Cyber Security Control & IT Risk Review: Where It Goes Wrong
The failures on Cyber Security Control & IT Risk Review repeat, which means they are avoidable if you know what to watch. The questions below are the ones raised most often in practice; the full scope of the service is on the Cyber Security Control & IT Risk Review page.
What exactly is a Cyber Security Control & IT Risk Review, in plain terms?
It is an independent check on whether your organisation's cybersecurity policies and technical controls are properly designed and are actually being followed in practice — not just written down. We map your IT risk areas, test access controls, network security, data protection practices, incident response readiness, and vendor risk against a recognised framework, then report gaps to your Board or Audit Committee with a prioritised plan to fix them.
In practice: The gap between 'we have a policy for that' and 'that policy is actually followed every time' is where almost every serious finding in this review originates. We test the second, not just the first.
Is this the same as a penetration test?
No. A penetration test (VAPT) actively attempts to technically exploit vulnerabilities in your systems and networks to see what an attacker could achieve. A Cyber Security Control & IT Risk Review takes a broader governance and controls view — policies, access management, vendor risk, incident response readiness, and regulatory compliance — and evaluates whether the overall control environment is sound. The two are complementary; many clients commission VAPT as a technical component within the broader review, but they are not interchangeable.
In practice: An organisation can commission an expensive penetration test while its access de-provisioning process — a former employee's login still active six months after they left — remains completely untested. Both matter; they test different things.
What is SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF)?
CSCRF is SEBI's consolidated cybersecurity framework applicable to SEBI-registered intermediaries and market infrastructure institutions in the securities market — stock exchanges, depositories, clearing corporations, stock brokers, mutual funds/AMCs, RTAs, depository participants, and other categories of SEBI Regulated Entities — that brought together and updated the earlier sector-specific cyber circulars into a single framework. It requires periodic cyber risk assessments, defined incident detection and reporting timelines, a designated CISO function reporting to the Board, and specific controls around data localisation and audit requirements depending on the entity category. Listed companies that are not themselves SEBI-registered intermediaries fall outside CSCRF's direct scope but carry a related, narrower obligation — cybersecurity incident and materiality disclosure under SEBI's LODR Regulations.
In practice: CSCRF applicability and the specific obligations differ by entity category within SEBI's regulated universe — a stock broker's obligations are not identical to an AMC's, and a listed company that is not itself a SEBI-registered intermediary is generally outside CSCRF altogether. We confirm your exact category and applicable clauses before scoping.
What is the difference between a 'control deficiency,' a 'significant deficiency,' and a 'material weakness'?
These are severity classifications commonly used in control assessments, borrowed from the same conceptual framework used in Internal Financial Controls reporting. A control deficiency exists when a control is not designed or operating in a way that allows timely prevention or detection of a risk, but the impact is limited. A significant deficiency is more severe and merits attention from those responsible for governance. A material weakness represents a reasonable possibility that a material misstatement, breach, or loss will not be prevented or detected in a timely manner — the most serious category, typically requiring immediate Board and, where relevant, auditor attention.
In practice: We use this same three-tier language across both our IFC reviews and cybersecurity reviews deliberately — it gives the Audit Committee one consistent severity vocabulary across all their assurance reports, rather than a different scale for every type of review.
What if we do not have any formal IT policies at all — can you still conduct the review?
Yes. Absence of documented policy is itself a finding. We assess actual practice against the applicable framework regardless of whether formal policy exists, and the remediation roadmap will typically include drafting or formalising the missing policy documents as a first-tier action item alongside any technical control gaps.
In practice: An organisation with no written policy but genuinely disciplined practical controls sometimes scores better on operating effectiveness than one with an elaborate policy document nobody actually follows. We test both — design and operation — because they can diverge in either direction.
What is the difference between this review and a management self-assessment questionnaire?
A management self-assessment is an internal exercise — typically a checklist completed by the IT or security team itself, with no independent testing of whether the answers reflect reality. It carries no external assurance value for a Board, auditor, or regulator. A Cyber Security Control & IT Risk Review is performed by an independent party, involves actual testing of evidence (access logs, configuration exports, sampled transactions) rather than self-reported answers, and produces a report that carries genuine evidentiary weight for governance and, where relevant, regulatory purposes.
In practice: We have reviewed self-assessment questionnaires that confidently answered 'yes, MFA is enforced everywhere' — and found, on actual testing, several critical accounts with no MFA at all. Self-reported answers and tested evidence are not the same thing.
What deliverables do we actually receive at the end of the engagement?
A written report covering: the scope and methodology, the risk and control matrix mapped to the applicable framework, detailed findings with severity classification and evidence references, a prioritised and owner-assigned remediation roadmap, and an executive summary suitable for Board or Audit Committee presentation. PNPC also delivers the findings in person to the Board, Audit Committee, or IT Strategy Committee where requested, rather than simply emailing a PDF.
In practice: We always offer to present findings directly to the Board or Audit Committee rather than leaving that translation to internal IT or finance staff — directors ask sharper, more useful questions when they can question the independent reviewer directly.
How do you handle sensitive findings — do you share the full report with everyone in the organisation?
No. We agree report distribution and confidentiality handling with the engaging party (typically the Audit Committee or CFO/CISO) at the outset. Detailed technical findings, particularly anything classified Critical, are handled on a need-to-know basis, since a full vulnerability report circulated too widely can itself become a security risk if it falls into the wrong hands before remediation is complete.
In practice: A Board-level executive summary should be kept separate from the detailed technical findings report — different audiences genuinely need different levels of technical detail, and over-sharing the technical detail internally creates its own exposure.
Can this review be combined with our regular internal audit function?
Yes, and for organisations with an internal audit function under Section 138 of the Companies Act 2013, coordinating the cybersecurity review's timing and scope with the internal audit plan avoids duplicated effort and gives the Audit Committee one integrated risk picture rather than two separately-scheduled, overlapping reviews.
In practice: We proactively ask whether a client has an internal audit function and, if so, what its IT-risk coverage already includes — there is no value in re-testing the same control twice in the same year through two different engagements.
Where this sits in the wider engagement
Cyber Security Control & IT Risk Review rarely arrives on its own. The statutory basis and the current requirements are set out on the Cyber Security Control & IT Risk Review service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Cyber Security Control & IT Risk Review we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.