal maker-checker or independent review process. The reviewer evaluates the sufficiency of evidence, consistency of risk ratings, accuracy of regulatory references, completeness of scope coverage and practicality of recommendations before report authorization.
10. Reporting and Management Communication
The deliverables may include:
- Executive summary and overall control-posture assessment
- Detailed clause-wise compliance report
- Risk-rated observation register
- Evidence and sampling index
- Repeat-observation status
- Management action plan
- Recommended remediation priorities
- Board or Audit Committee presentation
- Follow-up or revalidation report, where contracted
The report clearly records scope, period, methodology, tools and manual procedures used, sampling decisions, exclusions, limitations and other constraints. Audit observations are supported by objective evidence suitable for risk-based management decisions.
11. Remediation Follow-Up and Closure Verification
After management completes corrective action, Codec Networks may perform revalidation against the original observation and evidence requirements. The outcome may be recorded as closed, partially closed, open, risk accepted or not verifiable. Any risk acceptance remains the responsibility of the authorized management of the auditee organization. Revalidation confirms the status observed at the time of review and does not provide an indefinite assurance against future changes, vulnerabilities, incidents or regulatory interpretation.
Please Note
Codec Networks provides independent, risk-based Information Systems and cybersecurity audit services to assess alignment with applicable RBI requirements and agreed audit criteria. Audit conclusions are based on the defined scope, evidence made available and conditions existing during the assessment period. Responsibility for compliance, remediation, risk acceptance and ongoing security remains with the auditee organization.
Codec Networks adopts an independent, evidence-based and risk-focused audit approach for assessing alignment with the Reserve Bank of India Directions and guidelines. The approach is guided by applicable CERT-In cyber security audit principles and is tailored to the regulated entity’s business model, technology landscape, critical information assets, outsourced services and risk exposure.
1. Risk-Based Scope and Planning
The audit scope is developed from the auditee’s updated asset inventory, critical business services, applications, infrastructure, databases, cloud environments, third-party dependencies, previous findings and recent technology changes. Greater audit attention is directed toward critical systems, customer-facing services, sensitive information, high-risk vendors and areas with significant operational or cyber-resilience impact.
2. RBI Clause-Wise Assessment
Codec Networks structures the audit against the applicable RBI requirements covering:
- IT governance and oversight
- IT infrastructure and service management
- IT and information-security risk management
- Business continuity and disaster recovery
- Information Systems Audit governance
The assessment considers whether required policies, governance structures, responsibilities, controls and monitoring mechanisms are appropriately established and implemented.
3. Design and Operating-Effectiveness Review
Controls are evaluated for:
- Design effectiveness: whether the control is appropriately structured to address the relevant RBI requirement and identified risk.
- Operating effectiveness: whether the control is functioning consistently and is supported by reliable evidence.
Audit procedures may include document review, stakeholder interviews, process walkthroughs, sampling, configuration validation, access review, log examination, incident-record review and inspection of BCP/DR, vendor-risk and vulnerability-management evidence.
4. Independent and Evidence-Based Validation
Audit conclusions are based on relevant, sufficient and verifiable evidence rather than declarations, policy documents or automated tools alone. Codec Networks applies independence, objectivity, professional judgement, confidentiality and professional care throughout the engagement, in line with CERT-In audit principles.
Technical testing, where included, is conducted only within the agreed scope, authorised environment, testing window and written rules of engagement. Potentially disruptive tests are undertaken only with explicit written approval.
5. Risk-Rated Findings and Management Reporting
Confirmed observations are mapped to the relevant RBI clause and supported by objective evidence. Findings may include the observed condition, associated business and cyber risk, affected process or asset, existing controls and recommended corrective action.
Critical and high-risk matters are communicated promptly. The final report may include:
- Executive and Board-level summary
- RBI clause-wise compliance assessment
- Risk-rated observations
- Evidence and sampling references
- Repeat-finding status
- Management action plan
- Recommended remediation priorities
Technical vulnerabilities may be classified using CVSS and supplemented by EPSS, CWE and CVE references where applicable.
6. Quality Review and Follow-Up
Audit work and reports are subjected to an independent maker-checker review for scope coverage, evidence sufficiency, risk-rating consistency and accuracy of regulatory references. Where included in the engagement, follow-up verification is performed to assess corrective actions and record findings as closed, partially closed, open, risk accepted or not verifiable.
Codec Networks’ audit represents an independent, point-in-time assessment based on the mutually agreed scope, evidence made available and conditions existing during the audit period. Responsibility for continuing compliance, control operation, remediation and risk acceptance remains with the auditee organisation.
For RBI IT Governance, Risk, Controls and Assurance audits, Codec Networks may use the following internationally recognized standards and frameworks as supplementary assessment references, depending on the agreed scope and technology environment:
- ISO/IEC 27001 and ISO/IEC 27002 – Information security governance and control practices
- ISO/IEC 27005 and ISO 31000 – Information security and enterprise risk management
- ISO 22301 – Business continuity and disaster-recovery management
- ISO/IEC 20000-1 – IT service-management controls
- ISO/IEC 27017 and ISO/IEC 27018 – Cloud security and protection of personal information in cloud environments
- CSA Cloud Controls Matrix – Cloud security control assessment
- OWASP WSTG, ASVS and Mobile Security Testing Guide – Application, API and mobile security testing
- OSSTMM – Structured security-testing methodology
Please Note
The RBI Directions and other applicable regulatory requirements remain the primary audit criteria; international standards are used only as supporting references where relevant. Their use does not constitute ISO certification, regulatory approval or a guarantee that all vulnerabilities will be identified. Audit conclusions are limited to the mutually agreed scope, systems made accessible, evidence provided and conditions existing during the assessment period.
Codec Networks provides independent, risk-based Information Systems and cybersecurity audit services to assess an RBI-regulated entity’s alignment with the Reserve Bank of India Directions, the engagement evaluates the design and operating effectiveness of relevant governance, technical, operational and resilience controls within the mutually agreed audit scope. It is structured as an evidence-based, point-in-time assessment and does not replace the auditee’s continuing responsibility for regulatory compliance, cybersecurity operations or risk management.
Key Service Features
- RBI clause-based compliance assessment: Mapping and assessment of applicable requirements , including IT governance, technology operations, information security, cyber-risk management, business continuity, disaster recovery and IS audit.
- Board and management governance review: Evaluation of Board-approved strategies and policies, IT Strategy Committee oversight, IT Steering Committee responsibilities, senior-management accountability, Head of IT responsibilities and information-security governance .
- IT infrastructure and service-control assessment: Review of IT service management, third-party arrangements, capacity, project governance, change and patch management, data migration, audit trails, cryptography, access control, teleworking and performance metrics
- IT and information-security risk assessment: Assessment of risk governance, critical-system identification, information-security controls, CISO oversight, vulnerability management, incident response and recovery .
- Vulnerability assessment and penetration-testing review: Verification of the organisation’s VA/PT governance, scope, periodicity, independence, production-environment coverage, remediation and vulnerability-scoring practices . Where technical testing forms part of the engagement, the scope, environment, permissions and rules of engagement are agreed in writing before testing.
- Cyber-incident and SOC control review: Assessment of incident classification, escalation, communication, forensic analysis, corrective action, reporting and lessons learned .
- Business continuity and disaster-recovery assurance: Review of BCP/DR governance, recovery objectives, backup restoration, DR drills, DC–DR configuration consistency, vendor resilience and recovery preparedness.
- Risk-based IS audit planning: Audit coverage and testing depth are determined using business criticality, asset sensitivity, threat exposure, regulatory significance, previous observations, change history and control maturit .
