Meridian Alpha

Records

FindingsActionsValidationsEvidenceTestsControlsMonitoring
138 evidence
As of 9 Oct 2026
Filtered byOwner: Arjun Kapoor ✕Severity: Medium ✕
EvidenceTitleControlSource systemCollectedStatus
ISO-REQ-020AWS: Portal DB restore test reportBCP-018 Oct 2026Accepted
ISO-REQ-021Microsoft Azure: SAP HANA restore test reportBCP-017 Oct 2026Accepted
ITGC-REQ-001Microsoft Entra ID: Access package assignments have approvalACC-02Microsoft Entra ID9 Oct 2026Accepted
ITGC-REQ-002SAP S/4HANA: SAP role assignments trace to approved requestACC-02SAP S/4HANA8 Oct 2026Accepted
ITGC-REQ-003ServiceNow: Access request tickets approvedACC-027 Oct 2026Accepted
ITGC-REQ-004Microsoft Entra ID: No permanent Global Administrator assignmentsACC-03Microsoft Entra ID8 Oct 2026Accepted
ITGC-REQ-005AWS: No standing AdministratorAccess permission setsACC-037 Oct 2026Accepted
ITGC-REQ-006SAP S/4HANA: Firefighter sessions reviewedACC-03SAP S/4HANA6 Oct 2026Accepted
ITGC-REQ-007SAP S/4HANA: Q3 SAP access review signed offACC-04SAP S/4HANA7 Oct 2026Under review
ITGC-REQ-008Salesforce: Q3 Salesforce access review signed offACC-046 Oct 2026Under review
ITGC-REQ-009Microsoft Entra ID: Entra access review campaign statusACC-04Microsoft Entra ID5 Oct 2026Under review
ITGC-REQ-010Darwinbox HRMS: Terminations feed reconciled to IdPJML-01Darwinbox HRMS6 Oct 2026Accepted
ITGC-REQ-011Microsoft Entra ID: No sign-ins after terminationJML-01Microsoft Entra ID5 Oct 2026Accepted
ITGC-REQ-012SAP S/4HANA: Terminated users locked in SAPJML-01SAP S/4HANA4 Oct 2026Accepted
ITGC-REQ-013Darwinbox HRMS: Role changes detected from HR feedJML-02Darwinbox HRMS5 Oct 2026Accepted
ITGC-REQ-014SAP S/4HANA: Previous-role SAP roles removed after moveJML-02SAP S/4HANA4 Oct 2026Accepted
ITGC-REQ-015Microsoft Entra ID: Previous-role groups removed after moveJML-02Microsoft Entra ID9 Oct 2026Accepted
ITGC-REQ-016SAP S/4HANA: SoD ruleset — no unmitigated conflictsSOD-01SAP S/4HANA4 Oct 2026Accepted
ITGC-REQ-017SAP S/4HANA: No self-approved purchase ordersP2P-01SAP S/4HANA9 Oct 2026Accepted
ITGC-REQ-018SAP S/4HANA: Release strategy matches thresholdP2P-01SAP S/4HANA8 Oct 2026Accepted
ITGC-REQ-019SAP S/4HANA: Sensitive vendor fields confirmed by second userP2P-02SAP S/4HANA8 Oct 2026Accepted
ITGC-REQ-020GitHub: Branch protection on default branchesCHG-017 Oct 2026Accepted
ITGC-REQ-021GitHub: Merged PRs approved by non-authorCHG-016 Oct 2026Accepted
ITGC-REQ-022Meridian Customer Portal: Deployed build traces to approved PRCHG-01Meridian Customer Portal5 Oct 2026Accepted
ITGC-REQ-024ServiceNow: Emergency CRs closed with PIRCHG-025 Oct 2026Rejected
ITGC-REQ-025GitHub: Production environment requires reviewersCHG-035 Oct 2026Accepted
ITGC-REQ-026AWS: No developer roles with prod writeCHG-034 Oct 2026Accepted
ITGC-REQ-027AWS: AWS Backup jobs succeeded in last 24hOPS-014 Oct 2026Accepted
ITGC-REQ-028Microsoft Azure: Azure Recovery Services vault jobs succeededOPS-019 Oct 2026Accepted
ITGC-REQ-029AWS: Portal DB restore test reportBCP-019 Oct 2026Under review
ITGC-REQ-031SAP S/4HANA: Payment runs released by independent checkerPAY-02SAP S/4HANA8 Oct 2026Accepted
ITGC-REQ-033Meridian Customer Portal: Activated accounts linked to approved caseKYC-01Meridian Customer Portal6 Oct 2026Under review
Q2-EV-001Microsoft Entra ID · configuration report (Q2)ACC-01Microsoft Entra ID8 Jun 2026Accepted
Q2-EV-002Amazon Web Services (ap-south-1) · ticket sample (Q2)ACC-01Amazon Web Services (ap-south-1)13 Jun 2026Accepted
