In an era where data security and privacy are paramount, businesses handling sensitive information
Regulatory non-compliance could result in fines and penalties including reputational damage
Regulatory non-compliance can have far-reaching and severe consequences that extend beyond immediate financial penalties. It can damage an organization’s reputation, disrupt operations, and lead to legal and financial challenges that can be difficult to overcome.
- Easy compliance checklist to get you started.
- Adopt the readily built-in compliance framework for regulations related to cybersecurity, privacy or third-party risks.
- Grant access to your external independent auditors so they can certify your compliance.
Cybersecurity
Regulations
Privacy
Regulations
Third Party or Outsourcing
Regulations
Stay ahead of constantly changing regulations with our compliance solution
We understand the struggles organization’s face in grasping compliance requirements, whether it’s related to Third-Party Risk, Information and Cyber Security guidelines, or Privacy and Data Protection regulations. Simplify compliance, mitigate risks, and ensure your organization stays compliant.
Contact us today to stay on top of regulatory changes and protect your business.
Contact us today to stay on top of regulatory changes and protect your business.
Third Party Risk
Regulations related to Third-Party Risks and Outsourcing.
Information & Cyber Security
Regulations related to Information and Cyber Security Guidance.
Privacy & Data Protection
Regulations related to Privacy and Data Protection Laws.
Security and Exchange Board of India (SEBI)
The Securities and Exchange Board of India has put out an advisory for SEBI Regulated Entities (REs) regarding cybersecurity best practices to limit cyber threats and phishing attacks. SEBI has asked all REs, including financial sector organisations, stock exchanges, depositories, mutual funds and other financial entities, to provide compliance of the advisory along with their cybersecurity audit report.
SEBI has issued a consultation paper on ‘Consolidated Cyber Security and Cyber Resilience Framework (CSCRF) for Sebi Regulated Entities’ looks at providing a common structure for multiple approaches to cyber security to prevent any cyber-risks/incidents.
Reserve Bank of India (RBI)
The Reserve Bank of India has issued guidance on third party risks, information and cyber security.
The Reserve Bank of India (“RBI”) notified the Master Direction on Outsourcing of Information Technology Services (“Master Directions”) on April 10, 2023. These Master Directions are released subsequent to receiving public comments on the RBI’s draft of the Master Directions.
The Master Directions intend to regulate the outsourcing of information technology (“IT”) services by banks, non- banking financial companies (“NBFCs”), primary cooperative banks, EXIM Bank, National Bank for Agriculture and Rural Development, National Bank for Financing Infrastructure and Development, National Housing Bank, Small Industries Development Bank of India Credit Information Companies, etc (collectively, “RE”).
REs typically outsource a substantial portion of their IT and IT enabled services to third party service providers. Such dependency on third parties exposes REs to significant risks as the autonomy of its IT systems could be compromised and thereby their operational integrity could be threatened. RBI has also ramped up its checks on the soundness of cyber security practices of various institutions in the ecosystem.
Insurance Regulatory and Development Authority of India (IRDAI)
The IRDAI has released Information and Cyber Security Guidelines, 2023. Considering the wide-spread adoption of digital technologies and the concurrent increase in cyber security incidents, the revised Guidelines are hereby issued in order to enable the insurance industry to strengthen their defenses as well as related governance mechanism to deal with such emerging cyber threats.
All Insurers including FRBs, Insurance Intermediaries covering Brokers, Corporate Agents, Web Aggregators, TPAs, IMFs, Insurance Repositories, ISNP, Corporate Surveyors, MISPs, CSCs and Insurance Information Bureau of India (IIB) shall adhere to the said Guidelines. Those entities who have already completed security audit for FY 2022-23 shall ensure compliance with these guidelines from next financial year.
The Digital Personal Data Protection Act 2023
Our solution can provide your organization with a head start. The new Data Protection Bill is aimed at safeguarding the data of consumers in India, and big corporations and consumers will be charged a hefty fine if they fail to do so and don’t follow the norms listed in the bill.
Indian Computer Emergency Response Team (CERT-In)
CERT-In issues “Guidelines on Information Security Practices” for Government Entities for Safe & Trusted Internet.
Recognizing the significance of a secure and trustworthy digital environment, the Government of India has formulated policies aimed at ensuring safe & trusted and secure cyber space for its users. It remains fully aware of the growing cyber threats and attacks present in today’s digital world.
