Meridian Alpha
Regulatory Library
Regulations that apply to Meridian Alpha and the controls that meet them
As of 9 Oct 2026
As of 9 Oct 2026
Global standards · Industry standards · Cyber & Technology
ISO 27001 · Information security management
ISO/IEC 27001:2022 · Annex A controls mapped to Prismet controls
Readiness and internal audit view. Certification and the grading of nonconformities are by an accredited certification body.
Legal entity
Meridian Alpha
Applicability
Applicable · ISMS scope as defined by the organization
Locations
Mumbai Head Office (Bandra Kurla Complex), Bengaluru Technology Centre
Reporting cycle
Internal audit (clause 9.2) · certification audits by an accredited certification body
Requirement coverage · compliance position: gaps to close
7
requirements
- Covered 00%
- Partially covered 686%
- Evidence unavailable 114%
Controls
15
5 failed testing
Evidence approved
50/68
current cycle
Open findings (gaps)
5
1 high
Open actions
5
0 overdue
Requirements and the controls that meet them
| Ref | Requirement | Applicability | Control objective | Controls | Coverage |
|---|---|---|---|---|---|
| A.5.15–5.18 | Access control and access rights | Applicable | Access is approved, reviewed and removed on exit or role change | ACC-01ACC-02ACC-04JML-01JML-02 | Partially covered |
| A.8.2 | Privileged access rights | Applicable | Privileged access is just-in-time and restricted | ACC-03CHG-03 | Partially covered |
| A.8.8 | Management of technical vulnerabilities | Applicable | Vulnerabilities are remediated on time | VUL-01 | Evidence unavailable |
| A.8.15–8.16 | Logging and monitoring | Applicable | Security events are logged, retained and monitored | LOG-01LOG-02 | Partially covered |
| A.8.32 | Change management | Applicable | Changes are approved, tested and traceable | CHG-01CHG-02CHG-03 | Partially covered |
| A.5.19–5.22 | Supplier relationships | Applicable | Third parties are assessed, contracted and monitored | VEN-01VEN-02VEN-03 | Partially covered |
| A.5.24–5.26 | Incident management | Applicable | Incidents, including supplier incidents, are assessed and reported | VEN-03LOG-01 | Partially covered |
Controls and current position
| Control | What it checks | Systems | Test | Evidence | Open findings |
|---|---|---|---|---|---|
| ACC-01 | MFA and SSO enforced for workforce access | Amazon Web Services (ap-south-1), Microsoft Entra ID, GitHub Enterprise Cloud | Pass | 6 / 6 | 0 |
| ACC-02 | User access provisioning is approved before grant | Microsoft Entra ID, SAP S/4HANA, ServiceNow ITSM | Pass | 6 / 6 | 0 |
| ACC-04 | Quarterly user access review of in-scope applications | Microsoft Entra ID, Salesforce (Sales + Financial Services Cloud), SAP S/4HANA | Not tested | 0 / 5 | 0 |
| JML-01 | Leavers are de-provisioned within 24 hours | Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA | Pass | 6 / 6 | 0 |
| JML-02 | Mover access is recertified on role change | Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA | Fail | 9 / 9 | 1 |
| ACC-03 | Privileged access is just-in-time and reviewed | Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA | Fail | 3 / 7 | 1 |
| CHG-03 | Developers have no standing production access; deployments via pipeline only | Amazon Web Services (ap-south-1), GitHub Enterprise Cloud | Pass | 2 / 3 | 0 |
| VUL-01 | Vulnerabilities are scanned and remediated within SLA | Amazon Web Services (ap-south-1), GitHub Enterprise Cloud | Not tested | 0 / 0 | 0 |
| LOG-01 | Security events are centrally logged and monitored 24x7 | Amazon Web Services (ap-south-1), Microsoft Entra ID, Meridian Customer Portal | Pass | 3 / 4 | 0 |
| LOG-02 | Audit logs retained 180 days online and 5 years archived, tamper-protected | Amazon Web Services (ap-south-1), SAP S/4HANA | Not tested | 0 / 0 | 0 |
| CHG-01 | Production code changes are peer-reviewed and approved | GitHub Enterprise Cloud, Meridian Customer Portal | Pass | 9 / 9 | 0 |
| CHG-02 | Emergency changes are retrospectively approved | GitHub Enterprise Cloud, ServiceNow ITSM | Fail | 2 / 5 | 0 |
| VEN-01 | Critical third parties are risk-assessed before onboarding and annually | PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud) | Fail | 2 / 3 | 1 |
| VEN-02 | Provider contracts include data protection and RBI audit clauses | Salesforce (Sales + Financial Services Cloud) | Not tested | 0 / 1 | 1 |
| VEN-03 | Supplier security incidents are assessed for impact and tracked | PayGate Payment Gateway, Meridian Customer Portal | Fail | 2 / 4 | 1 |
Open actions
| Action | Issue | Owner | Due | Status |
|---|---|---|---|---|
| REM-F-SOC2-02 | Mover access not removed timely (deviation in CC6.2 testing) | Neha Iyer | 31 Oct 2026 | Open |
| REM-F-ITGC-02 | Standing privileged access in production AWS | Rahul Nair | 16 Oct 2026 | In Progress |
| REM-F-RBI-02 | Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9) | Sanjay Kulkarni | 20 Oct 2026 | Open |
| REM-F-ISO-02 | Supplier agreement lacks information security clauses (A.5.20) | Sanjay Kulkarni | 31 Oct 2026 | In Progress |
| REM-F-RBI-03 | Payment provider incident — incomplete credential rotation | Deepa Menon | 10 Oct 2026 | In Progress |
Regulatory reporting for management, audit and compliance review. Applicability is as assessed in Prismet. Statutory returns and regulator filings are not prepared or submitted from Prismet.