Evidence · RBI-REQ-030

PayGate: Provider API keys rotated after incident

AcceptedAutomated test resultCollected 7 Oct 2026

Requirement to validation

Requirement
ISO-A.5.19 · ISO-A.5.24 · RBI-CSF-NBFC-Annex-1-2 · RBI-OITS-2023-9 · SOC2-CC7.3 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-03
Supplier security incidents are assessed for impact and tracked
Application
PayGate Payment Gateway · Meridian Customer Portal
mapped
Evidence · Q3
4 items
2 approved · 1 pending · 1 rejected
Test · Q3
Fail
TST-RBI-VEN-03 · High confidence
Finding
F-RBI-03 · High
In Progress
Action
Deepa Menon
REM-F-RBI-03 · In Progress
Validation
Pending
as recorded

Record

Control
VEN-03 · Supplier security incidents are assessed for impact and tracked
Source system
Cycle
Q3 2026 Unified Program Review
Review note
Evidence complete; exception noted against the control requirement.
Provenance
PBC request REQ-030 · RBI Regulatory Controls — Q4 2026 Periodic Internal Audit