- Evidence-based reporting: Findings are supported by relevant and verifiable evidence, with clear identification of the applicable requirement, observed condition, associated risk, management response and recommended corrective action.
- Executive and Board-level reporting: Management summaries translate technical observations into business, operational, regulatory and resilience risks to support informed decision-making.
- Remediation and revalidation support: Follow-up verification may be performed within the agreed engagement to assess whether reported observations have been addressed. Closure is based on evidence available at the time of revalidation and does not constitute a continuing guarantee of future compliance or security.
CODEC NETWORKS VALUE PROPOSITION
Beyond protection, Codec Networks delivers value additions that strengthen compliance,
build digital trust, and empower business innovation.
RBI, SEBI, IRDAI, NPCI, UIDAI and Other Regulatory Audits
Codec Networks, a CERT-In empanelled Information Security Auditing Organisation, delivers independent, risk-based cybersecurity and compliance audits for regulated entities across banking, NBFC, FinTech, securities, insurance, payments, Aadhaar-enabled services, government, healthcare and critical infrastructure sectors.
Our value proposition combines regulatory understanding, cybersecurity expertise, structured audit methodology and evidence-driven assurance to help organizations identify compliance gaps, strengthen controls and demonstrate regulatory readiness.
1. Regulatory and Framework-Aligned Audit Assurance
- Audits applicable requirements issued by RBI, SEBI, IRDAI, NPCI, UIDAI, CERT-In and other relevant authorities.
- Maps regulatory obligations with ISO/IEC 27001:2022, ISO 27002, ISO 27005, ISO 22301, NIST CSF, COBIT, CIS Controls and applicable data-protection requirements.
- Converts complex regulatory provisions into practical audit criteria, control requirements, evidence expectations and accountable actions.
- Supports consistent compliance across applications, infrastructure, cloud, networks, data centres, branches, third parties and digital ecosystems.
2. CERT-In Empanelled and Risk-Based Audit Approach
- Applies a structured methodology aligned with applicable CERT-In requirements and recognized auditing principles.
- Evaluates both control design—Test of Design—and operating effectiveness—Test of Effectiveness.
- Prioritizes observations according to regulatory significance, threat exposure, business criticality, likelihood and potential impact.
- Maintains professional independence, confidentiality, evidence integrity and appropriate segregation between audit and remediation activities.
3. Multidisciplinary Regulatory and Cybersecurity Expertise
- Deploys auditors and specialists with experience in information security, IT governance, VAPT, cloud security, application security, SOC, incident response, privacy and business continuity.
- Brings relevant professional competencies such as CISA, CISSP, CISM, ISO 27001 Lead Auditor/Implementer, CEH and cloud-security certifications, subject to engagement requirements.
- Understands sector-specific technology, operating models, outsourcing arrangements, payment environments, digital channels and sensitive-data ecosystems.
- Integrates governance, process and technical testing to provide a complete view of regulatory cyber risk.
4. Comprehensive Audit Coverage
- Covers cybersecurity governance, IT risk management, asset management, identity and access management, secure configuration, vulnerability management and security monitoring.
- Reviews application, API, mobile, network, cloud, database, endpoint, data-protection and third-party security controls, as applicable.
- Assesses incident response, regulatory reporting, business continuity, disaster recovery, cyber resilience, log management and forensic readiness.
- Validates policies, procedures, contracts, configurations, records, system-generated evidence, samples and stakeholder practices.
5. Evidence-Driven Findings and Actionable Remediation
- Links each finding to the applicable regulatory clause, audit criterion, supporting evidence and affected system or process.
- Clearly distinguishes compliant, partially compliant, non-compliant and not-applicable requirements.
- Provides risk-rated observations with business impact, root-cause considerations, recommended corrective actions, ownership and target timelines.
- Supports structured management responses, corrective-action tracking and re-testing of remediated observations within the agreed scope.
6. Management Visibility and Regulatory Readiness
- Delivers executive summaries, detailed audit reports, compliance matrices, risk heat maps and prioritized remediation roadmaps.
- Provides traceability from regulatory requirements to controls, audit procedures, evidence reviewed and audit conclusions.
- Helps boards, senior management, CISOs, compliance officers and technology teams understand material exposures and required decisions.
- Strengthens readiness for regulatory inspections, supervisory reviews, internal audits, certification audits and customer assurance requirements.
7. Independent, Scalable and Business-Focused Delivery
- Adapts the audit approach to the organization’s size, complexity, risk profile, technology architecture and regulatory classification.
- Supports single-entity, multi-location, group-wide and ecosystem-based audits through onsite, remote or hybrid delivery models.
- Coordinates audit activities to reduce operational disruption while preserving audit independence and testing sufficiency.
- Enables organizations to transform regulatory compliance from a periodic exercise into a sustainable governance and cyber-resilience capability.
Why Customers Should Choose Codec Networks
Customers should consider Codec Networks for the combination of CERT-In empanelment, regulatory-domain understanding, multidisciplinary technical capability, risk-based testing and practical reporting. Our audits are designed not merely to identify documentary gaps, but to determine whether critical cybersecurity controls are appropriately designed, consistently implemented and demonstrably effective.
The result is greater regulatory confidence, stronger cyber resilience, improved management accountability and a clearly prioritized path toward sustained compliance.
Disclaimer: Audit scope, procedures and conclusions depend on the applicable regulation, agreed terms of reference, systems and locations included, sampling methodology, evidence provided and conditions existing during the audit period. An audit provides reasonable assurance within its defined scope and does not constitute a guarantee against cyber incidents, regulatory action or future control failure. CERT-In empanelment should be represented strictly in accordance with applicable CERT-In conditions and should not be construed as an endorsement of any commercial claim or as certification by CERT-In.
Founded in 2008 with 17+ Years of Industry Experience in Information and Cyber Security domain
Codec Networks Full-Spectrum Cybersecurity Expertise across all Industry Domains:
- Security Vulnerability Assessment & Penetration Testing (VAPT): Covering Web, Mobile, API, IoT, Blockchain, Cloud-Native, and smart infrastructure environments, with a focus on OWASP, MITRE ATT&CK, and real-world exploit simulation.
- Offensive Security & Deep Level Security Assessments: Advanced Red Team, Blue Team and Purple Team Exercises, Threat Simulations, Social Engineering Campaigns, and Secure Code Review.
- IT Security Audit & Compliance Services: Implementation and audit support for ISO/IEC 27001, ISO 27701, NIST CSF, RBI-CSF, SEBI, IRDAI, PCI DSS, HIPAA, SOC 2, GDPR, and India’s DPDPA 2023.
- Data Privacy & Strategic Risk Advisory: ISO 27701, GDPR, DPDPA, Cross-border compliance, DPIA, DPO-as-a-service, supply chain risk management, and digital transformation risk consulting.
- Emerging Technology Security (Web3.0 | AI | Blockchain): Specialized testing for smart contracts, DeFi platforms, Metaverse applications, AI/ML models, quantum readiness, and blockchain nodes.
- Managed SOC & Threat Monitoring Services: End-to-end SOC operations, SIEM/EDR/XDR/SOAR integration, threat intelligence, cloud security monitoring, and 24/7 incident response.
- Cyber Forensics & Threat Analysis: Investigation services including Device forensics, Malware Analysis, Cloud and Mobile forensics, insider threat detection, and Forensic support.
- Board-Level Cybersecurity Advisory Services to build governance, quantify risks, and align with enterprise-wide digital priorities : Codec Networks enables this transformation by offering Integrated Cyber Risk Management, GRC Program Advisory, Reputation Management, Crisis Communication Readiness, and CISO Support, tailored for CXOs and board members seeking to integrate cybersecurity into strategic decision-making.
