Vulnerability Management Compliance & Audit Services
From Scan Evidence to Audit-Ready in Every Cycle
Running vulnerability scans is not the same as being compliant. CERT-In, RBI, SEBI, and PCI-DSS don’t ask whether you scan — they ask for the evidence trail that proves what you found, how you scored it, and whether it was actually closed. When that trail doesn’t exist, audits fail. Softenger steps in. We build the governance layer that turns your vulnerability programme into structured, auditor-ready compliance evidence — every cycle, automatically.
5+
Regulations
Covered
Covered
99.5%
SLA Compliance
Rate Achieved
Rate Achieved
ISO
27001:2022
Certified Team
Certified Team
Book Your Free
Compliance Mapping Session
We’ll map your active CERT-In, RBI, SEBI, or PCI-DSS obligations against what your current programme generates — and identify every evidence gap before your auditor does.
🔒 ISO 27001:2022 certified data handling · No sales pressure
Trusted by
Oracle
SAP
VISA
Kotak Bank
Reliance Jio
NTT DATA
ISO 27001:2022
ISO 9001:2015
25 YRS
For Your
Compliance & Audit Team
Your team maps every regulation on this page against what your programme currently generates. You know which gaps will surface in the next CERT-In inspection, RBI examination, or PCI-DSS assessment — and you need a vendor who understands those gaps before you have to explain them.
This page was written for your team.
For Your
Security Leadership
Your leadership needs to know three things before approving a vendor: are they certified, have they delivered for regulated enterprises like yours, and will they own the outcome — or hand you another tool to manage.
The proof is below.
ISO 27001:2022 · 99.5% SLA · VISA · Kotak Bank · 25 years
What Regulators Actually Require
CERT-In, RBI, SEBI and PCI-DSS don’t audit your intentions.
They audit your evidence.
Most enterprises believe they are compliant because they run scans. Regulators don’t audit scanning activity — they audit the structured evidence trail that proves what was found, how it was prioritised, and whether the risk was closed or formally accepted.
CERT-IN 2022
CERT-In Directions for IT Intermediaries
🇮🇳 India — All IT intermediaries, data centres & government entities
CERT-In’s 2022 Directions mandate vulnerability assessment as a continuous obligation — not a periodic exercise. Organisations must maintain documented evidence of scanning activity, findings classified by severity, and remediation timelines. The absence of a documented vulnerability management programme is itself a compliance gap.
What auditors ask for
Scan reports with dates, scope, and methodology
Findings classified by severity — Critical, High, Medium, Low
Remediation status per finding with closure timestamps
Follow-up scans confirming vulnerability closure
Documented risk acceptance records for unresolved findings
RBI IT FRAMEWORK
RBI Cybersecurity Policy for Banks & NBFCs
🇮🇳 India — Scheduled commercial banks, NBFCs, payment system operators
The RBI IT Framework mandates quarterly VAPT for scheduled commercial banks and qualifying NBFCs. Findings must be escalated to the Board-level IT Strategy Committee. The RBI examiner does not accept a dashboard screenshot — they require structured documentation throughout the examination cycle.
What RBI examiners ask for
Quarterly scan reports with scope, methodology, and findings summary
Severity-classified findings with business risk context
Remediation SLA adherence records — Critical, High, Medium, Low tiers
Board IT Strategy Committee meeting minutes referencing cybersecurity posture
History of closed findings vs. formally accepted risks with CISO sign-off
SEBI CIRCULAR
SEBI Cybersecurity & Cyber Resilience Framework
🇮🇳 India — Market Infrastructure Institutions (stock exchanges, depositories)
SEBI’s framework requires Market Infrastructure Institutions to maintain a documented security testing programme with vulnerability assessment as a continuous activity. Cyber incidents must be reported within prescribed timelines with documented evidence of the underlying vulnerability programme.
What SEBI compliance requires
Documented VA programme with defined assessment frequency
Incident correlation with known vulnerability findings
Board-level cyber risk reporting with posture trend evidence
Continuous monitoring evidence — not point-in-time assessments
DPDP ACT 2023
India Digital Personal Data Protection Act
🇮🇳 India — All entities processing personal data of Indian citizens
India’s DPDP Act 2023 creates direct obligations around the security of personal data. Organisations must implement reasonable security safeguards — and vulnerability management is a core component. A breach involving unpatched vulnerabilities exposes data fiduciaries to significant regulatory penalties.
