Action · REM-F-IAQ2-PAY-01
Remediate: bulk payout api accepted requests without customer 2fa.
ClosedOwner Deepa MenonTarget 31 Jul 2026
Requirement to validation
Requirement
ISO-A.8.24 · ISO-A.8.5 · RBI-DPSC-2021-4 · SOC2-CC6.1 · SOC2-CC6.7
mapped
Policy
Payments Security Policy
pol-payments
Control
PAY-01
Payment APIs secured with mTLS, signing and customer 2FA
Application
PayGate Payment Gateway · Meridian Customer Portal
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-RBI-PAY-01 · High confidence
Finding
F-IAQ2-PAY-01 · High
Closed
Action
Deepa Menon
REM-F-IAQ2-PAY-01 · Closed
Validation
Validated
as recorded
Remediation
- Owner (FPR)
- Deepa Menon
- Priority
- High
- Target date
- 31 Jul 2026
- Status
- Closed
- Management response
- Management agreed and committed to remediate before the Q3 review.
Did it hold?
- Validation
- RET-F-IAQ2-PAY-01
- Status
- Validated
- Planned
- 26 Sep 2026
- Method
- Retest in the Q3 review.
- Result
- Legacy plan retired on 2026-07-15; payout requests sampled in September all carried 2FA.