Q2-EV-003Microsoft Entra ID · ticket sample (Q2)ACC-02Microsoft Entra ID18 Jun 2026Accepted
Q2-EV-004SAP S/4HANA · access review (Q2)ACC-02SAP S/4HANA23 Jun 2026Rejected
Q2-EV-005Microsoft Entra ID · access review (Q2)ACC-03Microsoft Entra ID4 Jun 2026Rejected
Q2-EV-006Amazon Web Services (ap-south-1) · policy document (Q2)ACC-03Amazon Web Services (ap-south-1)9 Jun 2026Rejected
Q2-EV-007SAP S/4HANA · policy document (Q2)ACC-04SAP S/4HANA14 Jun 2026Rejected
Q2-EV-008Salesforce (Sales + Financial Services Cloud) · screenshot (Q2)ACC-04Salesforce (Sales + Financial Services Cloud)19 Jun 2026Rejected
Q2-EV-009Darwinbox HRMS · screenshot (Q2)JML-01Darwinbox HRMS24 Jun 2026Accepted
Q2-EV-010Microsoft Entra ID · system export (Q2)JML-01Microsoft Entra ID5 Jun 2026Accepted
Q2-EV-011Darwinbox HRMS · system export (Q2)JML-02Darwinbox HRMS10 Jun 2026Accepted
Q2-EV-012SAP S/4HANA · configuration report (Q2)JML-02SAP S/4HANA15 Jun 2026Accepted
Q2-EV-013SAP S/4HANA · configuration report (Q2)SOD-01SAP S/4HANA20 Jun 2026Rejected
Q2-EV-014SAP S/4HANA · ticket sample (Q2)P2P-01SAP S/4HANA25 Jun 2026Rejected
Q2-EV-015SAP S/4HANA · access review (Q2)P2P-02SAP S/4HANA6 Jun 2026Accepted
Q2-EV-016GitHub Enterprise Cloud · policy document (Q2)CHG-01GitHub Enterprise Cloud11 Jun 2026Accepted
Q2-EV-017Meridian Customer Portal · screenshot (Q2)CHG-01Meridian Customer Portal16 Jun 2026Rejected
Q2-EV-018GitHub Enterprise Cloud · screenshot (Q2)CHG-02GitHub Enterprise Cloud21 Jun 2026Rejected
Q2-EV-019ServiceNow ITSM · system export (Q2)CHG-02ServiceNow ITSM26 Jun 2026Rejected
Q2-EV-020GitHub Enterprise Cloud · system export (Q2)CHG-03GitHub Enterprise Cloud7 Jun 2026Rejected
Q2-EV-021Amazon Web Services (ap-south-1) · configuration report (Q2)CHG-03Amazon Web Services (ap-south-1)12 Jun 2026Rejected
Q2-EV-022Amazon Web Services (ap-south-1) · configuration report (Q2)VUL-01Amazon Web Services (ap-south-1)17 Jun 2026Rejected
Q2-EV-023GitHub Enterprise Cloud · ticket sample (Q2)VUL-01GitHub Enterprise Cloud22 Jun 2026Rejected
Q2-EV-024Amazon Web Services (ap-south-1) · ticket sample (Q2)LOG-01Amazon Web Services (ap-south-1)3 Jun 2026Rejected
Q2-EV-025Microsoft Entra ID · access review (Q2)LOG-01Microsoft Entra ID8 Jun 2026Rejected
Q2-EV-026Amazon Web Services (ap-south-1) · policy document (Q2)OPS-01Amazon Web Services (ap-south-1)13 Jun 2026Accepted
Q2-EV-027Microsoft Azure (corporate) · screenshot (Q2)OPS-01Microsoft Azure (corporate)18 Jun 2026Rejected
Q2-EV-028Amazon Web Services (ap-south-1) · screenshot (Q2)BCP-01Amazon Web Services (ap-south-1)23 Jun 2026Accepted
Q2-EV-029Microsoft Azure (corporate) · system export (Q2)BCP-01Microsoft Azure (corporate)4 Jun 2026Accepted
Q2-EV-030Amazon Web Services (ap-south-1) · system export (Q2)ENC-01Amazon Web Services (ap-south-1)9 Jun 2026Accepted
Q2-EV-031Meridian Customer Portal · configuration report (Q2)ENC-01Meridian Customer Portal14 Jun 2026Accepted
Q2-EV-032Salesforce (Sales + Financial Services Cloud) · configuration report (Q2)VEN-01Salesforce (Sales + Financial Services Cloud)19 Jun 2026Rejected
Q2-EV-033PayGate Payment Gateway · ticket sample (Q2)VEN-01PayGate Payment Gateway24 Jun 2026Rejected
Q2-EV-034Salesforce (Sales + Financial Services Cloud) · ticket sample (Q2)VEN-02Salesforce (Sales + Financial Services Cloud)5 Jun 2026Accepted
Q2-EV-035PayGate Payment Gateway · access review (Q2)VEN-03PayGate Payment Gateway10 Jun 2026Accepted
