Compliance is operational.
Compliance is a daily operating reality at Cylentrix — not a quarterly audit scramble. Every engagement is delivered against a documented control set, with evidence captured continuously and audit-ready by default.
Our compliance operating model
Cylentrix runs an integrated compliance function that sits inside the operations organisation — not adjacent to it. Controls are designed, deployed and evidenced as part of normal operating cadence, with the compliance team participating in change-advisory boards, incident reviews and quarterly business reviews.
Audits — internal and external — find what they expect to find: live controls, current evidence, remediated exceptions, accountable owners.
Indian regulatory alignment
- RBI Cyber Security Framework for BFSI clients — board-approved cyber strategy, segregated cyber operations, audited SOC, vendor risk continuous monitoring.
- SEBI CSCRF for capital-markets clients — regulatory filings, incident-reporting cadence, control testing.
- IRDAI ITC for insurance clients — information and technology cybersecurity expectations, audit cadence.
- CERT-In aligned operations — incident reporting timelines, log retention, sectoral coordination.
- DPDPA data protection — data-flow mapping, consent management, breach notification readiness.
Global regulatory alignment
- ISO/IEC 27001 — Information Security Management System with annual third-party audit.
- SOC 2 Type II — operational controls audited annually for security, availability, confidentiality.
- PCI DSS — for clients with cardholder-data environments.
- HIPAA — for clients in the US healthcare sector.
- GDPR — for clients with EU data subjects, with documented data-processing agreements.
- NIST CSF — used as a benchmark across all cyber-defence engagements.
Vendor risk and supply chain
Cylentrix maintains a continuously monitored vendor-risk register covering every third party in the operating supply chain — security ratings, financial health, sub-processor disclosures, regulatory exposures. Material changes are escalated to the executive committee and disclosed to clients where contractually required.
Reporting and disclosure
Material security incidents are disclosed to affected clients within timelines that meet or exceed contractual and regulatory expectations. We do not wait for quarterly reviews to surface material risk.