The System Audit Report for Data Localization (SAR Audit) & Storage of Payment System Data is a compliance mandate driven by RBI & NPCI to ensure appropriate security measures and data localization controls for storage of payment related data.
At its core, it’s about storing and processing data within the geographical borders of a particular country, a requirement that’s gaining momentum across various regulatory and compliance mandates.
Key Criteria for System Audit Report for Data Localization (SAR Audit)
Based on the RBI Cyber Security Compliance & NPCI Cyber Security Guidelines, the following key criteria need to be covered as part of this audit.
- Payment Data Elements
- Transaction / Data Flow
- Application Architecture
- Network Diagram / Architecture
- Data Storage
- Transaction Processing
- Activities subsequent to Payment Processing
- Cross Border Transactions
- Database Storage and Maintenance
- Data Backup & Restoration
- Data Security
- Access Management
The audit should must be conducted by CERT-IN empanelled security auditors certifying completion of activity
Sample Checklists & Data Trackers
SAR Data Localization Payment Data Elements
SAR Data Localization Payment Data Elements
SAR Data Localization Checklist
SAR Data Localization Checklist
Client Speak
Approach for System Audit Report for Data Localization (SAR)
Based on our extensive experience with delivering SAR for Data Localization & Storage of Payment System Data, we have developed the following approach:
Phase 1 – Information Gathering & Documentation Review
A detailed questionnaire is shared with your teams and various documentation and evidences are collected on the architecture, implementation and controls in place. These documents are thoroughly reviewed by our experts to understand the implementation and flag any concerns. This questionnaire is designed keeping in mind the RBI FAQs.
Phase 2 – Assessment, Validation & In-Depth Control Review
As part of this phase, an in-depth analysis of is carried out to validate all the documentation and cross-examine artefacts provided. Along with this the technical controls are assessed in-line with best-practices and data flow is analysed to identify potential risks or gaps.
Phase 3 – Remediation & Re-Validation
A comprehensive report is provided with any areas of concern, risks or violations. Appropriate recommendations are provided along with detailed proof of concept details to help your teams understand the concerns raised.
Our team works with you to carry out re-validation to ensure that you are able to close all the gaps and achieve successful compliance.
Phase 4 – CERT-In Empanelled Certification
As a CERT-In Empanelled Security Auditor, we document the entire activity along with relevant documentation, artefacts, findings, recommendations etc. A CERT-In Certification is issued for the System Audit Report (SAR) for Data Localization & Storage of Payment System Data.
Data Localization for RBI & NPCI Cyber Security Compliance
The Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI) are key players in shaping data localization policies in India. Their guidelines ensure that financial data of Indian citizens is stored within the country, providing a framework that balances operational flexibility with security needs.
RBI’s Data Localization Mandate
RBI mandates financial firms to store all transactional data about Indian customers within the country. This includes everything from payment transactions to customer information.
NPCI’s Data Localization Mandate
NPCI focuses on payment systems and mandates localization of payment data. This ensures quicker access to data for regulatory purposes and aids in resolving customer grievances efficiently.
Deliverables of Compliance Audit & Certification
- Executive Presentation: provide high level executive summaries of the complete engagement, root cause analysis of the identified issues & best practice recommendations for the long-term to help leaders better understand their risk and incorporate our recommendations into their roadmap.
- Detailed Audit Reports: The audit report will typically be a detailed document that is divided into several sections, including:
- Introduction: This section will provide an overview of the audit, including the scope, objectives, and methodology.
- Findings: This section will identify the areas of compliance and non-compliance.
- Recommendations: This section will make recommendations for improvement.
- Appendices: This section may include supporting documentation, such as interview transcripts, policies and procedures, and risk assessments.
- Certificate of Compliance: The certificate of compliance is a formal document that is issued by the auditor to the organization. This document states that the organization has been found to be in compliance with the guidelines.
- List of Recommendations for Improvement: The list of recommendations for improvement will identify areas where the organization can strengthen its technology risk management framework. These recommendations can be used by the organization to improve its security posture and reduce its risk of a data breach or other security incident.
- Plan for Remediation: The plan for remediation will outline the steps that the organization will take to address any non-compliance findings. This plan should be specific and measurable, and it should include a timeline for completion.