Meridian Alpha

Regulatory Library

India United States European Union Global standards Controls across regulations

Regulations that apply to Meridian Alpha and the controls that meet them
As of 9 Oct 2026

All areas Banking & Financial Payments Corporate & Finance Cyber & Technology Privacy Tax

India · Central · Cyber & Technology

SEBI · Cybersecurity and cyber resilience

SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 20 August 2024

Open in Studio

Legal entity

Meridian Alpha Pvt. Ltd.

Applicability

Not applicable to Meridian Alpha · scoped for Listed entity

Locations

Mumbai Head Office (Bandra Kurla Complex), Bengaluru Technology Centre

Reporting cycle

Half-yearly · compliance

Requirement coverage · compliance position: gaps to close

requirements

Covered 00%
Partially covered 5100%
Evidence unavailable 00%

Controls

4 failed testing

Evidence approved

39/54

current cycle

Open findings (gaps)

1 high

Open actions

0 overdue

Requirements and the controls that meet them

Ref	Requirement	Applicability	Control objective	Controls	Coverage
Identify	Asset and access governance	Not applicable	Access is approved, reviewed and removed on exit or role change	ACC-01 ACC-02 ACC-04 JML-01 JML-02	Partially covered
Protect	Privileged and network access	Not applicable	Privileged access is just-in-time and restricted	ACC-03 CHG-03	Partially covered
Detect	Continuous security monitoring	Not applicable	Security events are logged, retained and monitored	LOG-01 LOG-02	Partially covered
Respond	Incident response and reporting	Not applicable	Incidents, including supplier incidents, are assessed and reported	VEN-03 LOG-01	Partially covered
Protect	Third-party risk	Not applicable	Third parties are assessed, contracted and monitored	VEN-01 VEN-02 VEN-03	Partially covered

Controls and current position

Control	What it checks	Systems	Test	Evidence	Open findings
ACC-01	MFA and SSO enforced for workforce access	Amazon Web Services (ap-south-1), Microsoft Entra ID, GitHub Enterprise Cloud	Pass	6 / 6	0
ACC-02	User access provisioning is approved before grant	Microsoft Entra ID, SAP S/4HANA, ServiceNow ITSM	Pass	6 / 6	0
ACC-04	Quarterly user access review of in-scope applications	Microsoft Entra ID, Salesforce (Sales + Financial Services Cloud), SAP S/4HANA	Not tested	0 / 5	0
JML-01	Leavers are de-provisioned within 24 hours	Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA	Pass	6 / 6	0
JML-02	Mover access is recertified on role change	Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA	Fail	9 / 9	1
ACC-03	Privileged access is just-in-time and reviewed	Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA	Fail	3 / 7	1
CHG-03	Developers have no standing production access; deployments via pipeline only	Amazon Web Services (ap-south-1), GitHub Enterprise Cloud	Pass	2 / 3	0
LOG-01	Security events are centrally logged and monitored 24x7	Amazon Web Services (ap-south-1), Microsoft Entra ID, Meridian Customer Portal	Pass	3 / 4	0
LOG-02	Audit logs retained 180 days online and 5 years archived, tamper-protected	Amazon Web Services (ap-south-1), SAP S/4HANA	Not tested	0 / 0	0
VEN-03	Supplier security incidents are assessed for impact and tracked	PayGate Payment Gateway, Meridian Customer Portal	Fail	2 / 4	1
VEN-01	Critical third parties are risk-assessed before onboarding and annually	PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud)	Fail	2 / 3	1
VEN-02	Provider contracts include data protection and RBI audit clauses	Salesforce (Sales + Financial Services Cloud)	Not tested	0 / 1	1

Open actions

Action	Issue	Owner	Due	Status
REM-F-SOC2-02	Mover access not removed timely (deviation in CC6.2 testing)	Neha Iyer	31 Oct 2026	Open
REM-F-ITGC-02	Standing privileged access in production AWS	Rahul Nair	16 Oct 2026	In Progress
REM-F-RBI-03	Payment provider incident — incomplete credential rotation	Deepa Menon	10 Oct 2026	In Progress
REM-F-RBI-02	Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9)	Sanjay Kulkarni	20 Oct 2026	Open
REM-F-ISO-02	Supplier agreement lacks information security clauses (A.5.20)	Sanjay Kulkarni	31 Oct 2026	In Progress

Regulatory reporting for management, audit and compliance review. Applicability is as assessed in Prismet. Statutory returns and regulator filings are not prepared or submitted from Prismet.