Our role: eSign service provider audits are carried out by auditors empanelled with the Controller of Certifying Authorities (CCA). Rakvora provides pre-audit readiness, security testing and remediation support ahead of that audit.
Organisations offering or integrating eSign must meet the security and operational requirements set by the Controller of Certifying Authorities.
We review your eSign integration, key handling, audit trails and application security so you are ready for the formal audit.
Objectives
- Review eSign integration and API security
- Assess key management and signing workflows
- Verify audit trails and logging
- Test the applications in scope
Methodology
01
Scoping
- Confirm the applicable regulation, circulars and in-scope systems
- Agree timelines against your regulatory deadline
02
Pre-audit assessment
- Control-by-control review against the regulatory checklist
- Vulnerability assessment and penetration testing of in-scope systems
03
Remediation
- Prioritised fix plan with owners and dates
- Hands-on support closing gaps and updating policies
04
Audit readiness
- Evidence pack organised to the auditor's checklist
- Support during the statutory audit and closure of observations
Deliverables
Pre-audit gap assessment report
VAPT report with retest
Remediation tracker
Evidence pack for the statutory auditor