Overview
Indian regulated entities answer to several rulebooks at once: RBI or IRDAI directions, SEBI's CSCRF, CERT-In guidance, PCI DSS for card data and ISO 27001 for customers. Each expects testing evidence in a slightly different shape. We scope one engagement against the obligations that apply to you and track closure against deadlines such as CSCRF's three months. We do not claim CERT-In empanelment, so if an empanelled auditor is mandatory, raise it at scoping and we will give you a clear answer.
Many security standards require penetration testing, but a generic test does not automatically satisfy them. Each framework expects particular scope, timing and evidence, and an auditor needs to see that those expectations were met, not just that some testing happened. Compliance pentesting starts from the control you must satisfy and works backward, so the engagement is designed from the outset to produce the evidence your assessor is looking for.
For payment environments, PCI DSS v4.0.1 Requirement 11.4 calls for penetration testing at least annually and after any significant change, covering the cardholder data environment and the segmentation that isolates it; we scope the test and the segmentation checks accordingly. For an information security management system, ISO/IEC 27001:2022 Annex A 8.8 on technical vulnerabilities and A.8.29 on security testing in development point to regular testing, and we align the engagement to those controls. For SOC 2, a penetration test is commonly expected as evidence supporting the security criteria, so we document it to suit an attestation.
For Indian clients we also map the work to RBI, SEBI CSCRF, IRDAI and CERT-In expectations where they apply. We map findings to the relevant controls, provide an evidence pack covering scope, dates, method and results, and issue an attestation letter once fixes are retested. Where your obligations go further, we align the evidence to your regulator, whether that is RBI, SEBI or IRDAI, so one engagement can support several obligations at once.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Requirement reviewWe confirm which framework, control and timing your test must satisfy.
- ScopingThe engagement is designed to meet that control, including any segmentation checks.
- TestingWe test the in-scope environment to the depth the standard expects.
- Evidence assemblyFindings are mapped to controls and packaged for audit.
- Retest & attestFixed findings are retested and an attestation letter is issued.
What you receive
- Report scoped and mapped to your framework
- Audit-ready evidence pack with scope, dates and method
- Segmentation test results where PCI DSS applies
- Findings mapped to the relevant controls
- Attestation letter once fixes are retested
Standards & frameworks
- PCI DSS v4.0.1 Req. 11.4
- ISO/IEC 27001:2022 A.8.8
- ISO/IEC 27001:2022 A.8.29
- SOC 2
- NIST SP 800-115
- PTES
- CVSS v4.0
- SEBI CSCRF
- RBI IT Governance Direction 2023
- IRDAI Cyber Security Guidelines 2023
- CERT-In Audit Guidelines 2025
- DPDP Act 2023
Frequently asked questions
Which frameworks can this support?
Commonly PCI DSS, ISO/IEC 27001 and SOC 2, and it aligns to Indian regulators such as RBI, SEBI and IRDAI where you have further obligations. We scope the single engagement so its evidence serves whichever standards and jurisdiction you report against.
How often does PCI DSS need a pentest?
Requirement 11.4 calls for penetration testing at least once a year and after any significant change to the environment, covering both the cardholder data environment and the controls that segment it. We scope the test and segmentation checks to match that expectation.
Will our auditor accept your report?
Reports state scope, dates, method and risk-rated findings with evidence, and we map results to the relevant controls. Once fixes are retested we issue an attestation letter. We cannot act as your certifying body, but assessors routinely accept testing documented this way.
How often do Indian regulators expect VAPT?
It depends on the rulebook. RBI expects periodic VA/PT of critical and internet-facing systems, SEBI's CSCRF sets half-yearly VAPT for Qualified Stock Brokers, and CERT-In's 2025 guidelines call for at least one comprehensive audit a year. We help you build one calendar that covers each rule you report against.
Do you offer annual VAPT contracts?
Yes. Many Indian clients prefer a yearly agreement that covers two or more VAPT cycles plus retests, priced in INR with GST shown separately. Scope is reconfirmed before each cycle so the price stays accurate.