Q2-EV-036Meridian Customer Portal · policy document (Q2)VEN-03Meridian Customer Portal15 Jun 2026Accepted
Q2-EV-037Salesforce (Sales + Financial Services Cloud) · policy document (Q2)KYC-01Salesforce (Sales + Financial Services Cloud)20 Jun 2026Accepted
Q2-EV-038Meridian Customer Portal · screenshot (Q2)KYC-01Meridian Customer Portal25 Jun 2026Accepted
Q2-EV-039PayGate Payment Gateway · system export (Q2)PAY-01PayGate Payment Gateway6 Jun 2026Rejected
Q2-EV-040Meridian Customer Portal · configuration report (Q2)PAY-01Meridian Customer Portal11 Jun 2026Rejected
Q2-EV-041SAP S/4HANA · configuration report (Q2)PAY-02SAP S/4HANA16 Jun 2026Accepted
Q2-EV-042Meridian Customer Portal · ticket sample (Q2)GOV-01Meridian Customer Portal21 Jun 2026Accepted
RBI-REQ-001Meridian Customer Portal: ITSC minutes uploaded for quarterGOV-01Meridian Customer Portal9 Oct 2026Accepted
RBI-REQ-003Microsoft Entra ID: Conditional access requires MFA for all usersACC-01Microsoft Entra ID7 Oct 2026Accepted
RBI-REQ-004AWS: AWS IAM Identity Center federated to EntraACC-016 Oct 2026Accepted
RBI-REQ-005GitHub: GitHub org enforces SAML SSOACC-015 Oct 2026Accepted
RBI-REQ-006Microsoft Entra ID: No permanent Global Administrator assignmentsACC-03Microsoft Entra ID6 Oct 2026Under review
RBI-REQ-007AWS: No standing AdministratorAccess permission setsACC-035 Oct 2026Under review
RBI-REQ-009Darwinbox HRMS: Role changes detected from HR feedJML-02Darwinbox HRMS5 Oct 2026Accepted
RBI-REQ-010SAP S/4HANA: Previous-role SAP roles removed after moveJML-02SAP S/4HANA4 Oct 2026Accepted
RBI-REQ-011Microsoft Entra ID: Previous-role groups removed after moveJML-02Microsoft Entra ID9 Oct 2026Accepted
RBI-REQ-012SAP S/4HANA: SoD ruleset — no unmitigated conflictsSOD-01SAP S/4HANA4 Oct 2026Accepted
RBI-REQ-013GitHub: Branch protection on default branchesCHG-019 Oct 2026Accepted
RBI-REQ-014GitHub: Merged PRs approved by non-authorCHG-018 Oct 2026Accepted
RBI-REQ-015Meridian Customer Portal: Deployed build traces to approved PRCHG-01Meridian Customer Portal7 Oct 2026Accepted
RBI-REQ-016GitHub: Bypass merges have retrospective approvalCHG-028 Oct 2026Under review
RBI-REQ-017ServiceNow: Emergency CRs closed with PIRCHG-027 Oct 2026Rejected
RBI-REQ-018AWS: CloudTrail organisation trail enabledLOG-017 Oct 2026Under review
RBI-REQ-023AWS: AWS Backup jobs succeeded in last 24hOPS-015 Oct 2026Accepted
RBI-REQ-024Microsoft Azure: Azure Recovery Services vault jobs succeededOPS-014 Oct 2026Accepted
RBI-REQ-025AWS: Portal DB restore test reportBCP-014 Oct 2026Accepted
RBI-REQ-026Microsoft Azure: SAP HANA restore test reportBCP-019 Oct 2026Accepted
RBI-REQ-027Salesforce: Vendor assessment records currentVEN-019 Oct 2026Accepted
RBI-REQ-028PayGate: PayGate assurance artefacts currentVEN-018 Oct 2026Accepted
RBI-REQ-030PayGate: Provider API keys rotated after incidentVEN-037 Oct 2026Accepted
RBI-REQ-031Meridian Customer Portal: Payment webhook signatures validVEN-03Meridian Customer Portal6 Oct 2026Accepted
RBI-REQ-032Salesforce: Approved onboarding cases have complete KYC checklistKYC-016 Oct 2026Accepted
RBI-REQ-033Meridian Customer Portal: Activated accounts linked to approved caseKYC-01Meridian Customer Portal5 Oct 2026Accepted
RBI-REQ-035PayGate: mTLS enforced on payout APIPAY-014 Oct 2026Accepted
RBI-REQ-036Meridian Customer Portal: Payment initiation requires 2FAPAY-01Meridian Customer Portal9 Oct 2026Accepted