What DPDP compliance requires
Documented VM programme covering systems processing personal data
Evidence that vulnerabilities affecting personal data systems are remediated within defined timelines
Breach response documentation demonstrating pre-existing vulnerability governance
PCI-DSS v4.0
Payment Card Industry Data Security Standard — Requirement 11.3
🌐 Global — All entities storing, processing, or transmitting cardholder data
Requirement 11.3, fully enforced from March 2025, mandates continuous vulnerability management — not periodic scanning. The shift from v3.2.1 to v4.0 removes the annual scan exception. Internal and external scans must be conducted by qualified personnel, ASV quarterly scans completed, and findings resolved within defined timelines.
What PCI assessors ask for
ASV quarterly scan reports for external-facing cardholder data environments
Internal scan evidence triggered on every significant infrastructure change
Remediation closure confirmation via follow-up scans
Risk acceptance documentation with CISO sign-off for unresolved findings
Evidence that scanning is continuous — not periodic
For organisations with international compliance obligations
ISO 27001:2022Annex A.12.6 technical VM control evidence — Softenger is certified to this standard
MAS TRM 2021Singapore financial institution formal VM programme and risk-based patching requirements
UAE IA FrameworkMandatory VAPT for licensed entities — Softenger’s UAE office provides local compliance depth
NIS2 DirectiveEU vulnerability handling obligations for essential and important entities — full enforcement October 2024
“Knowing what regulators require is step one. Generating the evidence they ask for — automatically, every cycle, without manual aggregation — is where most programmes fall short. That is exactly what Softenger’s compliance programme is built to deliver.”
What We Generate For You
Every regulation mapped. Every evidence package specified.
Generated automatically — every cycle.
Every output is structured to the specific evidence format your active regulators require — generated at the close of every assessment cycle, without manual aggregation by your team.
| Regulation | Softenger Programme Output | Evidence Format | Audit Ready |
|---|---|---|---|
| CERT-In 2022 | Scan reports with scope, findings by severity, remediation status, closure confirmation scans | Structured PDF + raw data export · Timestamped per cycle | ✓ CERT-In Directions compliant |
| RBI IT Framework | Quarterly VAPT reports, SLA adherence records, risk acceptance register, Board IT Committee reporting pack | Formatted examination package · CISO sign-off trail | ✓ RBI examination ready |
| SEBI Framework | VA programme documentation, incident correlation records, board-level cyber risk posture summary | Executive dashboard export · Regulatory submission format | ✓ SEBI circular compliant |
| DPDP Act 2023 | Vulnerability governance records for personal data systems, remediation timelines, breach response documentation | Documented programme evidence · Data fiduciary pack | ✓ DPDP obligation evidenced |
| PCI-DSS v4.0 | ASV quarterly scan reports, internal scan evidence on change, closure confirmations, risk acceptance documentation | ASV-formatted reports · QSA submission ready | ✓ Req 11.3 continuous VM compliant |
| ISO 27001:2022 | Annex A.12.6 control evidence, VM policy documentation, risk treatment records | ISMS audit evidence package · Certification body ready | ✓ Annex A.12.6 satisfied |
| MAS TRM 2021 | Formal VM programme documentation, risk-based patching timelines, MAS inspection evidence | MAS-formatted examination package | ✓ MAS TRM compliant |
Generated automatically. Not assembled manually.
Every evidence package above is produced by Softenger’s programme as standard output of each assessment cycle. Your compliance team does not spend the week before an audit pulling data from scanner dashboards, chasing remediation owners for closure confirmation, or reformatting reports for examiner submission. The package exists. It is current. It is auditor-ready.
Not sure which regulations apply?
Book a free compliance mapping session — 30 minutes, your obligations mapped before your next audit does it.
How We Deliver It
Five compliance capabilities that turn your vulnerability programme into an audit-ready evidence machine
Softenger’s compliance and audit delivery covers every layer of the evidence trail — from gap analysis and policy implementation through automated evidence generation and risk acceptance governance.
