Cyber Security Control & IT Risk Review: Who Needs It and Who Does Not
Whether Cyber Security Control & IT Risk Review applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the Cyber Security Control & IT Risk Review page.
Does my company legally need this review, or is it optional?
It depends on your regulatory category. SEBI-registered intermediaries and market infrastructure institutions (stock brokers, mutual funds/AMCs, depository participants, RTAs, exchanges, clearing corporations, and similar Regulated Entities) fall under SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), which mandates periodic risk assessment and Board-level reporting; listed companies generally (even if not a CSCRF-covered intermediary) carry a narrower cybersecurity incident and materiality disclosure obligation under SEBI's LODR Regulations. Banks, NBFCs, and payment system operators fall under RBI's cybersecurity framework circulars, which require a Board-approved cybersecurity policy and periodic VAPT. Service providers, intermediaries, data centres, body corporates and government organisations covered by CERT-In's April 2022 directions have specific logging and 6-hour incident-reporting obligations. If none of these apply to you directly, the review is not a standalone statutory requirement — but it remains good governance practice, particularly if IT systems underpin your financial reporting (relevant to your statutory auditor's Section 143(3)(i) opinion) or if you handle personal data that will trigger obligations under the Digital Personal Data Protection Act 2023.
In practice: We map the applicable regulatory stack for your specific entity type in the scoping conversation before any technical work begins — this determines the framework we test against and the reporting cadence we recommend.
We already have an internal IT team that manages security. Why do we need an external review?
Internal IT teams are usually the ones who designed and operate the controls being tested — an internal self-review has an inherent conflict of interest and, more practically, an internal team often cannot see its own blind spots. Independent review provides objectivity the Board and Audit Committee (and, where applicable, a regulator) can actually rely on. It is also frequently a specific expectation under SEBI CSCRF and RBI's cybersecurity framework that the assessment carries genuine independence from day-to-day IT operations.
In practice: We have found strong internal IT teams miss the same categories of gap repeatedly — not from incompetence, but because they are testing their own work. An access review performed by the person who provisions access rarely catches their own provisioning shortcuts.
What is an IT General Control (ITGC) and why does it matter for a financial audit?
IT General Controls are the foundational controls over an IT environment that support the reliability of application-level controls and, in turn, financial reporting — access management (who can get into a financial system and how that is granted/removed), change management (how changes to system configuration are approved and tested), backup and recovery (whether financial data can actually be restored if lost), and job scheduling (whether automated financial processes run reliably and completely). If ITGCs are weak, an auditor cannot rely on any application control that depends on that IT environment — which can significantly increase the scope and cost of substantive testing in the statutory audit.
In practice: A single weak ITGC can undo an otherwise well-run finance team — a shared 'admin' login used by three different people, no individual accountability — and force the statutory auditor to substantively test transactions they would otherwise have relied on controls for. Fixing that one control before year-end is far cheaper than the expanded audit scope that follows if it is not.
Can this review help us get cyber-liability insurance or reduce our premium?
Many cyber-liability insurers now require or reward evidence of an independent, recent security assessment as part of underwriting — some proposal forms ask for it directly, and insurers increasingly price premiums based on demonstrated control maturity rather than self-certified questionnaires alone. A completed review with a clean or well-remediated findings profile can support both the underwriting process and, in some cases, more favourable terms, though PNPC does not control or guarantee insurer pricing decisions.
In practice: We recommend clients share the executive summary and remediation status with their insurance broker directly — insurers respond far better to a structured, professionally issued report than to an internal self-assessment questionnaire filled in by the IT team.
Do smaller, unlisted, non-regulated companies ever need this review?
Yes, increasingly — not because of a direct statutory mandate, but because enterprise customers, investors, and insurers now routinely ask for evidence of a tested security control environment as a precondition of doing business. A mid-sized unlisted company selling into enterprise or government accounts, or approaching a Series A/B round, frequently finds this review requested as part of the counterparty's own due diligence checklist, well before any regulator would require it directly.
In practice: This review is increasingly requested by counterparties — enterprise procurement teams, investors — as part of due diligence, often before direct regulatory mandates apply. Being able to produce a recent, credible report proactively, rather than scrambling when a term sheet or vendor contract demands one, is a real competitive advantage.
Where this sits in the wider engagement
Cyber Security Control & IT Risk Review rarely arrives on its own. The statutory basis and the current requirements are set out on the Cyber Security Control & IT Risk Review service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Cyber Security Control & IT Risk Review we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.