RBI-REQ-037SAP S/4HANA: Payment runs released by independent checkerPAY-02SAP S/4HANA9 Oct 2026Accepted
SOC2-REQ-001Microsoft Entra ID: Conditional access requires MFA for all usersACC-01Microsoft Entra ID9 Oct 2026Accepted
SOC2-REQ-002AWS: AWS IAM Identity Center federated to EntraACC-018 Oct 2026Accepted
SOC2-REQ-003GitHub: GitHub org enforces SAML SSOACC-017 Oct 2026Accepted
SOC2-REQ-004Microsoft Entra ID: Access package assignments have approvalACC-02Microsoft Entra ID8 Oct 2026Accepted
SOC2-REQ-005SAP S/4HANA: SAP role assignments trace to approved requestACC-02SAP S/4HANA7 Oct 2026Accepted
SOC2-REQ-006ServiceNow: Access request tickets approvedACC-026 Oct 2026Accepted
SOC2-REQ-008AWS: No standing AdministratorAccess permission setsACC-036 Oct 2026Under review
SOC2-REQ-009SAP S/4HANA: Firefighter sessions reviewedACC-03SAP S/4HANA5 Oct 2026Under review
SOC2-REQ-010SAP S/4HANA: Q3 SAP access review signed offACC-04SAP S/4HANA6 Oct 2026Under review
SOC2-REQ-011Salesforce: Q3 Salesforce access review signed offACC-045 Oct 2026Under review
SOC2-REQ-013Darwinbox HRMS: Terminations feed reconciled to IdPJML-01Darwinbox HRMS5 Oct 2026Accepted
SOC2-REQ-014Microsoft Entra ID: No sign-ins after terminationJML-01Microsoft Entra ID4 Oct 2026Accepted
SOC2-REQ-015SAP S/4HANA: Terminated users locked in SAPJML-01SAP S/4HANA9 Oct 2026Accepted
SOC2-REQ-016Darwinbox HRMS: Role changes detected from HR feedJML-02Darwinbox HRMS4 Oct 2026Accepted
SOC2-REQ-017SAP S/4HANA: Previous-role SAP roles removed after moveJML-02SAP S/4HANA9 Oct 2026Accepted
SOC2-REQ-018Microsoft Entra ID: Previous-role groups removed after moveJML-02Microsoft Entra ID8 Oct 2026Accepted
SOC2-REQ-019GitHub: Branch protection on default branchesCHG-019 Oct 2026Accepted
SOC2-REQ-020GitHub: Merged PRs approved by non-authorCHG-018 Oct 2026Accepted
SOC2-REQ-021Meridian Customer Portal: Deployed build traces to approved PRCHG-01Meridian Customer Portal7 Oct 2026Accepted
SOC2-REQ-022GitHub: Bypass merges have retrospective approvalCHG-028 Oct 2026Accepted
SOC2-REQ-023ServiceNow: Emergency CRs closed with PIRCHG-027 Oct 2026Accepted
SOC2-REQ-024GitHub: Production environment requires reviewersCHG-037 Oct 2026Under review
SOC2-REQ-028AWS: CloudTrail organisation trail enabledLOG-015 Oct 2026Accepted
SOC2-REQ-029Microsoft Entra ID: Entra diagnostic logs streamed to SIEMLOG-01Microsoft Entra ID4 Oct 2026Accepted
SOC2-REQ-030Meridian Customer Portal: Portal audit events received in last 24hLOG-01Meridian Customer Portal9 Oct 2026Accepted
SOC2-REQ-031AWS: AWS Backup jobs succeeded in last 24hOPS-014 Oct 2026Accepted
SOC2-REQ-032Microsoft Azure: Azure Recovery Services vault jobs succeededOPS-019 Oct 2026Accepted
SOC2-REQ-033AWS: Portal DB restore test reportBCP-019 Oct 2026Under review
SOC2-REQ-035AWS: RDS and S3 encryption enabledENC-018 Oct 2026Accepted
SOC2-REQ-036Meridian Customer Portal: TLS configuration on portal endpointsENC-01Meridian Customer Portal7 Oct 2026Accepted
SOC2-REQ-038PayGate: PayGate assurance artefacts currentVEN-016 Oct 2026Under review
SOC2-REQ-039Salesforce: Contract clause checklist per vendorVEN-026 Oct 2026Under review
SOC2-REQ-040PayGate: Provider API keys rotated after incidentVEN-035 Oct 2026Rejected
SOC2-REQ-041Meridian Customer Portal: Payment webhook signatures validVEN-03Meridian Customer Portal4 Oct 2026Under review
SOC2-REQ-045Meridian Customer Portal: ITSC minutes uploaded for quarterGOV-01Meridian Customer Portal8 Oct 2026Under review