Supplier security incidents are assessed for impact and tracked

On notice of a security incident at a critical provider, an impact assessment covering services, applications, controls and customers is completed within 24 hours, credentials are rotated where relevant, and regulatory notification is made when required.

Requirements

ISO-A.5.19 A.5.19 · Information security in supplier relationships

ISO-A.5.24 A.5.24 · Information security incident management planning and preparation

RBI-CSF-NBFC-Annex-1-2 RBI-CSF-NBFC Annex 1 §2 · Cyber security — SOC monitoring, vulnerability management, incident reporting (RBI Cyber Security Framework for NBFCs (IT Framework for the NBFC Sector))

RBI-OITS-2023-9 RBI-OITS-2023 §9 · Outsourcing — ongoing monitoring of service providers and incident notification (RBI Master Direction on Outsourcing of Information Technology Services, 2023)

SOC2-CC7.3 CC7.3 · Evaluates security events to determine whether they are incidents

SOC2-CC9.2 CC9.2 · Assesses and manages risks associated with vendors and business partners

Policy

pol-vendor · Vendor & IT Outsourcing Risk Policy

Applications

PayGate Payment GatewayMeridian Customer Portal

Third parties

PayGate Payments Pvt. Ltd.

Testing procedure

Prismet external intelligence -> relationship graph -> tasks; continuous monitoring verifies key rotation. Tests: PayGate Payment Gateway: Provider API keys rotated after incident; Meridian Customer Portal: Payment webhook signatures valid. Frequency on-demand.