Control · VEN-01

Critical third parties are risk-assessed before onboarding and annually

Third-Party RiskSOC 2 · ISO 27001 · RBIRisk High

Requirement to validation

Requirement
ISO-A.5.19 · ISO-A.5.22 · RBI-OITS-2023-6 · RBI-OITS-2023-9 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-01
Critical third parties are risk-assessed before onboarding and annually
Application
PayGate Payment Gateway · Salesforce (Sales + Financial Services Cloud)
mapped
Evidence · Q3
3 items
2 approved · 1 pending · 0 rejected
Test · Q3
Fail
TST-RBI-VEN-01 · Medium confidence
Finding
F-RBI-02 · Medium
Open
Action
Sanjay Kulkarni
REM-F-RBI-02 · Open
Validation
Pending
as recorded

What should be true

Tier 1 and Tier 2 providers are assessed before onboarding and at least annually, including review of SOC 2 / ISO reports and penetration test summaries; lapses are tracked to resolution.

Requirements
ISO-A.5.19 A.5.19 · Information security in supplier relationships
ISO-A.5.22 A.5.22 · Monitoring, review and change management of supplier services
RBI-OITS-2023-6 RBI-OITS-2023 §6 · Outsourcing of IT services — due diligence, contractual clauses (data, audit rights) (RBI Master Direction on Outsourcing of Information Technology Services, 2023)
RBI-OITS-2023-9 RBI-OITS-2023 §9 · Outsourcing — ongoing monitoring of service providers and incident notification (RBI Master Direction on Outsourcing of Information Technology Services, 2023)
SOC2-CC9.2 CC9.2 · Assesses and manages risks associated with vendors and business partners
Policy
pol-vendor · Vendor & IT Outsourcing Risk Policy
Applications
PayGate Payment GatewaySalesforce (Sales + Financial Services Cloud)
Third parties
Amazon Web Services (AWS India)Northstar BPO Services Ltd.PayGate Payments Pvt. Ltd.
Testing procedure
Prismet vendor register + questionnaire; evidence collected as forms. Tests: Salesforce (Sales + Financial Services Cloud): Vendor assessment records current; PayGate Payment Gateway: PayGate assurance artefacts current. Frequency annual.

Findings (2)

Open list →
FindingObservationControlApplicationsSeverityStatusOwnerActionValidation
F-RBI-02Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9)VEN-01PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud)MediumOpenSanjay KulkarniREM-F-RBI-02 · OpenPending
F-IAQ2-VEN-01Critical vendor reassessments not trackedVEN-01PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud)MediumClosedSanjay KulkarniREM-F-IAQ2-VEN-01 · ClosedFailed

Evidence (5)

Open list →
EvidenceTitleControlSource systemCollectedStatus
Q2-EV-032Salesforce (Sales + Financial Services Cloud) · configuration report (Q2)VEN-01Salesforce (Sales + Financial Services Cloud)19 Jun 2026Rejected
Q2-EV-033PayGate Payment Gateway · ticket sample (Q2)VEN-01PayGate Payment Gateway24 Jun 2026Rejected
RBI-REQ-027Salesforce: Vendor assessment records currentVEN-019 Oct 2026Accepted
RBI-REQ-028PayGate: PayGate assurance artefacts currentVEN-018 Oct 2026Accepted
SOC2-REQ-038PayGate: PayGate assurance artefacts currentVEN-016 Oct 2026Under review

Tests (2)

Open list →
TestControlCycleTestedByResultConfidence
TST-RBI-VEN-01VEN-01 · Critical third parties are risk-assessed before onboarding and annuallyQ3 2026 Unified Program Review2 Oct 2026Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell)FailMedium
TST-Q2-VEN-01VEN-01 · Critical third parties are risk-assessed before onboarding and annuallyQ2 2026 Unified Program Review18 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditFailMedium