Cyber & Information Security Assessment: The Process, Start to Finish
The mechanics of Cyber & Information Security Assessment are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the Cyber & Information Security Assessment page.
We are a small business with no dedicated IT team. Is this assessment relevant at our scale?
Often yes, if a real trigger exists — you process customer payment data, you are applying for cyber insurance, an enterprise client's vendor security questionnaire now requires evidence of an assessment, or you are raising a funding round. For a genuinely early-stage business with minimal technology footprint and no customer data at risk, a lighter-touch security hygiene review may be more proportionate, and we will recommend that scope rather than oversell a larger engagement.
In practice: We scope every assessment to actual risk and actual triggers. A 13-stage full assessment is right for a business processing sensitive data at scale; a smaller business with a narrow trigger may only need a subset of that process, at a correspondingly smaller fee.
Does the Digital Personal Data Protection Act, 2023 (DPDP Act) apply to our business, and how does that relate to this assessment?
The DPDP Act, 2023 establishes a framework for the processing of digital personal data in India, with obligations on 'Data Fiduciaries' (broadly, entities that determine the purpose and means of processing personal data) around consent, purpose limitation, data security safeguards, and breach notification. The DPDP Rules, 2025 were notified on 14 November 2025 and bring the Act into force in phases: the Data Protection Board provisions took effect on notification, the consent-manager provisions follow at 12 months (13 November 2026), and the main obligations on Data Fiduciaries at 18 months (around 14 May 2027), unless an earlier date is notified. Where the Act's provisions apply to your data processing, the security safeguards required overlap substantially with the control areas our cyber security assessment already covers — access control, data governance, incident response, and breach notification readiness.
In practice: We treat the DPDP Act as an evolving compliance layer on top of the existing IT Act/CERT-In baseline rather than a fully separate exercise — much of what a well-executed cyber security assessment identifies and remediates also strengthens DPDP Act readiness. We flag DPDP-specific gaps explicitly where they diverge from general cyber security practice.
We are a listed company. Does SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) apply to us, and how does PNPC address it?
SEBI's CSCRF applies to SEBI-registered Regulated Entities — such as stock exchanges, clearing corporations, depositories, stock brokers, depository participants, mutual funds/AMCs and registrars/transfer agents — rather than to listed companies as such. A listed company that is not itself a SEBI-registered intermediary falls outside CSCRF, but has cyber incident disclosure obligations under SEBI's LODR Regulations (Regulation 30, where material). Where CSCRF applies, it sets out structured requirements around governance, identification of critical systems, protection, detection, response, and recovery, along with reporting obligations. Applicability varies by the specific category of regulated entity, so the first step in our engagement for any SEBI-regulated client is confirming exactly which CSCRF requirements apply to your specific entity category. We map our assessment findings directly against the applicable CSCRF requirements so your Board and compliance officer can demonstrate structured compliance.
In practice: CSCRF applicability and specific requirements differ meaningfully by entity category — we do not apply a one-size-fits-all checklist. Confirming your exact regulatory category is the first, non-negotiable step before we scope a CSCRF-aligned assessment.
We are an NBFC/bank. What does RBI expect regarding cyber security?
RBI has issued cyber security frameworks and guidelines applicable to banks and, separately, to NBFCs, covering governance (Board-level oversight, often through an IT Strategy Committee), risk management, IT outsourcing due diligence, and incident reporting expectations. The specific requirements and thresholds vary by the category and scale of the regulated entity. Our assessment for RBI-regulated clients maps findings against the applicable RBI framework and helps prepare the documentation your Board and RBI examination process will expect to see.
In practice: RBI-regulated clients should treat cyber security assessment as a Board governance matter, not purely an IT department exercise — RBI's framework places real emphasis on demonstrated Board-level oversight, which is a documentation and governance requirement as much as a technical one.
How long does a Cyber & Information Security Assessment take?
A full assessment — scoping, technical testing, access and governance review, regulatory gap analysis, and a prioritised remediation roadmap — takes a time that depends on the scope, the size of the business and the regulatory requirements involved; confirm the expected timeline at scoping. A narrower, specifically scoped assessment (for example, addressing a single insurer's questionnaire) can be completed faster. Multi-entity engagements, or those layering in SEBI CSCRF or RBI-specific requirements, typically take longer. Remediation verification is a separate follow-on phase after the initial report.
In practice: The most common timeline variable is not the technical testing — it is how quickly the client's internal team can produce the asset inventory, existing policy documents (or confirm their absence), and access to systems that need to be reviewed. We build the project plan around your organisation's actual readiness to provide this information.
What frameworks do you assess against — ISO 27001, NIST, something else?
We benchmark against internationally recognised frameworks — principally ISO/IEC 27001 control domains, the NIST Cybersecurity Framework, and CIS Controls — while layering in the specific statutory and regulatory obligations that actually apply to your entity under Indian law (IT Act 2000, CERT-In directions, SEBI CSCRF, RBI guidelines as applicable) and, for UAE entities, relevant UAE cybersecurity and data protection requirements. The framework blend is scoped to your sector and regulatory profile rather than applied as a single fixed checklist.
In practice: We are explicit with clients about which framework elements are 'good practice benchmarking' versus 'mandatory legal/regulatory obligation' — the distinction matters when prioritising remediation budget, because regulatory obligations carry direct compliance consequences that pure best-practice gaps do not.
What does the assessment actually cost, and how is PNPC's fee structured?
Fees depend on scope — the number of systems and data flows in scope, the depth of technical testing required, whether SEBI CSCRF/RBI-specific mapping is needed, and whether policy drafting and remediation verification are included. We provide a written scope and fee proposal before any engagement begins; there is no fixed published price because the right scope varies significantly with business size, sector, and regulatory profile.
In practice: We deliberately scope and price to the actual risk and regulatory profile in front of us — a single-entity startup with a narrow web application and no regulated-sector obligations requires meaningfully less work than a listed NBFC subject to both SEBI CSCRF and RBI guidelines. Ask for a scoping conversation before assuming cost from a generic price list.
How does PNPC prioritise which findings to fix first?
We rank findings by business materiality, not technical severity score alone — factoring in what data or system the vulnerability exposes, how easily it could realistically be exploited, what regulatory or contractual obligation it relates to, and the realistic cost and effort to remediate. A technically 'critical' finding on an isolated test environment with no sensitive data may be deprioritised below a 'medium' finding on a system processing customer payment data.
In practice: We explicitly walk clients through the reasoning behind our prioritisation, not just the ranked list — because leadership needs to understand why item 3 outranks item 1 on a pure technical severity scale, in order to trust and act on the sequencing we recommend.
How often should a business repeat this assessment?
We generally recommend an annual reassessment as a baseline, with an additional review triggered by significant change events — a new major SaaS vendor or cloud environment, a new UAE or overseas entity, a funding round or acquisition, or a relevant regulatory update (new CERT-In direction, SEBI CSCRF revision, DPDP Act rules coming into force). A one-time assessment that is never repeated becomes stale as your technology environment and the regulatory landscape both evolve.
In practice: We flag this explicitly in every engagement's final report — a cyber security assessment is a snapshot, not a permanent certification of safety. Treating the first assessment as a one-time exercise leaves a business exposed to a subsequently introduced vendor or system that was never assessed.
Where this sits in the wider engagement
Cyber & Information Security Assessment rarely arrives on its own. The statutory basis and the current requirements are set out on the Cyber & Information Security Assessment service page, and the related services are grouped under Business Transformation.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Cyber & Information Security Assessment we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.