- Cyber Security Education & Global Certifications - Through the Codec Centre for Professional Excellence, we deliver Post Graduate Certification in Advanced Cybersecurity (PGCAC), Graduate Certification in Advanced Cybersecurity (GCAC), Accredited Trainings & Certifications from EC Council, PECB, TUV, Quality Austria, ISACA and ISC2 - building the next generation of cybersecurity leaders.
- CERT-IN empaneled Information Security Auditing Organization
- NICSI empaneled for providing Application Audit and Compliance Services under Start-Up Category
- An ISO/IEC 27001:2022 certified company, has established Information Security Management System (ISMS), demonstrating a structured approach to manage and protect sensitive information from cyber threats.
- An ISO 20000 IT Service Management (ITSM) company, ensure high-quality and reliable service delivery to clients on our products and services offered.
- An ISO 9001 certified company, has established and maintains a certified Quality Management System (QMS) that meets international standards for quality and consistency
At Codec Networks, our foundation is built on deep technical mastery, certified expertise, and an unrelenting pursuit of cyber excellence. With a team of globally accredited professionals, advanced methodologies, and next-generation tools, we deliver measurable security outcomes across assessment, compliance, monitoring, and forensic domains. Our competency-driven approach ensures every engagement is governed by precision, accountability, and alignment with international standards — empowering enterprises to stay secure, compliant, and resilient.
Governance, Risk & Compliance (GRC) Competency
Codec Networks’ dedicated Governance, Risk & Compliance (GRC) group specializes in security assessments, risk management, regulatory compliance, and audit readiness. The team partners with organizations to strengthen governance frameworks and ensure end-to-end compliance in a complex regulatory landscape.
Key Attributes:
- Team of certified auditors and consultants with credentials including ISO 27001 LA/LI, ISO 31000 Risk Specialist, ISO 27701 PIMS, GDPR, SOC 2, HIPAA, CCPA, DPO, CISA, CISM, CRISC, CISSP and other advanced industry certifications.
- Expertise in enterprise risk quantification, privacy impact assessment (PIA/DPIA), audit automation, and supply chain risk mapping.
- Proven track record in implementing ISO-based ISMS/PIMS frameworks, RBI/SEBI/IRDAI audits, and cross-border data compliance projects.
Vulnerability Assessment & Penetration Testing (VAPT) Expertise
Our VAPT teams bring extensive technical depth across Web, Mobile, API, Cloud, Network, Database, Infrastructure, IoT, and People & Process domains. Every engagement is mapped to OWASP, NIST, MITRE ATT&CK, ISO 27001, PCI DSS, HIPAA, RBI, and GDPR frameworks — ensuring real-world relevance and compliance alignment.
Core Strengths:
- Certified professionals with CEH, C-PENT, LPT, OSCP, OSWE, OSEE, and CREST credentials, averaging 7–10 years of offensive security experience.
- Proven expertise in Red/Blue/Purple Teaming, DevSecOps, secure SDLC, and threat emulation.
- Continuous skill enhancement through CTFs, hackathons, and product certifications (on case to case basis) such as CCNA, CCNP etc.
Managed SOC & Threat Intelligence Operations
Codec Networks operates a 24/7 Managed Security Operations Center (SOC) delivering continuous visibility, detection, and response across hybrid environments. Our SOC integrates SIEM, SOAR, EDR/XDR, and Cloud-Native Analytics to ensure rapid threat detection, incident containment, and business continuity.
Key Capabilities:
- Certified SOC analysts with credentials such as CHFI, CEH, CompTIA CySA+, GCIA, GCFA, and Splunk Certified Architect.
- Integration with platforms like Splunk, QRadar, SentinelOne, CrowdStrike, Elastic, Microsoft Sentinel, and Cortex XSOAR.
- Advanced use cases include cloud posture management, insider threat analytics, MITRE ATT&CK–aligned detections, and threat hunting automation.
- Comprehensive SOC Maturity Assessments and Threat Intelligence Fusion through integration with global feeds and dark web monitoring.
Cyber Forensics & Threat Analysis Expertise
Our Cyber Forensic Division delivers end-to-end investigation, evidence preservation, and digital analysis services — designed to support law enforcement, corporate forensics, and internal response teams. We combine forensic science with cyber intelligence to identify root causes, trace adversaries, and restore operational integrity.
Core Expertise Areas:
- Device, Network, Cloud, and Mobile Forensics – leveraging latest forensic tools (wherever applicable) such as Autopsy, Cyber Triage, Kape, EnCase, FTK, Magnet AXIOM, and Cellebrite.
- Malware Reverse Engineering and Memory Forensics for incident containment and threat attribution.
- Blockchain & Crypto Forensics – tracing DeFi fraud, NFT manipulation, and crypto laundering activities using Chainalysis, TRM Labs, and Elliptic (wherever applicable).
- Incident Response Support – forensic readiness, eDiscovery, evidence preservation, aligned with ISO/IEC 27037 & 27043.
- Certified experts including CHFI, eCIR, eCDFP, GCFE, GCFA, EnCE, CFCE and ECIH, ensuring investigations meet both technical and legal standards.
Advanced Tools, Frameworks & Continuous Innovation
Codec Networks leverages industry-leading tools and platforms such as Burp Suite Pro, Nessus, Prisma Cloud, Splunk, QRadar, CrowdStrike, SentinelOne, Autopsy, Chainalysis, MythX, and Prowler (wherever applicable) ensuring accuracy, scalability, and efficiency.
Our methodologies align with globally recognized frameworks including:
- MITRE ATT&CK & D3FEND
- OWASP Top 10 / MASVS / ASVS
- NIST Cybersecurity Framework & SP 800-115
- ISO/IEC 27001, 27701, 31000, 22301
Through ongoing research, Codec Networks continually evolves to address modern threats — from Generative AI prompt attacks and smart contract exploits to IoT zero-days, metaverse impersonation, and quantum-era vulnerabilities.
Compliance-Driven Deliverables
All technical engagements and reports are mapped to major global and Indian compliance frameworks — including ISO 27001, PCI DSS, HIPAA, GDPR, RBI-CSF, SEBI, IRDAI, and DPDPA 2023. Our structured technical and executive reports support board-level visibility, audit evidence, and certification readiness, ensuring that every engagement drives both technical assurance and regulatory confidence.
Codec Networks – Certified Competence. Proven Expertise. Real-World Cyber Resilience. Empowering enterprises through advanced security engineering, continuous monitoring, and forensic intelligence.
At Codec Networks, we believe that cybersecurity excellence is not achieved through tools alone — it is built through methodical delivery, risk-based insight, and measurable outcomes. Our Agile and Modular 8-Stage Delivery Methodology ensures that every engagement — from rapid risk assessments to full-scale ISMS implementations — is structured, standards-aligned, and business-focused.
Agile & Modular Methodology
Our delivery framework integrates global best practices with localized regulatory insight, ensuring each engagement is executed with clarity, accountability, and precision. Clients benefit from seamless onboarding, milestone-driven execution, and transparent reporting throughout the lifecycle.
- Discovery & Scoping: Collaborative workshops to understand business context, IT landscape, compliance obligations, and risk appetite, forming the foundation of a well-defined project scope.
- Risk Profiling & Gap Assessment: Comprehensive evaluation of people, process, and technology controls aligned with ISO 27001, NIST CSF, GDPR, HIPAA, DPDPA 2023, RBI, and PCI DSS.