01
Compliance Gap Analysis
Before building anything, we map your current vulnerability programme against every active regulatory obligation — CERT-In, RBI, SEBI, DPDP, PCI-DSS, ISO 27001. Control by control. Evidence requirement by evidence requirement. The gap analysis tells you precisely what exists, what is missing, and what your next audit will surface before it surfaces it.
What you receive
A structured gap report mapped to each active regulation — with a prioritised remediation roadmap and the specific evidence packages each framework requires.
02
Regulatory Audit Support
When the CERT-In inspection notice arrives or the RBI examination cycle begins, Softenger’s team generates and packages the complete evidence trail your examiners require. Scan reports, remediation records, SLA adherence documentation, risk acceptance registers — formatted to the specific submission requirements of each regulator, not reformatted at the last minute from raw scanner data.
What you receive
Regulator-specific evidence packages — CERT-In formatted, RBI examination ready, PCI-DSS ASV reports, ISO 27001 ISMS audit evidence — generated as standard programme output, not assembled on demand.
03
Policy Implementation
A vulnerability management programme without documented policy is not a programme — it is a set of activities. Softenger implements the formal policy framework your regulators expect: vulnerability management policy aligned to ISO 27001 Annex A.12.6, patch governance policy with defined SLA tiers, and risk acceptance policy with formal CISO approval workflows.
What you receive
Documented, board-approved policy framework — vulnerability management, patch governance, and risk acceptance — aligned to your active regulatory obligations and ready for audit submission.
04
Automated Compliance Tracking
Compliance tracking should not require a spreadsheet maintained by your team. Softenger’s Splunk dashboards provide real-time visibility into your compliance posture — open findings by regulation, remediation SLA adherence by severity tier, risk acceptance register with CISO sign-off trail, and programme trend reporting for board-level submission. Every metric your auditor will ask for is live, current, and exportable.
What you receive
Real-time compliance dashboards — posture by regulation, SLA adherence rates, open vs. closed findings, risk acceptance register — with automated report generation at the close of every assessment cycle.
05
Risk Acceptance Documentation
Not every vulnerability can be remediated immediately. When operational dependencies, business constraints, or resource limitations prevent timely closure, risk acceptance must be formally governed — with CISO sign-off, documented business justification, time-bound acceptance windows, and a structured register that satisfies CERT-In, RBI, and PCI-DSS examiner requirements. Informal deferral is not an option in our programme — because in an RBI examination, informal deferral is non-compliance.
What you receive
A formal risk acceptance register — CISO-approved, time-bound, with documented business justification — formatted for submission to CERT-In, RBI, and PCI-DSS assessors. Every accepted risk has an owner, an expiry, and an evidence trail.
For Security Leadership
The credentials that matter to the CISO
approving this engagement
ISO 27001:2022 Certified
Not the 2013 version. The current standard — audited annually by an accredited third party. The team managing your vulnerability data operates under a certified ISMS.
Current standard · Annual audit
99.5% SLA Compliance
Achieved in a live enterprise engagement managing 100,000+ monthly findings across 10,000+ hybrid endpoints. Not a claimed capability — a verified delivery outcome.
Verified · 10,000+ endpoints
BFSI Enterprise Clients
VISA · Kotak Bank · Reliance Jio — organisations where data sensitivity and regulatory scrutiny are the primary procurement criteria.
VISA · Kotak Bank · Jio
25 Years Enterprise Delivery
India · Singapore · Malaysia · UAE. Four offices. One accountability model. A 25-year track record across the region’s most regulated markets.
India · SG · MY · UAE
Single-Point Accountability
NOC + SOC + IT Infrastructure + ITSM + Compliance — one team. No separate towers. One team owns the outcome from scan to close to audit evidence.
No handoffs · Full ownership
Verified Case Study
A compliance programme built under audit pressure.
The evidence trail that made the difference.
Technology Sector · India · RBI IT Framework + CERT-In
“They didn’t just know vulnerability management. They knew exactly what our RBI examiner would ask for — and had it ready before we did.”
