Contracts with providers processing customer data include a data processing addendum, RBI inspection/audit rights, data localisation and 6-hour breach notification.

Requirements: ISO-A.5.20 A.5.20 · Addressing information security within supplier agreements
RBI-OITS-2023-6 RBI-OITS-2023 §6 · Outsourcing of IT services — due diligence, contractual clauses (data, audit rights) (RBI Master Direction on Outsourcing of Information Technology Services, 2023)
SOC2-CC9.2 CC9.2 · Assesses and manages risks associated with vendors and business partners
Policy: pol-vendor · Vendor & IT Outsourcing Risk Policy
Applications: Salesforce (Sales + Financial Services Cloud)
Third parties: VeriKYC Solutions Pvt. Ltd.
Testing procedure: Contract clause checklist in Prismet; Legal attests. Tests: Salesforce (Sales + Financial Services Cloud): Contract clause checklist per vendor. Frequency on-demand.

Findings (1)

Open list →

Finding	Observation	Control	Applications	Severity	Status	Owner	Action	Validation
F-ISO-02	Supplier agreement lacks information security clauses (A.5.20)	VEN-02	Salesforce (Sales + Financial Services Cloud)	Medium	Open	Sanjay Kulkarni	REM-F-ISO-02 · In Progress	Pending

Evidence (2)

Open list →

Evidence	Title	Control	Source system	Collected	Status
Q2-EV-034	Salesforce (Sales + Financial Services Cloud) · ticket sample (Q2)	VEN-02	Salesforce (Sales + Financial Services Cloud)	5 Jun 2026	Accepted
SOC2-REQ-039	Salesforce: Contract clause checklist per vendor	VEN-02		6 Oct 2026	Under review

Tests (1)

Open list →

Test	Control	Cycle	Tested	By	Result	Confidence
TST-Q2-VEN-02	VEN-02 · Provider contracts include data protection and RBI audit clauses	Q2 2026 Unified Program Review	12 Jun 2026	Farah Khan, Vikram Mehta · Meridian Internal Audit	Pass	High