- Regulatory Mapping & Framework Alignment: Mapping organizational obligations against applicable standards and laws — from ISO & NIST to RBI, SEBI, IRDAI, UIDAI, and DPDPA — including new-age frameworks like ISO 42001 (AI) and FATF for emerging technologies.
- Security Architecture & Control Design: Designing or refining network, cloud, and data security architectures with controls tailored for cloud, AI, OT/ICS, and Web3.0 environments.
- Documentation & Policy Development: Creation and refinement of Policies, SOPs, Risk Registers, DPIAs, Incident Response Plans, and Governance Documents, ensuring audit readiness and legal compliance.
- Implementation & Risk Treatment: Execution of remediation roadmaps, vendor risk management, privacy engineering, and workforce training to mitigate gaps and operationalize security controls.
- Validation, Testing & Audit Readiness: Conducting mock audits, VAPT, forensic readiness, and compliance testing to validate effectiveness and prepare for certifications.
- Governance Reporting & Continual Improvement: Delivering executive dashboards, compliance scorecards, and board-level insights with ongoing advisory through vCISO and DPO-as-a-Service models.
Risk-Based & Business-Oriented Audit Approach
Our methodology goes beyond testing systems — it focuses on how vulnerabilities translate into business, reputational, and compliance risks.
- Deliver Deep Insight: Actionable intelligence into vulnerabilities, attack paths, business impact, and remediation priorities.
- Extend Beyond Tools: Manual and contextual assessments combining automation with human expertise across government, financial, and commercial sectors.
- Actionable Reporting: Executive-friendly reports that translate complex findings into strategic, risk-aware recommendations.
- Efficient Execution: Critical assets prioritized for testing to deliver maximum value within tight engagement windows.
Outcome-Driven Engagements for Security Maturity
Each stage is modular yet interconnected, adaptable to enterprises of any scale or industry. Whether it’s a cloud-native fintech pursuing SOC 2, a healthcare provider ensuring HIPAA alignment, or a bank meeting RBI-CSF requirements, Codec Networks ensures consistency, compliance, and measurable improvement.
Beyond certification checklists, our Post-Audit Support and Continuous Risk Monitoring provide remediation guidance, breach response playbooks, staff training, and ongoing compliance tracking — building sustainable security posture and resilient business continuity.
Codec Networks – Turning Compliance into a Competitive Advantage. Structured. Measurable. Secure. Always Aligned with Your Business Goals.
At Codec Networks, our clients are not just audit subjects — they are long-term partners in a shared cybersecurity journey. Every engagement is designed around the client’s business priorities, security maturity, and risk appetite, ensuring solutions that are relevant, practical, and results-driven.
With a legacy of 650+ successful engagements across industries such as Banking, Fintech, Healthcare, Telecom, Energy, Aviation, Manufacturing, E-commerce, and Government, Codec Networks has attempted to become a trusted advisor for organizations seeking to transform compliance into resilience.
Our engagement philosophy extends beyond conventional audits. We integrate strategic advisory, technical assurance, remediation support, and continuous compliance monitoring, creating a full lifecycle relationship rather than a one-time service. Clients benefit from:
- Personalized advisory frameworks tailored to their business model and operational scale.
- Collaborative engagement models featuring joint workshops, stakeholder training, and compliance awareness sessions.
- Board-level guidance and reporting that translates complex technical findings into actionable business intelligence.
- Transparent communication channels with dedicated project managers, secure digital workspaces, and real-time status dashboards.
By combining the objectivity of an auditor with the empathy of an advisor, Codec Networks builds trust, accountability, and measurable security growth. Our commitment is simple — to deliver cybersecurity as a continuous partnership, not a periodic project.
Codec Networks – Where Advisory Meets Assurance. Empowering Clients Through Partnership, Transparency, and Trust.
At Codec Networks, integrity, professionalism, and ethical responsibility form the cornerstone of every engagement. As a trusted strategic partner in cybersecurity, we operate within the highest standards of ethical conduct, legal compliance, and regulatory governance, ensuring our services strengthen both our clients’ defenses and their reputations.
We adhere to a strict ethical code of conduct, driven by transparency, independence, and accountability. Every consultant, auditor, and engineer within Codec Networks upholds the core security triad of Confidentiality, Integrity, and Availability (CIA) — ensuring data protection, operational reliability, and business continuity at all times.
Our professional ethos blends technical excellence with moral responsibility, following structured processes, defined service standards, and adherence to international and national regulatory frameworks.
Our Ethical & Professional Commitments
- Zero-Compromise Consulting: We maintain independence, neutrality, and confidentiality across all audits and advisory engagements.
- Legal & Regulatory Conformance: We assist clients to conform strictly within the boundaries of applicable cyber laws, privacy regulations, and data protection statutes.
- Client-First Philosophy: Every recommendation is designed to safeguard stakeholder interests, minimize legal exposure, and build sustainable resilience.
- Outcome-Driven Security Maturity: Our modular yet integrated delivery approach supports organizations of all sizes in achieving measurable improvements in security posture.
- Global Delivery, Local Integrity: Our Global Network Delivery Model integrates international best practices with local regulatory expertise — ensuring value-driven, compliant outcomes.
Industry-Specific Security Advisory
Recognizing that every sector faces distinct threats and compliance challenges, Codec Networks provides customized, industry-aligned security advisory across BFSI, Fintech, Telecom, Healthcare, Energy, Aviation, E-commerce, Government, and Critical Infrastructure domains.
Our sector-specific consulting translates regulatory complexity into practical, business-aware strategies, ensuring risk mitigation plans are compliant, auditable, and operationally feasible.
Our Commitment
With a zero-tolerance approach to ethical compromise, Codec Networks stands for trust, transparency, and truth in cybersecurity. We are more than consultants — we are custodians of digital integrity, committed to helping organizations navigate risk, maintain compliance, and enable secure business growth.
Codec Networks – Where Integrity Meets Innovation. Trusted. Ethical. Future-Ready.
At Codec Networks, we combine the strength of a global delivery ecosystem with the precision of local regulatory insight to deliver cybersecurity solutions that are both internationally benchmarked and regionally compliant.
Our Global Delivery Capability enables clients across continents to access specialized cybersecurity expertise, advanced technologies, and globally aligned methodologies. Through a distributed network of certified professionals, partner alliances, and intelligence centers, Codec Networks ensures consistent service quality and rapid response across time zones and geographies.
What truly differentiates us is our Local Expertise — a deep understanding of national regulations, industry frameworks, and operational nuances that shape cybersecurity implementation in each region.
Our hybrid delivery model blends remote and on-site collaboration, combining the agility of digital operations with the contextual understanding of local consultants. This ensures culturally aligned communication, faster problem resolution, and seamless coordination with client teams.
With a presence across India, Codec Networks empowers global enterprises to manage cybersecurity uniformly while adapting to local risks, regulations, and realities.
Codec Networks – Global Vision. Local Precision. Consistent Cyber Resilience.
“With Codec Networks, you’re not just buying a service — you’re investing in a cybersecurity ally who understands your business, defends your reputation, and strengthens your future.”
At Codec Networks, we believe cybersecurity is not a project — it’s a partnership. Our approach is built on trust, transparency, and transformation, helping clients evolve from compliance readiness to cyber resilience.
Your Strategic Security Partner
Codec Networks acts as a strategic security partner, providing continuous roadmap development, architecture reviews, and improvement programs that evolve with your business and the threat landscape.
“We don’t just secure businesses — we empower them to lead with confidence in a digital-first world.”
