Cyber Security

Cyber security has moved from an IT-team concern to a boardroom risk — accelerated by the Digital Personal Data Protection Act, 2023 (DPDP Act), the CERT-In directions on incident reporting, the RBI cyber-security framework, and customer contracts increasingly requiring ISO 27001, SOC 2 and third-party VAPT attestation. A serious cyber posture is now a condition of doing enterprise business.

The Exim Roof runs an information-security advisory practice that combines regulatory expertise, ISO 27001 lead auditors, penetration testers, cloud-security architects and privacy counsel. We build defensible security programs, close specific gaps against ISO 27001 / SOC 2 / DPDP Act / PCI-DSS, and support you through internal / third-party audits and CERT-In incident response.

Regulatory landscape we help you navigate

• Digital Personal Data Protection Act, 2023 (DPDP Act) — consent, notice, DPO, breach reporting, cross-border transfer, children data.
• CERT-In directions dated 28 April 2022 — 6-hour incident reporting, 180-day log retention, KYC and traceability requirements.
• RBI cyber-security framework for banks, NBFCs, PSOs and PPI issuers.
• SEBI Cyber Security & Resilience Framework (CSCRF) for regulated intermediaries.
• Sector-specific mandates from IRDAI, TRAI, MeitY and DGGI.

Certifications and attestations we deliver

Enterprise contracts and marketplace listings increasingly require independent attestation of your security controls. Our team drives every stage — scoping, gap analysis, remediation, internal audit, stage-1 and stage-2 audit support with an accredited certification body.

• ISO / IEC 27001:2022 Information Security Management System.
• ISO / IEC 27701 Privacy Information Management System.
• ISO / IEC 27017 and 27018 for cloud security and cloud PII.
• SOC 2 Type I and Type II readiness against Trust Service Criteria.
• PCI-DSS v4.0 for payment environments.
• ISO 22301 Business Continuity Management.

Vulnerability assessment and penetration testing (VAPT)

Our red-team practice runs black-box, grey-box and white-box VAPT against web applications, mobile applications, APIs, cloud environments and internal networks. Every engagement produces a CVSS-scored report, a proof-of-concept for every finding, and a retest to close the loop after remediation. We also deliver source-code review, cloud posture assessment (AWS / Azure / GCP CIS benchmark) and container / Kubernetes security review.

DPDP Act 2023 compliance — a full programme

The DPDP Act 2023 imposes obligations on every Data Fiduciary — consent management, notices, purpose limitation, data-principal rights, breach reporting, appointment of a Data Protection Officer for Significant Data Fiduciaries, and lawful cross-border transfer. Non-compliance attracts penalties of up to ₹250 crore per breach category. We build the privacy programme end-to-end — data-flow mapping, ROPA, consent-artefact design, DPIA, DPO-as-a-service, breach-response playbooks and vendor-risk clauses.

How The Exim Roof helps

• Gap assessment against the target framework (ISO 27001 / SOC 2 / DPDP / PCI-DSS).
• ISMS and privacy documentation — policies, procedures, records, ROPA, DPIA templates.
• Technical hardening — cloud posture, endpoint hardening, SIEM tuning, email security.
• VAPT, source-code review and cloud-security assessment with actionable remediation.
• Internal audit, management review and third-party stage-1 / stage-2 audit support.
• CERT-In incident-response playbook and 6-hour breach-reporting readiness.
• DPO-as-a-service and virtual CISO for growing organisations.