Managed VM Compliance · Technology Sector · Hybrid Infrastructure · India
Building an Audit-Ready Vulnerability Programme Across 10,000+ Endpoints — Zero Audit Findings
99.5%
SLA Compliance
Rate Achieved
Rate Achieved
Zero
Audit Findings
on VM Evidence
on VM Evidence
The compliance challenge — what we inherited
Scans Without Evidence StructureWeekly scans running across 10,000+ endpoints — but findings existed only inside scanner dashboards. No structured documentation formatted for CERT-In inspection or RBI examination submission
No Risk Acceptance TrailVulnerabilities with operational dependencies were informally deferred — no CISO sign-off, no time-bound acceptance, no documented business justification. In an RBI examination, informal deferral is non-compliance
SLA Gaps Nobody Could ProveRemediation SLA timelines existed in internal policy. Adherence records did not. When auditors ask for SLA evidence, “we have a policy” is not an answer
Board Reporting Without DataSecurity leadership was expected to report cyber risk posture to the Board IT Committee — but had no structured programme output. Reports were manually assembled, inconsistent, and not examination-ready
What Softenger built — the compliance programme
Automated Evidence Generation Every CycleSplunk + Rapid7 dashboards generating structured output at the close of every assessment cycle — scan reports, findings by severity, SLA adherence records, and closure confirmation evidence — formatted for CERT-In and RBI examination submission automatically
Formal Risk Acceptance GovernanceCISO sign-off workflow implemented for every vulnerability not remediated within SLA — documented business justification, time-bound acceptance window, structured register formatted to RBI examiner requirements
Four-Tier SLA Framework — Tracked and EvidencedCritical 24–72hrs · High 7–14 days · Medium 30–60 days · Low 90 days. Every finding tracked against its SLA tier. Breach alerts automated. Adherence records generated without manual aggregation
Board-Level Reporting — Structured and Submission-ReadyMonthly executive reporting configured for Board IT Committee submission — posture trend, SLA scorecard, Top 10 criticals, risk acceptance register. Consistent. Structured. Examination-ready every cycle
99.5%
SLA Compliance on Remediation Tracking
100K+
Findings Governed Within SLA Per Month
Zero
Audit Findings on VM Evidence Gaps
Auto
CERT-In & RBI Evidence — Every Cycle
Download Full Case Study — Vulnerability Management Compliance & Audit Services
"The assessment didn't just find vulnerabilities. It found the reason they weren't being closed — and built the programme that proved they were."
See the Full Programme →Engagement Models
How we structure the engagement
Softenger's compliance and audit capabilities are delivered as part of a fully managed vulnerability management programme — not as a standalone audit service. The engagement model that fits your environment, team size, and regulatory obligations is determined during your compliance mapping session. Four options are available — from fully managed delivery to advisory and gap analysis engagements.
Enterprise VM Programme
See all four engagement models on our enterprise VM programme page
Full delivery options · Managed · On-site · Advisory · Audit & Upgrade
→
Common Questions
Vulnerability management best practices:
questions CISOs ask before engaging us
01What does your managed vulnerability assessment and management service cover?+
Four integrated pillars — 26 capabilities total. Vulnerability Assessment (scanning, asset discovery, severity classification, zero-day response), Vulnerability Management (continuous scanning, remediation tracking, SLA monitoring, risk acceptance governance), Patch & Remediation Governance (structured patch management, automated orchestration, bi-weekly tracking), and Compliance & Audit Services (gap analysis, ISO 27001/PCI-DSS/CERT-In evidence packages).
02Is your service CERT-In and RBI compliant?+
Yes. Our programme is built around CERT-In's 2022 Directions and RBI's IT Framework from inception — not retrofitted from a global template. We generate the specific evidence trail that CERT-In auditors and RBI examiners look for: scan reports, remediation tracking records, SLA adherence documentation, and risk acceptance logs.
03We already own Qualys or Rapid7. Do you work with our existing tools?+
Yes — we are tool-agnostic and this is deliberate. We integrate directly with Qualys VMDR, Rapid7 InsightVM, Tenable Nessus, Wiz CSPM, Palo Alto Prisma Cloud, and Splunk. No tool migration required. Your existing licence investment becomes the foundation of a properly governed programme, not a barrier to engagement.