Our strength lies in the fusion of technical depth, regulatory insight, industry specialization, and future readiness — providing unmatched cybersecurity value to enterprises across India and beyond.
Codec Networks – Certified Competence. Proven Expertise. Real-World Cyber Resilience. Empowering enterprises through advanced security engineering, continuous monitoring, and forensic intelligence.
Every engagement reflects our belief that advisory must meet assurance — a promise we deliver through partnership, integrity, and measurable impact.
Codec Networks – Where Advisory Meets Assurance. Empowering Clients Through Partnership, Transparency, and Trust.
And above all —
“Decoding Threats. Coding Solutions.” That’s the Codec Networks Advantage.
RBI, SEBI, IRDAI, NPCI, UIDAI and Other Regulatory Audits
Codec Networks, a CERT-In empanelled Information Security Auditing Organisation, delivers independent, risk-based cybersecurity and compliance audits for regulated entities across banking, NBFC, FinTech, securities, insurance, payments, Aadhaar-enabled services, government, healthcare and critical infrastructure sectors.
Our value proposition combines regulatory understanding, cybersecurity expertise, structured audit methodology and evidence-driven assurance to help organizations identify compliance gaps, strengthen controls and demonstrate regulatory readiness.
1. Regulatory and Framework-Aligned Audit Assurance
- Audits applicable requirements issued by RBI, SEBI, IRDAI, NPCI, UIDAI, CERT-In and other relevant authorities.
- Maps regulatory obligations with ISO/IEC 27001:2022, ISO 27002, ISO 27005, ISO 22301, NIST CSF, COBIT, CIS Controls and applicable data-protection requirements.
- Converts complex regulatory provisions into practical audit criteria, control requirements, evidence expectations and accountable actions.
- Supports consistent compliance across applications, infrastructure, cloud, networks, data centres, branches, third parties and digital ecosystems.
2. CERT-In Empanelled and Risk-Based Audit Approach
- Applies a structured methodology aligned with applicable CERT-In requirements and recognized auditing principles.
- Evaluates both control design—Test of Design—and operating effectiveness—Test of Effectiveness.
- Prioritizes observations according to regulatory significance, threat exposure, business criticality, likelihood and potential impact.
- Maintains professional independence, confidentiality, evidence integrity and appropriate segregation between audit and remediation activities.
3. Multidisciplinary Regulatory and Cybersecurity Expertise
- Deploys auditors and specialists with experience in information security, IT governance, VAPT, cloud security, application security, SOC, incident response, privacy and business continuity.
- Brings relevant professional competencies such as CISA, CISSP, CISM, ISO 27001 Lead Auditor/Implementer, CEH and cloud-security certifications, subject to engagement requirements.
- Understands sector-specific technology, operating models, outsourcing arrangements, payment environments, digital channels and sensitive-data ecosystems.
- Integrates governance, process and technical testing to provide a complete view of regulatory cyber risk.
4. Comprehensive Audit Coverage
- Covers cybersecurity governance, IT risk management, asset management, identity and access management, secure configuration, vulnerability management and security monitoring.
- Reviews application, API, mobile, network, cloud, database, endpoint, data-protection and third-party security controls, as applicable.
- Assesses incident response, regulatory reporting, business continuity, disaster recovery, cyber resilience, log management and forensic readiness.
- Validates policies, procedures, contracts, configurations, records, system-generated evidence, samples and stakeholder practices.
5. Evidence-Driven Findings and Actionable Remediation
- Links each finding to the applicable regulatory clause, audit criterion, supporting evidence and affected system or process.
- Clearly distinguishes compliant, partially compliant, non-compliant and not-applicable requirements.
- Provides risk-rated observations with business impact, root-cause considerations, recommended corrective actions, ownership and target timelines.
- Supports structured management responses, corrective-action tracking and re-testing of remediated observations within the agreed scope.
6. Management Visibility and Regulatory Readiness
- Delivers executive summaries, detailed audit reports, compliance matrices, risk heat maps and prioritized remediation roadmaps.
- Provides traceability from regulatory requirements to controls, audit procedures, evidence reviewed and audit conclusions.
- Helps boards, senior management, CISOs, compliance officers and technology teams understand material exposures and required decisions.
- Strengthens readiness for regulatory inspections, supervisory reviews, internal audits, certification audits and customer assurance requirements.
7. Independent, Scalable and Business-Focused Delivery
- Adapts the audit approach to the organization’s size, complexity, risk profile, technology architecture and regulatory classification.
- Supports single-entity, multi-location, group-wide and ecosystem-based audits through onsite, remote or hybrid delivery models.
- Coordinates audit activities to reduce operational disruption while preserving audit independence and testing sufficiency.
- Enables organizations to transform regulatory compliance from a periodic exercise into a sustainable governance and cyber-resilience capability.
Why Customers Should Choose Codec Networks
Customers should consider Codec Networks for the combination of CERT-In empanelment, regulatory-domain understanding, multidisciplinary technical capability, risk-based testing and practical reporting. Our audits are designed not merely to identify documentary gaps, but to determine whether critical cybersecurity controls are appropriately designed, consistently implemented and demonstrably effective.
The result is greater regulatory confidence, stronger cyber resilience, improved management accountability and a clearly prioritized path toward sustained compliance.
Disclaimer: Audit scope, procedures and conclusions depend on the applicable regulation, agreed terms of reference, systems and locations included, sampling methodology, evidence provided and conditions existing during the audit period. An audit provides reasonable assurance within its defined scope and does not constitute a guarantee against cyber incidents, regulatory action or future control failure. CERT-In empanelment should be represented strictly in accordance with applicable CERT-In conditions and should not be construed as an endorsement of any commercial claim or as certification by CERT-In.
Founded in 2008 with 17+ Years of Industry Experience in Information and Cyber Security domain
Codec Networks Full-Spectrum Cybersecurity Expertise across all Industry Domains:
- Security Vulnerability Assessment & Penetration Testing (VAPT): Covering Web, Mobile, API, IoT, Blockchain, Cloud-Native, and smart infrastructure environments, with a focus on OWASP, MITRE ATT&CK, and real-world exploit simulation.
- Offensive Security & Deep Level Security Assessments: Advanced Red Team, Blue Team and Purple Team Exercises, Threat Simulations, Social Engineering Campaigns, and Secure Code Review.
- IT Security Audit & Compliance Services: Implementation and audit support for ISO/IEC 27001, ISO 27701, NIST CSF, RBI-CSF, SEBI, IRDAI, PCI DSS, HIPAA, SOC 2, GDPR, and India’s DPDPA 2023.
- Data Privacy & Strategic Risk Advisory: ISO 27701, GDPR, DPDPA, Cross-border compliance, DPIA, DPO-as-a-service, supply chain risk management, and digital transformation risk consulting.
- Emerging Technology Security (Web3.0 | AI | Blockchain): Specialized testing for smart contracts, DeFi platforms, Metaverse applications, AI/ML models, quantum readiness, and blockchain nodes.
- Managed SOC & Threat Monitoring Services: End-to-end SOC operations, SIEM/EDR/XDR/SOAR integration, threat intelligence, cloud security monitoring, and 24/7 incident response.
- Cyber Forensics & Threat Analysis: Investigation services including Device forensics, Malware Analysis, Cloud and Mobile forensics, insider threat detection, and Forensic support.
- Board-Level Cybersecurity Advisory Services to build governance, quantify risks, and align with enterprise-wide digital priorities : Codec Networks enables this transformation by offering Integrated Cyber Risk Management, GRC Program Advisory, Reputation Management, Crisis Communication Readiness, and CISO Support, tailored for CXOs and board members seeking to integrate cybersecurity into strategic decision-making.
