Cyber & Information Security Assessment: After Approval: What Continues
Cyber & Information Security Assessment does not end at approval — a set of obligations continues afterwards. The questions below are the ones raised most often in practice; the full scope of the service is on the Cyber & Information Security Assessment page.
What happens if the assessment finds a critical vulnerability that is actively being exploited right now?
If we identify evidence of an active, ongoing compromise during the assessment — as opposed to a theoretical vulnerability — we notify you immediately, outside the normal reporting timeline, so you can begin incident response without waiting for the full assessment report. Where the incident meets CERT-In's reportable categories, we advise on the reporting obligation and timeline immediately.
In practice: This has happened in practice — an assessment intended as a routine, proactive exercise uncovering signs of an existing, undetected compromise. Immediate escalation outside the normal reporting cadence is standard practice for us in that scenario, not an exception we make reluctantly.
What is the difference between this service and PNPC's Digital Transformation Advisory?
Digital Transformation Advisory is broader — it covers technology roadmap planning, ERP/accounting software selection, and finance/compliance process design, with basic access-control and data-governance hygiene addressed as one component of that broader control design. Cyber & Information Security Assessment is a focused, deeper review specifically of your security posture, technical vulnerabilities, and regulatory cyber obligations. In practice, the two are complementary — a Digital Transformation Advisory engagement will often flag the need for a dedicated cyber assessment, and a cyber assessment's findings frequently inform a subsequent technology roadmap.
In practice: We do not force clients into one framing over the other. If your immediate concern is specifically security and regulatory cyber risk, this is the right engagement; if the concern is broader systems and process design with security as one component, Digital Transformation Advisory may be the better starting point. We will recommend whichever fits your actual need.
Does PNPC issue a formal certification that our systems are 'secure' after the assessment?
No. We provide our professional assessment, a documented gap analysis against the frameworks and regulations applicable to you, and a remediation roadmap — this is not equivalent to a formal ISO/IEC 27001 or SOC 2 Type II certification, which must be issued by an accredited certification body following its own separate, formal audit process. Where certification is the ultimate goal, our assessment is a strong preparatory step — closing the gaps we identify meaningfully improves your readiness for that formal certification audit.
In practice: We are explicit with every client that 'assessed by PNPC' and 'ISO 27001 certified' are different things carrying different evidentiary weight with different audiences — an investor's technical diligence team may accept our assessment report; a large enterprise procurement process may specifically require the formal accredited certification. We help clients understand which one their specific situation actually requires.
What if our business has already had a data breach — can PNPC help after the fact?
Yes. Post-incident, our role shifts to incident response coordination (including CERT-In reporting support within the applicable window where the incident is reportable), root-cause analysis of how the breach occurred, and a revised remediation roadmap informed by the actual incident rather than a hypothetical assessment. We also advise on any onward notification obligations to affected individuals or regulators that may apply depending on the nature of the data involved and applicable law.
In practice: The single most valuable thing we can do in a live incident is help leadership move quickly and correctly on the reporting timeline — the CERT-In 6-hour window is unforgiving, and decisions made in the first few hours of incident discovery materially affect both the regulatory outcome and the practical containment of the breach.
Do you offer a fixed-fee retainer for ongoing cyber security advisory, or is every engagement a one-off project?
Both models are available. Many clients begin with a one-off structured assessment and then move to a periodic retainer — typically an annual reassessment cycle plus advisory availability when a new vendor, system, or regulatory question arises in between. We scope whichever structure fits your situation and are transparent about the trade-offs of each before you commit.
In practice: We generally recommend the retainer model for clients in regulated sectors (SEBI CSCRF, RBI-regulated entities) or those with an active, evolving technology footprint, since cyber risk in those situations genuinely does not stay static for a full year between one-off assessments.
Where this sits in the wider engagement
Cyber & Information Security Assessment rarely arrives on its own. The statutory basis and the current requirements are set out on the Cyber & Information Security Assessment service page, and the related services are grouped under Business Transformation.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Cyber & Information Security Assessment we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.