04What SLA tiers do you guarantee?+
Critical: 24–72 hours. High: 7–14 days. Medium: 30–60 days. Low: 90 days. We achieved 99.5% SLA compliance in a live enterprise engagement managing 100,000+ monthly findings across 10,000+ hybrid endpoints. SLAs are tracked in real-time dashboards with automated breach alerting to the CISO escalation path.
05How do you handle our sensitive vulnerability data as an offshore team?+
Softenger is ISO 27001:2022 certified — our own information security management system is audited annually by an accredited third party. Engagement contracts include explicit data handling agreements, data residency options, and role-based access controls. We manage vulnerability data for VISA, Kotak Bank, and other regulated financial institutions where data sensitivity is the primary procurement criterion.
06How quickly can you onboard a managed programme?+
Typical fully managed onboarding runs 2–4 weeks: Week 1 — asset discovery and tool integration. Week 2 — baseline scan and finding prioritisation. Week 3 — ITSM integration and governance cadence setup. Week 4 — first monthly report and stakeholder review. Emergency onboarding is available for post-incident or pre-audit situations.
07What makes Softenger different from global MSSPs like IBM, TCS, or Wipro?+
Vulnerability assessment identifies and prioritises what needs to be fixed. Three structural differences: (1) Single-point accountability — NOC, SOC, IT infrastructure, ITSM, and compliance under one team. Global MSSPs deliver each as a separate tower. (2) APAC regulatory depth — CERT-In, RBI, SEBI, MAS TRM built in, not translated from a US/EU template. (3) Tool agnosticism — five platforms managed simultaneously with equal proficiency; most competitors are platform-centric.
08What does the bi-weekly governance call cover?+
Open finding review by severity and owner, SLA breach discussion and acceleration planning, blocker identification (technical, resource, or process), escalated items requiring CISO/IT Head decisions, and a confirmed two-week action plan. Minutes and an action tracker are distributed post-call.
09What vulnerability management best practices does your programme follow?+
Continuous scanning over periodic assessments, risk-based prioritisation using CVSS v3.1 combined with EPSS exploit-probability scoring, ITSM-integrated remediation tracking with assigned owners and SLA timers, a four-tier SLA governance model, bi-weekly operational governance calls, formal risk acceptance workflows with CISO sign-off, and auto-generated audit evidence packages for CERT-In, RBI, PCI-DSS, and ISO 27001.
10How does Softenger handle cloud vulnerability management?+
Agentless and agent-based scanning across AWS EC2, Azure VMs, and GCP Compute instances, container image scanning for Docker and Kubernetes pods, and Cloud Security Posture Management (CSPM) using Wiz and Palo Alto Prisma Cloud. Cloud findings are normalised alongside on-premise findings into a single governed programme — one SLA framework, one dashboard, one evidence trail.
Start Here
Request a Free
Compliance
Mapping
Session
Not a sales call. Not a generic demo. A structured 30-minute session with a Softenger compliance expert who will review your industry, geography, and active regulatory obligations — and map them against what your current vulnerability programme actually generates. You leave with a clear picture of your compliance gaps before your next audit does.
What the session covers
- Active regulatory obligation mapping — CERT-In, RBI, SEBI, DPDP, PCI-DSS, ISO 27001
- Current evidence audit — what your programme generates vs. what your auditors will ask for
- Gap identification — missing evidence packages, policy gaps, risk acceptance weaknesses
- Programme outline — what a compliance-ready VM programme looks like for your environment
- Examiner readiness — how your current posture would perform in an RBI or CERT-In inspection today
Who this is for
Compliance teams preparing for an upcoming CERT-In inspection, RBI examination, or PCI-DSS assessment
Security leaders whose programme generates scan reports but not structured examiner evidence
Organisations that have received a regulatory direction and need to demonstrate a governed VM programme quickly
Teams evaluating whether their current MSSP understands the Indian regulatory landscape
Request Your Free
Compliance Mapping Session
A Softenger compliance expert will respond within one business day to confirm your 30-minute session.
🔒 ISO 27001:2022 certified data handling · No sales pressure · 1 business day response
Not ready for a conversation yet? See how Softenger’s full enterprise vulnerability management programme works — all four pillars, all engagement models, all proof points — on one page.