- Cyber Security Education & Global Certifications - Through the Codec Centre for Professional Excellence, we deliver Post Graduate Certification in Advanced Cybersecurity (PGCAC), Graduate Certification in Advanced Cybersecurity (GCAC), Accredited Trainings & Certifications from EC Council, PECB, TUV, Quality Austria, ISACA and ISC2 - building the next generation of cybersecurity leaders.
- CERT-IN empaneled Information Security Auditing Organization
- NICSI empaneled for providing Application Audit and Compliance Services under Start-Up Category
- An ISO/IEC 27001:2022 certified company, has established Information Security Management System (ISMS), demonstrating a structured approach to manage and protect sensitive information from cyber threats.
- An ISO 20000 IT Service Management (ITSM) company, ensure high-quality and reliable service delivery to clients on our products and services offered.
- An ISO 9001 certified company, has established and maintains a certified Quality Management System (QMS) that meets international standards for quality and consistency
At Codec Networks, our foundation is built on deep technical mastery, certified expertise, and an unrelenting pursuit of cyber excellence. With a team of globally accredited professionals, advanced methodologies, and next-generation tools, we deliver measurable security outcomes across assessment, compliance, monitoring, and forensic domains. Our competency-driven approach ensures every engagement is governed by precision, accountability, and alignment with international standards — empowering enterprises to stay secure, compliant, and resilient.
Governance, Risk & Compliance (GRC) Competency
Codec Networks’ dedicated Governance, Risk & Compliance (GRC) group specializes in security assessments, risk management, regulatory compliance, and audit readiness. The team partners with organizations to strengthen governance frameworks and ensure end-to-end compliance in a complex regulatory landscape.
Key Attributes:
- Team of certified auditors and consultants with credentials including ISO 27001 LA/LI, ISO 31000 Risk Specialist, ISO 27701 PIMS, GDPR, SOC 2, HIPAA, CCPA, DPO, CISA, CISM, CRISC, CISSP and other advanced industry certifications.
- Expertise in enterprise risk quantification, privacy impact assessment (PIA/DPIA), audit automation, and supply chain risk mapping.
- Proven track record in implementing ISO-based ISMS/PIMS frameworks, RBI/SEBI/IRDAI audits, and cross-border data compliance projects.
Vulnerability Assessment & Penetration Testing (VAPT) Expertise
Our VAPT teams bring extensive technical depth across Web, Mobile, API, Cloud, Network, Database, Infrastructure, IoT, and People & Process domains. Every engagement is mapped to OWASP, NIST, MITRE ATT&CK, ISO 27001, PCI DSS, HIPAA, RBI, and GDPR frameworks — ensuring real-world relevance and compliance alignment.
Core Strengths:
- Certified professionals with CEH, C-PENT, LPT, OSCP, OSWE, OSEE, and CREST credentials, averaging 7–10 years of offensive security experience.
- Proven expertise in Red/Blue/Purple Teaming, DevSecOps, secure SDLC, and threat emulation.
- Continuous skill enhancement through CTFs, hackathons, and product certifications (on case to case basis) such as CCNA, CCNP etc.
Managed SOC & Threat Intelligence Operations
Codec Networks operates a 24/7 Managed Security Operations Center (SOC) delivering continuous visibility, detection, and response across hybrid environments. Our SOC integrates SIEM, SOAR, EDR/XDR, and Cloud-Native Analytics to ensure rapid threat detection, incident containment, and business continuity.
Key Capabilities:
- Certified SOC analysts with credentials such as CHFI, CEH, CompTIA CySA+, GCIA, GCFA, and Splunk Certified Architect.
- Integration with platforms like Splunk, QRadar, SentinelOne, CrowdStrike, Elastic, Microsoft Sentinel, and Cortex XSOAR.
- Advanced use cases include cloud posture management, insider threat analytics, MITRE ATT&CK–aligned detections, and threat hunting automation.
- Comprehensive SOC Maturity Assessments and Threat Intelligence Fusion through integration with global feeds and dark web monitoring.
Cyber Forensics & Threat Analysis Expertise
Our Cyber Forensic Division delivers end-to-end investigation, evidence preservation, and digital analysis services — designed to support law enforcement, corporate forensics, and internal response teams. We combine forensic science with cyber intelligence to identify root causes, trace adversaries, and restore operational integrity.
Core Expertise Areas:
- Device, Network, Cloud, and Mobile Forensics – leveraging latest forensic tools (wherever applicable) such as Autopsy, Cyber Triage, Kape, EnCase, FTK, Magnet AXIOM, and Cellebrite.
- Malware Reverse Engineering and Memory Forensics for incident containment and threat attribution.
- Blockchain & Crypto Forensics – tracing DeFi fraud, NFT manipulation, and crypto laundering activities using Chainalysis, TRM Labs, and Elliptic (wherever applicable).
- Incident Response Support – forensic readiness, eDiscovery, evidence preservation, aligned with ISO/IEC 27037 & 27043.
- Certified experts including CHFI, eCIR, eCDFP, GCFE, GCFA, EnCE, CFCE and ECIH, ensuring investigations meet both technical and legal standards.
Advanced Tools, Frameworks & Continuous Innovation
Codec Networks leverages industry-leading tools and platforms such as Burp Suite Pro, Nessus, Prisma Cloud, Splunk, QRadar, CrowdStrike, SentinelOne, Autopsy, Chainalysis, MythX, and Prowler (wherever applicable) ensuring accuracy, scalability, and efficiency.
Our methodologies align with globally recognized frameworks including:
- MITRE ATT&CK & D3FEND
- OWASP Top 10 / MASVS / ASVS
- NIST Cybersecurity Framework & SP 800-115
- ISO/IEC 27001, 27701, 31000, 22301
Through ongoing research, Codec Networks continually evolves to address modern threats — from Generative AI prompt attacks and smart contract exploits to IoT zero-days, metaverse impersonation, and quantum-era vulnerabilities.
Compliance-Driven Deliverables
All technical engagements and reports are mapped to major global and Indian compliance frameworks — including ISO 27001, PCI DSS, HIPAA, GDPR, RBI-CSF, SEBI, IRDAI, and DPDPA 2023. Our structured technical and executive reports support board-level visibility, audit evidence, and certification readiness, ensuring that every engagement drives both technical assurance and regulatory confidence.
Codec Networks – Certified Competence. Proven Expertise. Real-World Cyber Resilience. Empowering enterprises through advanced security engineering, continuous monitoring, and forensic intelligence.
At Codec Networks, we believe that cybersecurity excellence is not achieved through tools alone — it is built through methodical delivery, risk-based insight, and measurable outcomes. Our Agile and Modular 8-Stage Delivery Methodology ensures that every engagement — from rapid risk assessments to full-scale ISMS implementations — is structured, standards-aligned, and business-focused.
Agile & Modular Methodology
Our delivery framework integrates global best practices with localized regulatory insight, ensuring each engagement is executed with clarity, accountability, and precision. Clients benefit from seamless onboarding, milestone-driven execution, and transparent reporting throughout the lifecycle.
- Discovery & Scoping: Collaborative workshops to understand business context, IT landscape, compliance obligations, and risk appetite, forming the foundation of a well-defined project scope.
- Risk Profiling & Gap Assessment: Comprehensive evaluation of people, process, and technology controls aligned with ISO 27001, NIST CSF, GDPR, HIPAA, DPDPA 2023, RBI, and PCI DSS.
