Cyber & Information Security Assessment: Who Needs It and Who Does Not
Whether Cyber & Information Security Assessment applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the Cyber & Information Security Assessment page.
What is CERT-In, and what are the reporting obligations under its directions?
CERT-In (the Indian Computer Emergency Response Team) is the national nodal agency for cyber security incident response, operating under Section 70B of the Information Technology Act, 2000. Its directions issued in 2022 require reporting of specified categories of cyber security incidents to CERT-In within 6 hours of detection or being brought to notice, and mandate that service providers, intermediaries, data centres, body corporates, and government organisations maintain and securely store specified ICT system logs for a rolling period of 180 days, within Indian jurisdiction. Specific incident categories covered are set out in the directions and include events such as data breaches, ransomware attacks, and unauthorised access to critical systems, among others.
In practice: The 6-hour window is genuinely tight, and most organisations without a prior structured assessment discover during an actual incident that no one had defined who detects, who decides to report, and who actually files the report. We test this readiness as a specific stage of our assessment, before an incident forces the question.
Do you perform the actual technical penetration testing yourselves, or subcontract it?
Our engagement combines PNPC-led scoping, business/regulatory translation, governance and policy review, and reporting, together with technical vulnerability testing performed to recognised methodology — either by our own technical resources or through a vetted technical testing partner, depending on the depth and specialisation the engagement requires (for example, specialised mobile application or IoT testing may call in a particular specialist). Regardless of who performs the technical testing component, PNPC leads the engagement, owns the regulatory mapping, and presents the final report and roadmap.
In practice: We are transparent about which parts of any given engagement are performed directly by PNPC and which involve a vetted technical partner — clients should always know exactly who touched their systems and under what confidentiality and scope terms.
Do you provide a written report, and who is it addressed to?
Yes — a written report structured in layers: an executive summary for the Board/leadership in plain business language, a regulatory gap analysis mapped to applicable frameworks, a detailed technical findings section for your IT team, and a prioritised remediation roadmap with realistic sequencing and cost guidance. The report is designed to be usable directly with your statutory auditor, your cyber insurer, or an investor's due diligence team without requiring translation.
In practice: A technical-only report can sit unread by the people who actually need to act on it — a founder or Board member who cannot parse a CVSS-scored vulnerability list will not act on it. Our layered report format exists specifically to solve that problem.
Can this assessment help us respond to a specific client's or partner's vendor security questionnaire?
Yes — this is a common and specific trigger. Enterprise and institutional clients increasingly require vendor security questionnaires or SOC 2/ISO 27001 evidence before onboarding a new supplier. We can scope the assessment specifically to generate the evidence and documentation your counterparty's questionnaire requires, rather than a full generic assessment, where that is the actual driving need.
In practice: We ask to see the actual questionnaire early in scoping wherever a specific counterparty's requirement is the trigger — questionnaires vary significantly in what they actually ask for, and scoping precisely to the real requirement avoids both under-delivery and unnecessary over-scoping.
Who at PNPC actually delivers this assessment — is it a CA, or a separate technology team?
The engagement is led by a practising Chartered Accountant with governance, risk, and compliance experience, working alongside technical security resources (in-house or a vetted technical partner) who perform the hands-on vulnerability testing. The distinguishing feature of our approach is that the same governance and regulatory lens applied to your statutory audit and compliance work is applied consistently to the cyber assessment — not handed off between disconnected teams that never reconcile their findings.
In practice: We deliberately avoid the model where a purely technical vendor delivers a scanner printout and a separate compliance team is left to interpret its regulatory relevance months later. One accountable, CA-led team owns the assessment from scoping through the final Board presentation.
Where this sits in the wider engagement
Cyber & Information Security Assessment rarely arrives on its own. The statutory basis and the current requirements are set out on the Cyber & Information Security Assessment service page, and the related services are grouped under Business Transformation.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Cyber & Information Security Assessment we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.