Raised 2026-10-02 in the ISO/IEC 27001:2022 Surveillance Audit — 2026 (Northgate Certification Services). Classified as a minor nonconformity. VeriKYC processes Aadhaar offline XML and PAN data but no DPA with RBI audit-right and 6-hour breach notification clauses has been executed.

Applications: Salesforce (Sales + Financial Services Cloud).

Potential risk

The control may not operate consistently, weakening reliance by auditors and the regulator.

Root cause

Supplier onboarding checklist did not require a DPA before go-live for KYC processors.

Agreed action plan

DPA with VeriKYC in legal negotiation; target execution 2026-10-31. Tracked as T-012 in Prismet Tasks.

Management response: DPA with VeriKYC in legal negotiation; target execution 2026-10-31.

Action: REM-F-ISO-02
Owner (FPR): Sanjay Kulkarni
Target date: 31 Oct 2026
Priority: Medium
Status: In Progress
Validation: Pending · planned 31 Oct 2026

Evidence for this control (2)

Open list →

Evidence	Title	Control	Source system	Collected	Status
Q2-EV-034	Salesforce (Sales + Financial Services Cloud) · ticket sample (Q2)	VEN-02	Salesforce (Sales + Financial Services Cloud)	5 Jun 2026	Accepted
SOC2-REQ-039	Salesforce: Contract clause checklist per vendor	VEN-02		6 Oct 2026	Under review

Tests of this control (1)

Open list →

Test	Control	Cycle	Tested	By	Result	Confidence
TST-Q2-VEN-02	VEN-02 · Provider contracts include data protection and RBI audit clauses	Q2 2026 Unified Program Review	12 Jun 2026	Farah Khan, Vikram Mehta · Meridian Internal Audit	Pass	High