Cyber Security Control & IT Risk Review: The Process, Start to Finish
The mechanics of Cyber Security Control & IT Risk Review are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the Cyber Security Control & IT Risk Review page.
What are CERT-In's cyber incident reporting directions and do they apply to us?
CERT-In (Indian Computer Emergency Response Team), under Section 70B of the Information Technology Act 2000, issued directions in April 2022 that apply broadly to entities operating computer resources in India. Key obligations include: reporting specified categories of cyber security incidents (data breaches, ransomware, unauthorised access, and others listed in the directions) to CERT-In within six hours of detection or of being made aware of the incident; maintaining logs of all ICT systems for a rolling period of 180 days, stored within India; and synchronising system clocks to designated time sources. These directions apply broadly — not just to large or regulated entities.
In practice: The six-hour window is measured from detection or awareness, not from when the incident actually began — and it is a genuinely tight window. Most organisations discover during our review that their internal escalation process alone would consume most or all of that six hours before anyone even started drafting the CERT-In report. We test this specifically.
How does this review connect to my statutory audit?
Where your financial reporting depends on IT systems — which is the case for virtually every company today — your statutory auditor's opinion under Section 143(3)(i) of the Companies Act 2013 on Internal Financial Controls, and the CARO 2020 commentary on internal controls, both implicitly rely on the IT General Controls underneath your financial systems: access management, change management, backup and recovery. A cybersecurity control review conducted ahead of the year-end audit surfaces and fixes these gaps proactively, rather than having the statutory auditor discover them during audit fieldwork and raise them as findings or management letter points.
In practice: We time the ITGC-relevant portion of the review to complete before year-end audit fieldwork begins wherever possible — a gap found and fixed in month 9 is a non-event; the same gap found by the auditor in month 12 becomes a documented audit finding.
How long does the review take?
The time a first-time review takes for the assessment and report, and for the remediation verification that follows, depends on the size and complexity of the company and the scope agreed; confirm the expected timeline at scoping. Larger or more complex organisations, or those with multiple regulated entities/subsidiaries in scope, take longer. Subsequent-year reviews, building on an established asset inventory and control matrix, are typically faster since the framework only needs updating for what has changed.
In practice: The single biggest driver of timeline in practice is not our testing speed — it is how quickly the client's IT team can produce the requested access logs, configuration exports, and policy documents. We flag this at kickoff and provide the full document checklist upfront to avoid mid-review delays.
What is the Digital Personal Data Protection Act 2023 and how does it affect this review?
The DPDP Act 2023 is India's comprehensive data protection legislation, governing how organisations (data fiduciaries) collect, process, store, and protect personal data of individuals (data principals). It introduces obligations around consent, purpose limitation, data breach notification, and reasonable security safeguards, with the DPDP Rules, 2025 notified on 14 November 2025 and their operative provisions commencing in phases (consent-manager provisions from 13 November 2026 and the main Data Fiduciary obligations from around 14 May 2027, unless an earlier date is notified). As part of this review, we assess your data classification, encryption, retention, and consent-architecture readiness against the Act's requirements, so that when the operational rules are fully in force, your control environment is not starting from zero.
In practice: The Act's rules and compliance timelines have been rolled out progressively rather than all at once — we track the notification status and advise clients on what is currently in effect versus what to prepare for ahead of full enforcement, rather than treating every provision as immediately binding.
How is a Critical, High, Medium, or Low finding actually defined?
We classify findings using a consistent risk-rating methodology based on the likelihood of the control gap being exploited or causing harm, and the potential impact if it is — financial, regulatory, reputational, or operational. A Critical finding typically involves an active exploit path to sensitive data or financial systems with no compensating control. High findings represent a significant control gap that is not immediately exploitable but poses material risk. Medium and Low findings represent design or process gaps with lower immediate risk but that still warrant remediation to avoid future exposure.
In practice: We deliberately calibrate severity conservatively rather than inflating findings — a report with twenty 'Critical' findings trains the Board to stop believing the word 'Critical' means anything. Genuine criticals should be rare and should get immediate attention; everything else gets a realistic, proportionate rating.
How does PNPC's Chennai/Bangalore/Hyderabad/Dubai presence matter for this kind of review?
For groups with operations spanning India and the UAE, we coordinate the review across jurisdictions under one engagement — assessing the Indian entity against SEBI/RBI/CERT-In/DPDP Act requirements as relevant, and coordinating with the UAE entity's own data protection and cybersecurity obligations under UAE federal and free-zone frameworks, so the Board gets one consistent risk picture rather than two disconnected reports from two different advisors.
In practice: Cross-border data flows between an Indian and UAE entity in the same group raise their own data-transfer and localisation questions on both sides — we flag these specifically for groups with that structure rather than treating each entity's review in isolation.
What happens during the 'IT General Controls' section if we use an accounting software provider that manages the infrastructure for us (SaaS/cloud accounting)?
Where core financial systems are hosted and managed by a third-party SaaS provider, the relevant ITGCs partly shift to that provider's environment. We assess what controls remain your organisation's responsibility (user access management within the application, approval workflows configured within the tool) versus what should be evidenced by the provider's own certifications (SOC 2 report, ISO 27001 certificate) — and flag where a provider cannot or will not furnish that evidence as a vendor risk finding in its own right.
In practice: A surprising number of cloud accounting and ERP vendors, when asked directly for a SOC 2 report or ISO certificate, cannot produce one. That gap becomes a documented vendor-risk finding — it tells the Board something concrete about a dependency they may not have previously scrutinised.
How does this review interact with a prior year's audit findings or management letter points on IT?
We specifically request and review the prior year's statutory audit management letter and any IT-related findings as an input to scoping — a review that ignores what the statutory auditor already flagged risks either duplicating known findings without adding value or, worse, missing that a previously flagged gap was never actually closed.
In practice: A prior-year audit finding marked closed internally may never have been independently verified as fixed. Closure claims deserve scepticism until verified.
Is remote/hybrid work a specific risk area you assess?
Yes. Remote and hybrid work materially expands the attack surface — VPN configuration and usage discipline, endpoint security on personally-owned (BYOD) devices, use of personal email or unsanctioned file-sharing tools for company data, and physical security of devices outside the office are all assessed as part of the access and endpoint control review, particularly for organisations that shifted to hybrid arrangements without formally updating their security policy to match.
In practice: The single most common gap we find in hybrid-work environments is a security policy still written for an office-only workforce, sitting alongside an actual operating reality of company data flowing through personal devices and home networks the policy never contemplated.
Where this sits in the wider engagement
Cyber Security Control & IT Risk Review rarely arrives on its own. The statutory basis and the current requirements are set out on the Cyber Security Control & IT Risk Review service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Cyber Security Control & IT Risk Review we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.