PPI issuers must operate secure, resilient systems and have them audited as prescribed in RBI's Master Directions on PPIs.
We review your wallet or card platform, transaction security, fraud controls and IT operations, and test the systems customers and attackers interact with.
Objectives
- Assess PPI platform security and transaction controls
- Review customer authentication and fraud risk management
- Test mobile apps, web portals and APIs
- Evaluate IT operations, BCP and incident response
Methodology
01
Planning
- Define scope, applicable requirements and critical systems
- Agree audit plan, sampling approach and timelines
02
Fieldwork
- Review of policies, procedures and governance
- Testing of technical and operational controls
- Interviews with process owners and evidence verification
03
Technical testing
- Vulnerability assessment and penetration testing where in scope
- Configuration review of servers, databases and network devices
04
Reporting
- Observations rated by risk with recommendations
- Management responses and follow-up review
Deliverables
Audit plan and scope
Audit report with risk-rated observations
VAPT report where in scope
Remediation plan and follow-up review