- Regulatory Mapping & Framework Alignment: Mapping organizational obligations against applicable standards and laws — from ISO & NIST to RBI, SEBI, IRDAI, UIDAI, and DPDPA — including new-age frameworks like ISO 42001 (AI) and FATF for emerging technologies.
- Security Architecture & Control Design: Designing or refining network, cloud, and data security architectures with controls tailored for cloud, AI, OT/ICS, and Web3.0 environments.
- Documentation & Policy Development: Creation and refinement of Policies, SOPs, Risk Registers, DPIAs, Incident Response Plans, and Governance Documents, ensuring audit readiness and legal compliance.
- Implementation & Risk Treatment: Execution of remediation roadmaps, vendor risk management, privacy engineering, and workforce training to mitigate gaps and operationalize security controls.
- Validation, Testing & Audit Readiness: Conducting mock audits, VAPT, forensic readiness, and compliance testing to validate effectiveness and prepare for certifications.
- Governance Reporting & Continual Improvement: Delivering executive dashboards, compliance scorecards, and board-level insights with ongoing advisory through vCISO and DPO-as-a-Service models.
Risk-Based & Business-Oriented Audit Approach
Our methodology goes beyond testing systems — it focuses on how vulnerabilities translate into business, reputational, and compliance risks.
- Deliver Deep Insight: Actionable intelligence into vulnerabilities, attack paths, business impact, and remediation priorities.
- Extend Beyond Tools: Manual and contextual assessments combining automation with human expertise across government, financial, and commercial sectors.
- Actionable Reporting: Executive-friendly reports that translate complex findings into strategic, risk-aware recommendations.
- Efficient Execution: Critical assets prioritized for testing to deliver maximum value within tight engagement windows.
Outcome-Driven Engagements for Security Maturity
Each stage is modular yet interconnected, adaptable to enterprises of any scale or industry. Whether it’s a cloud-native fintech pursuing SOC 2, a healthcare provider ensuring HIPAA alignment, or a bank meeting RBI-CSF requirements, Codec Networks ensures consistency, compliance, and measurable improvement.
Beyond certification checklists, our Post-Audit Support and Continuous Risk Monitoring provide remediation guidance, breach response playbooks, staff training, and ongoing compliance tracking — building sustainable security posture and resilient business continuity.
Codec Networks – Turning Compliance into a Competitive Advantage. Structured. Measurable. Secure. Always Aligned with Your Business Goals.
At Codec Networks, our clients are not just audit subjects — they are long-term partners in a shared cybersecurity journey. Every engagement is designed around the client’s business priorities, security maturity, and risk appetite, ensuring solutions that are relevant, practical, and results-driven.
With a legacy of 650+ successful engagements across industries such as Banking, Fintech, Healthcare, Telecom, Energy, Aviation, Manufacturing, E-commerce, and Government, Codec Networks has attempted to become a trusted advisor for organizations seeking to transform compliance into resilience.
Our engagement philosophy extends beyond conventional audits. We integrate strategic advisory, technical assurance, remediation support, and continuous compliance monitoring, creating a full lifecycle relationship rather than a one-time service. Clients benefit from:
- Personalized advisory frameworks tailored to their business model and operational scale.
- Collaborative engagement models featuring joint workshops, stakeholder training, and compliance awareness sessions.
- Board-level guidance and reporting that translates complex technical findings into actionable business intelligence.
- Transparent communication channels with dedicated project managers, secure digital workspaces, and real-time status dashboards.
By combining the objectivity of an auditor with the empathy of an advisor, Codec Networks builds trust, accountability, and measurable security growth. Our commitment is simple — to deliver cybersecurity as a continuous partnership, not a periodic project.
Codec Networks – Where Advisory Meets Assurance. Empowering Clients Through Partnership, Transparency, and Trust.
At Codec Networks, integrity, professionalism, and ethical responsibility form the cornerstone of every engagement. As a trusted strategic partner in cybersecurity, we operate within the highest standards of ethical conduct, legal compliance, and regulatory governance, ensuring our services strengthen both our clients’ defenses and their reputations.
We adhere to a strict ethical code of conduct, driven by transparency, independence, and accountability. Every consultant, auditor, and engineer within Codec Networks upholds the core security triad of Confidentiality, Integrity, and Availability (CIA) — ensuring data protection, operational reliability, and business continuity at all times.
Our professional ethos blends technical excellence with moral responsibility, following structured processes, defined service standards, and adherence to international and national regulatory frameworks.
Our Ethical & Professional Commitments
- Zero-Compromise Consulting: We maintain independence, neutrality, and confidentiality across all audits and advisory engagements.
- Legal & Regulatory Conformance: We assist clients to conform strictly within the boundaries of applicable cyber laws, privacy regulations, and data protection statutes.
- Client-First Philosophy: Every recommendation is designed to safeguard stakeholder interests, minimize legal exposure, and build sustainable resilience.
- Outcome-Driven Security Maturity: Our modular yet integrated delivery approach supports organizations of all sizes in achieving measurable improvements in security posture.
- Global Delivery, Local Integrity: Our Global Network Delivery Model integrates international best practices with local regulatory expertise — ensuring value-driven, compliant outcomes.
Industry-Specific Security Advisory
Recognizing that every sector faces distinct threats and compliance challenges, Codec Networks provides customized, industry-aligned security advisory across BFSI, Fintech, Telecom, Healthcare, Energy, Aviation, E-commerce, Government, and Critical Infrastructure domains.
Our sector-specific consulting translates regulatory complexity into practical, business-aware strategies, ensuring risk mitigation plans are compliant, auditable, and operationally feasible.
Our Commitment
With a zero-tolerance approach to ethical compromise, Codec Networks stands for trust, transparency, and truth in cybersecurity. We are more than consultants — we are custodians of digital integrity, committed to helping organizations navigate risk, maintain compliance, and enable secure business growth.
Codec Networks – Where Integrity Meets Innovation. Trusted. Ethical. Future-Ready.
At Codec Networks, we combine the strength of a global delivery ecosystem with the precision of local regulatory insight to deliver cybersecurity solutions that are both internationally benchmarked and regionally compliant.
Our Global Delivery Capability enables clients across continents to access specialized cybersecurity expertise, advanced technologies, and globally aligned methodologies. Through a distributed network of certified professionals, partner alliances, and intelligence centers, Codec Networks ensures consistent service quality and rapid response across time zones and geographies.
What truly differentiates us is our Local Expertise — a deep understanding of national regulations, industry frameworks, and operational nuances that shape cybersecurity implementation in each region.
Our hybrid delivery model blends remote and on-site collaboration, combining the agility of digital operations with the contextual understanding of local consultants. This ensures culturally aligned communication, faster problem resolution, and seamless coordination with client teams.
With a presence across India, Codec Networks empowers global enterprises to manage cybersecurity uniformly while adapting to local risks, regulations, and realities.
Codec Networks – Global Vision. Local Precision. Consistent Cyber Resilience.
“With Codec Networks, you’re not just buying a service — you’re investing in a cybersecurity ally who understands your business, defends your reputation, and strengthens your future.”
At Codec Networks, we believe cybersecurity is not a project — it’s a partnership. Our approach is built on trust, transparency, and transformation, helping clients evolve from compliance readiness to cyber resilience.
Your Strategic Security Partner
Codec Networks acts as a strategic security partner, providing continuous roadmap development, architecture reviews, and improvement programs that evolve with your business and the threat landscape.
“We don’t just secure businesses — we empower them to lead with confidence in a digital-first world.”
Our strength lies in the fusion of technical depth, regulatory insight, industry specialization, and future readiness — providing unmatched cybersecurity value to enterprises across India and beyond.
