| ACC-01 | MFA and SSO enforced for workforce access | Access Control | Amazon Web Services (ap-south-1), Microsoft Entra ID, GitHub Enterprise Cloud | Pass | 0 |
| ACC-03 | Privileged access is just-in-time and reviewed | Access Control | Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA | Fail | 1 |
| CHG-03 | Developers have no standing production access; deployments via pipeline only | Change Management | Amazon Web Services (ap-south-1), GitHub Enterprise Cloud | Pass | 0 |
| VUL-01 | Vulnerabilities are scanned and remediated within SLA | Security Operations | Amazon Web Services (ap-south-1), GitHub Enterprise Cloud | Not tested | 0 |
| LOG-01 | Security events are centrally logged and monitored 24x7 | Logging & Monitoring | Amazon Web Services (ap-south-1), Microsoft Entra ID, Meridian Customer Portal | Pass | 0 |
| LOG-02 | Audit logs retained 180 days online and 5 years archived, tamper-protected | Logging & Monitoring | Amazon Web Services (ap-south-1), SAP S/4HANA | Not tested | 0 |
| OPS-01 | Backups are performed daily and monitored | Operations & Resilience | Amazon Web Services (ap-south-1), Microsoft Azure (corporate) | Pass | 0 |
| BCP-01 | Backup restore and DR are tested | Operations & Resilience | Amazon Web Services (ap-south-1), Microsoft Azure (corporate) | Pass | 0 |
| ENC-01 | Customer and payment data encrypted at rest and in transit | Data Protection | Amazon Web Services (ap-south-1), Meridian Customer Portal | Pass | 0 |