Test · TST-Q2-VEN-02
VEN-02 · Provider contracts include data protection and RBI audit clauses
PassQ2 2026 Unified Program ReviewTested 12 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.20 · RBI-OITS-2023-6 · SOC2-CC9.2
mapped
Policy
Vendor & IT Outsourcing Risk Policy
pol-vendor
Control
VEN-02
Provider contracts include data protection and RBI audit clauses
Application
Salesforce (Sales + Financial Services Cloud)
mapped
Evidence · Q3
1 items
0 approved · 1 pending · 0 rejected
Test · Q3
Not tested
Finding
F-ISO-02 · Medium
Open
Action
Sanjay Kulkarni
REM-F-ISO-02 · In Progress
Validation
Pending
as recorded
Procedure and result
- Procedure
- Contract clause checklist in Prismet; Legal attests. Tests: Salesforce (Sales + Financial Services Cloud): Contract clause checklist per vendor. Frequency on-demand.
- Sample
- 25 items sampled (Q2 baseline)
- Expected
- Contracts with providers processing customer data include a data processing addendum, RBI inspection/audit rights, data localisation and 6-hour breach notification.
- Observed
- No exceptions in the sample; contractual safeguards operated as designed.
- Confidence
- High
- Evidence
- Q2-EV-034