Codec Networks – Certified Competence. Proven Expertise. Real-World Cyber Resilience. Empowering enterprises through advanced security engineering, continuous monitoring, and forensic intelligence.
Every engagement reflects our belief that advisory must meet assurance — a promise we deliver through partnership, integrity, and measurable impact.
Codec Networks – Where Advisory Meets Assurance. Empowering Clients Through Partnership, Transparency, and Trust.
And above all —
“Decoding Threats. Coding Solutions.” That’s the Codec Networks Advantage.
WHAT OUR CUSTOMERS SAY
Every customer testimonial is proof of our commitment, highlighting security, compliance,
and resilience enabled by Codec Networks’ services.
-
“Vijay Pratap is a passionate Software Developer specializing in building scalable web applications and APIs. He enjoys solving complex problems with clean”
Vijay Pratap
Developer -
“Deepak Baghel is a passionate Frontend Developer specializing in building responsive, accessible interfaces. He enjoys solving complex problems with clean”
Deepak Baghel
Frontend Developer -
“Saurav is a passionate DevOps engineer specializing in building resilient, automated delivery pipelines. He enjoys solving complex problems with clean”
Saurav
DevOps
“Vijay Pratap is a passionate Software Developer specializing in building scalable web applications and APIs. He enjoys solving complex problems with clean”
Vijay Pratap
Developer
“Deepak Baghel is a passionate Frontend Developer specializing in building responsive, accessible interfaces. He enjoys solving complex problems with clean”
Deepak Baghel
Frontend Developer
“Saurav is a passionate DevOps engineer specializing in building resilient, automated delivery pipelines. He enjoys solving complex problems with clean”
Saurav
DevOpsFREQUENTLY ASKED QUESTION
Asking the right questions is the first step toward security; our FAQs
The service is relevant to Scheduled Commercial Banks, Small Finance Banks, Payments Banks, applicable Middle, Upper and Top Layer NBFCs, Credit Information Companies and specified All India Financial Institutions. Foreign banks operating in India are also covered, subject to the RBI’s “comply or explain” approach
The audit assesses applicable requirements relating to IT governance, infrastructure and service management, information security, cyber-risk management, third-party controls, incident response, business continuity, disaster recovery and Information Systems Audit governance.
Yes. RBI Clause requires regulated entities to plan IS audits using a risk-based approach plus also permits more frequent or continuous auditing of critical systems.
No. It may be used for annual IS audit programmes, Audit Committee assurance, internal compliance reviews, major technology changes, cloud migration, outsourcing reviews, post-incident assessments and remediation validation.
No. The regulated entity remains responsible for maintaining controls, regulatory compliance, remediation, risk acceptance and ongoing cybersecurity. The auditor provides an independent assessment based on the agreed scope and evidence available during the audit.
The scope is agreed with the auditee and generally derived from its updated asset inventory, critical business services, applications, infrastructure, databases, cloud environments, third-party dependencies, previous findings and relevant RBI requirements.
Codec Networks follows an independent, evidence-based and risk-focused approach involving regulatory mapping, document review, stakeholder interviews, walkthroughs, sampling, configuration review, technical validation, risk classification and management reporting.
Technical testing may be included where agreed, such as application, API, network, cloud, database, access-control, logging or vulnerability-management reviews. Penetration testing or potentially disruptive activities are performed only under written authorisation and agreed rules of engagement.
No. CERT-In guidelines discourage tool-only assessments. Automated tools may support the audit, but conclusions are also based on manual review, interviews, walkthroughs, evidence validation and professional judgement.
Critical and high-risk observations are communicated promptly to authorised auditee representatives. Technical vulnerabilities may be rated using CVSS and supplemented with EPSS, CWE and CVE references where applicable.
Depending on the agreed engagement, deliverables may include an executive summary, RBI clause-wise compliance assessment, risk-rated observation register, evidence index, repeat-finding status, management action plan, remediation priorities and follow-up validation report.
Yes. Potential observations are normally discussed with relevant process and control owners to validate facts, understand existing controls and record management responses before finalization.
Where included in the engagement, Codec Networks may conduct follow-up verification to assess corrective actions. Findings may be recorded as closed, partially closed, open, risk accepted or not verifiable based on the evidence available at the time of review.
No. The audit does not guarantee regulatory approval, absence of vulnerabilities, prevention of cyber incidents or uninterrupted operations. It is a point-in-time assessment to the agreed scope
Where relevant, Codec Networks may use standards and frameworks such as ISO/IEC 27001, ISO/IEC 27002, ISO 22301, ISO/IEC 27005, ISO 31000, CSA CCM, OWASP and OSSTMM as supporting references. The RBI Directions and other applicable regulatory requirements remain the primary audit criteria.
The service is relevant to Scheduled Commercial Banks, Small Finance Banks, Payments Banks, applicable Middle, Upper and Top Layer NBFCs, Credit Information Companies and specified All India Financial Institutions. Foreign banks operating in India are also covered, subject to the RBI’s “comply or explain” approach
The audit assesses applicable requirements relating to IT governance, infrastructure and service management, information security, cyber-risk management, third-party controls, incident response, business continuity, disaster recovery and Information Systems Audit governance.
Yes. RBI Clause requires regulated entities to plan IS audits using a risk-based approach plus also permits more frequent or continuous auditing of critical systems.
No. It may be used for annual IS audit programmes, Audit Committee assurance, internal compliance reviews, major technology changes, cloud migration, outsourcing reviews, post-incident assessments and remediation validation.
No. The regulated entity remains responsible for maintaining controls, regulatory compliance, remediation, risk acceptance and ongoing cybersecurity. The auditor provides an independent assessment based on the agreed scope and evidence available during the audit.
The scope is agreed with the auditee and generally derived from its updated asset inventory, critical business services, applications, infrastructure, databases, cloud environments, third-party dependencies, previous findings and relevant RBI requirements.
Codec Networks follows an independent, evidence-based and risk-focused approach involving regulatory mapping, document review, stakeholder interviews, walkthroughs, sampling, configuration review, technical validation, risk classification and management reporting.
Technical testing may be included where agreed, such as application, API, network, cloud, database, access-control, logging or vulnerability-management reviews. Penetration testing or potentially disruptive activities are performed only under written authorisation and agreed rules of engagement.
No. CERT-In guidelines discourage tool-only assessments. Automated tools may support the audit, but conclusions are also based on manual review, interviews, walkthroughs, evidence validation and professional judgement.
Critical and high-risk observations are communicated promptly to authorised auditee representatives. Technical vulnerabilities may be rated using CVSS and supplemented with EPSS, CWE and CVE references where applicable.
Depending on the agreed engagement, deliverables may include an executive summary, RBI clause-wise compliance assessment, risk-rated observation register, evidence index, repeat-finding status, management action plan, remediation priorities and follow-up validation report.
Yes. Potential observations are normally discussed with relevant process and control owners to validate facts, understand existing controls and record management responses before finalization.
Where included in the engagement, Codec Networks may conduct follow-up verification to assess corrective actions. Findings may be recorded as closed, partially closed, open, risk accepted or not verifiable based on the evidence available at the time of review.
No. The audit does not guarantee regulatory approval, absence of vulnerabilities, prevention of cyber incidents or uninterrupted operations. It is a point-in-time assessment to the agreed scope
Where relevant, Codec Networks may use standards and frameworks such as ISO/IEC 27001, ISO/IEC 27002, ISO 22301, ISO/IEC 27005, ISO 31000, CSA CCM, OWASP and OSSTMM as supporting references. The RBI Directions and other applicable regulatory requirements remain the primary audit criteria.