VAPT Services in Mumbai

No. AxVeil LLP is a young Indian entity and is not currently on the CERT-In Information Security Auditor empanelment list. For CERT-In mandated audits we partner with empaneled firms — see /partners. Empanelment requires multiple years of operating history, a 5+ trained-auditor headcount, an audited revenue threshold and a CERT-In technical evaluation; we will apply once we cross those thresholds. For Mumbai fintech / insurtech advisory, foreign-bank India ops, DPDP Act work and SOC 2 / ISO 27001 driver engagements, AxVeil contracts directly. Reference: https://www.cert-in.org.in.

CERT-In's April 2022 directions require 20 categories of cyber incidents to be reported within 6 hours of noticing or being brought to notice. RBI separately requires regulated entities to report unusual cyber incidents to the Department of Supervision within prescribed windows under the cyber security framework. AxVeil engagements include a Mumbai-tuned incident response playbook so your CISO can hit both clocks. The reporting clock applies to every BFSI entity regardless of empanelment status of the audit firm. Reference: https://www.cert-in.org.in.

The formal CSCRF cyber audit submission to SEBI requires a CERT-In empanelled audit firm on the signed report. AxVeil is not currently on that list. For the regulator-facing submission we deliver under sub-contract to a CERT-In empanelled partner (see /partners) — the partner holds the buyer paper and signs the submission, AxVeil delivers the operator-led technical work behind it. For pre-audit gap assessment, CSCRF principle mapping (Anticipate / Withstand / Contain / Recover / Evolve), evidence-pack design and retest closure on prior findings, AxVeil contracts directly. Reference: https://www.sebi.gov.in.

Where the RBI submission requires a CERT-In empanelled signature (the cyber security framework for SCBs, the cyber resilience baseline for UCBs, the NBFC IT framework, the digital lending guidelines, the master direction on IT governance and the SAR), we deliver the technical work under sub-contract to an empanelled partner who signs the regulator-facing report — see /partners for the partner roster. For pre-audit readiness, ongoing offensive security on the production stack, evidence-pack design and retest closure on prior findings, AxVeil contracts directly. Reference: https://www.rbi.org.in.

The formal IRDAI annual cyber audit submission requires a CERT-In empanelled audit firm. AxVeil delivers the technical engagement under sub-contract to an empanelled partner for the regulator-facing piece. Pre-audit readiness, ongoing offensive security, ISNP / web-aggregator security review and CISO reporting support AxVeil contracts directly. Reference: https://www.irdai.gov.in.

Critical payment systems (SWIFT CSP, NPCI UPI, RTGS / NEFT) are tested under tightly scoped read-only or staging-only methodology with explicit RBI-aligned change controls. We never touch production payment rails without written authorisation and a rollback plan. SWIFT CSP attestation alignment is supported on request.

Every Mumbai BFSI entity processes personal data of customers and is therefore a data fiduciary under the DPDP Act 2023, with penalties of up to INR 250 crore per instance for failure to safeguard personal data. Most large banks, AMCs and insurers will likely be designated Significant Data Fiduciaries (SDFs) requiring DPIA, DPO appointment and independent data audit. Reference: https://www.meity.gov.in.

Remote-first by default — testing, daily CISO digests and the readout call run over Teams / Zoom in IST hours. Engagements are served across Bandra Kurla Complex, Lower Parel, Nariman Point, Worli, Powai, Andheri East and Navi Mumbai. Onsite kick-offs for internal AD, treasury or trading-floor scopes are arranged on a per-engagement basis under your visitor-management policy.