Evidence · SOC2-REQ-040

PayGate: Provider API keys rotated after incident

RejectedAutomated test resultCollected 5 Oct 2026

Requirement to validation

Requirement
ISO-A.5.19 · ISO-A.5.24 · RBI-CSF-NBFC-Annex-1-2 · RBI-OITS-2023-9 · SOC2-CC7.3 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-03
Supplier security incidents are assessed for impact and tracked
Application
PayGate Payment Gateway · Meridian Customer Portal
mapped
Evidence · Q3
4 items
2 approved · 1 pending · 1 rejected
Test · Q3
Fail
TST-RBI-VEN-03 · High confidence
Finding
F-RBI-03 · High
In Progress
Action
Deepa Menon
REM-F-RBI-03 · In Progress
Validation
Pending
as recorded

Record

Control
VEN-03 · Supplier security incidents are assessed for impact and tracked
Source system
Cycle
Q3 2026 Unified Program Review
Review note
Provide PayGate's incident report PG-SEC-2026-014 and evidence that the settlement-report API key was rotated after 2026-10-03.
Provenance
PBC request REQ-040 · 2026 SOC 2 Type II Audit