Production workloads and the Customer Portal are scanned continuously; critical vulnerabilities are remediated within 15 days and high within 30 days.

Requirements: ISO-A.8.8 A.8.8 · Management of technical vulnerabilities
RBI-CSF-NBFC-Annex-1-2 RBI-CSF-NBFC Annex 1 §2 · Cyber security — SOC monitoring, vulnerability management, incident reporting (RBI Cyber Security Framework for NBFCs (IT Framework for the NBFC Sector))
RBI-ITGRCA-2023-7.4 RBI-ITGRCA-2023 §7.4 · Change and patch management — documented, approved and tested changes (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)
SOC2-CC7.1 CC7.1 · Detection and monitoring of configuration changes and vulnerabilities
Policy: pol-logging · Logging & Security Monitoring Standard
Applications: Amazon Web Services (ap-south-1)GitHub Enterprise Cloud
Third parties: —
Testing procedure: AWS Inspector, Dependabot, quarterly external VAPT. Tests: Amazon Web Services (ap-south-1): Inspector critical findings within SLA; GitHub Enterprise Cloud: Dependabot critical alerts within SLA. Frequency continuous.

Findings (1)

Open list →

Finding	Observation	Control	Applications	Severity	Status	Owner	Action	Validation
F-IAQ2-VUL-01	Critical vulnerabilities past remediation SLA	VUL-01	Amazon Web Services (ap-south-1), GitHub Enterprise Cloud	High	Closed	Ananya Rao	REM-F-IAQ2-VUL-01 · Closed	Pending

Evidence (2)

Open list →

Evidence	Title	Control	Source system	Collected	Status
Q2-EV-022	Amazon Web Services (ap-south-1) · configuration report (Q2)	VUL-01	Amazon Web Services (ap-south-1)	17 Jun 2026	Rejected
Q2-EV-023	GitHub Enterprise Cloud · ticket sample (Q2)	VUL-01	GitHub Enterprise Cloud	22 Jun 2026	Rejected

Tests (1)

Open list →

Test	Control	Cycle	Tested	By	Result	Confidence
TST-Q2-VUL-01	VUL-01 · Vulnerabilities are scanned and remediated within SLA	Q2 2026 Unified Program Review	18 Jun 2026	Farah Khan, Vikram Mehta · Meridian Internal Audit	Fail	High