System Audit Report for Data Localisation

---

As per RBI directive on Storage of payment system data (DPSS.CO.OD.No 2785/06.08.005/2017-18 dated April 06, 2018), Companies handling payment data have to undergo yearly SAR audits for data localisation. The audits reports have to be signed off by a CERT-in empanelled auditor. SICHERTEN helps you meet this regulatory compliance.

Our comprehensive audit process covers all the requirements of RBI guidelines and NPCI guidelines. The following are included in the audit.

- Review of system documentation and architecture diagrams
- Interviews with key personnel (IT, Security, Compliance)
- Verification of configurations, logs, and access controls
- Sample testing of payment data elements
- Review of policies, procedures, and compliance evidence
- Validation against RBI/NPCI Data Localization requirements 

The audit is conducted in 4 phases.

1:  Scope finalisation and document verification

2: Control review and Gap assessment

3: Remediation and follow up assessment

4: Report submission and CERT-in Audit certificate