To further address the goal of safe cyberspace, today the Indian Computer Emergency Response Team (CERT-In) has released guidelines on information security practices. These guidelines, issued under the powers conferred by clause (e) of sub-section (4) of section 70B of the Information Technology Act, 2000 (21 of 2000), apply to all Ministries, Departments, Secretariats, and Offices specified in the First Schedule to the Government of India (Allocation of Business) Rules, 1961, along with their attached and subordinate offices.
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (EU) 2016/679 (GDPR) is a regulation in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA). It also addresses the transfer of personal data outside the EU and EEA areas.
The GDPR aims primarily to give control to individuals over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.
Know More
Office of the Superintendent of Financial Institutions (OSFI) – Guideline B10 (Canada)
The Office of the Superintendent of Financial Institutions (OSFI) in Canada issued Guideline B-10, also known as the “Outsourcing of Business Activities, Functions, and Processes.” This guideline provides guidance and expectations for financial institutions when they engage in outsourcing arrangements.
Guideline B-10 outlines OSFI’s expectations for Federally Regulated Financial Institutions (FRFIs) to take a risk-based approach to managing third-party arrangements.
Financial Services Regulatory Authority (FSRA) – Effective IT Risk Management (Canada)
This guidance is applicable to all entities and individuals regulated by FSRA. The guidance describes practices and desired outcomes for regulated entities and individuals, but does not prescribe how to achieve them. This principles-based approach offers regulated entities and individuals the flexibility to achieve the outcomes in a manner that is suitable for the size and nature of their business.
FSRA defines “IT risk” as the risk of financial loss, operational disruption or damage, or reputational loss resulting from the inadequacy, disruption, destruction, failure, or damage by any means to a regulated entity or individual’s IT systems, infrastructure, and data.
IT risk can be external or internal to a regulated entity or individual. IT risk encompasses, but is not limited to, cyber risk. While cyber risk specifically relates to deliberate or accidental breaches of security (e.g., a data breach), IT risk also includes any risk extending from the use of IT (e.g., aging digital infrastructure).
IT risk represents a significant and growing threat to the business, operations and stability of FSRA’s regulated sectors, and can result in negative impacts to consumers. This can disrupt confidence in the financial services and pension sectors.
Personal Information And Electronic Documents Act (Canada)
The Personal Information Protection and Electronic Documents Act (PIPEDA) is a Canadian federal privacy law that governs the collection, use, and disclosure of personal information by private sector organizations. Here is a summary of key aspects of PIPEDA:
Purpose: PIPEDA aims to balance the right to privacy of individuals with the need of organizations to collect, use, or disclose personal information for legitimate purposes.
Scope: PIPEDA applies to private sector organizations engaged in commercial activities across Canada, with some exceptions for provinces that have their own substantially similar privacy laws (e.g., Quebec).
PIPEDA establishes rules and principles to govern the handling of personal information by private sector organizations in Canada, with a strong emphasis on obtaining consent, safeguarding data, and providing individuals with the right to access and control their personal information. It is an essential piece of legislation to protect the privacy rights of Canadian citizens.
Know More
Federal Financial Institutions Examination Council (FFIEC)
The Federal Financial Institutions Examination Council (FFIEC) members are taking a number of initiatives to raise the awareness of financial institutions and their critical third-party service providers with respect to cybersecurity risks and the need to identify, assess, and mitigate these risks in light of the increasing volume and sophistication of cyber threats.
Know More
Recent Articles
ISO/IEC 27001 is the world’s best-known standard for information security management systems (ISMS).
In the rapidly evolving digital landscape, businesses face an unprecedented level of cyber threats,
Frequently Asked Questions
ENGAIZ supports regulations related to cybersecurity guidelines, privacy and outsourcing or third-party risk. Our platform has the required framework to make it easy for your organization to meet most requirements including continued compliance year after year.
Please refer to the regulations section to learn more on the regulations supported by our platform.
ENGAIZ does not certify or attest your compliance with any regulations. Through our partnership with independent external audit firms, we help you prepare for the audits. Our platform makes it easy for your organization to seamlessly complete the external audit.
We have partnerships with AICPA licensed audit firms in the USA and in India Chartered Accountant firms registered with the Institute of Chartered Accountants of India (ICAI) or CERT-In empaneled audit firms.
The regulatory guidelines on cybersecurity guidelines, privacy and outsourcing or third-party risk require that organizations meet certain control requirements. These include but not limited to defining policies and procedures, performing annual risk assessments, undergoing security awareness training, conducting internal audits and more.
The ENGAIZ platform makes it easy for your organization as it automates a number of these compliance requirements to fast track your compliance journey. Compliance is a continuous requirement and hence leveraging a platform like ENGAIZ keeps your organization compliant and always ready for external audits.