Trending Articles

Introduction Every compliance audit, regardless of framework, arrives at the same point: the auditor requests evidence that specific controls operated correctly over a defined period. The quality of that evidence determines the audit outcome. An organisation with strong technical controls but weak evidence infrastructure will produce an audit package that reflects what can be reconstructed … Continue reading Building a Defensible Audit Evidence Package for Regulators | Akku

Introduction DPDPA Chapters II and III establish six rights for Data Principals. Each right creates a corresponding technical obligation for the Data Fiduciary. The right to access personal data requires a self-service portal or fulfilment workflow capable of producing a structured summary of personal data and processing activities. The right to correction and erasure requires … Continue reading DPDPA Data Principal Rights: What the Technical Infrastructure Behind Each Right Requires

Introduction GDPR Article 25 requires that data protection be built into system architecture by design and that data minimisation be the default configuration. These are architectural requirements, not operational ones. They apply at the point systems are designed and deployed, not only when data is being processed. An organisation that deploys a system with broad … Continue reading GDPR Article 25: Data Protection by Design and IAM | Akku

Introduction ISO 27001:2022 Annex A.8.15 requires that logs recording user activities, exceptions, faults, and security events be produced, kept, and regularly reviewed. The control is specific: user activities. Not login events. Not authentication outcomes. The activities a user performs after authentication succeeds. Most organisations pursuing ISO 27001 certification have authentication logging in place. Every login … Continue reading ISO 27001 A.8.15: User Activity Logs and Authentication Logs Are Not the Same Control

Introduction Every compliance audit, regardless of framework, arrives at the same point: the auditor requests evidence that specific controls operated correctly over a defined period. The quality of that evidence determines the audit outcome. An organisation with strong technical controls but weak evidence infrastructure will produce an audit package that reflects what can be reconstructed … Continue reading How to Build an Audit Evidence Package That Survives Regulatory Scrutiny

Introduction SOC 2 CC6 is the Logical and Physical Access Controls criterion cluster and is where the majority of IAM-relevant requirements in a SOC 2 engagement sit. CC6.1 through CC6.8 cover logical access security, user registration and authorisation, access modification and removal, external threat protection, transmission controls, and malicious software prevention. Together they define what … Continue reading SOC 2 CC6: Logical Access Controls and What IAM Must Deliver

Introduction RBI 2023 Master Direction Clause 19 is the most technically detailed access control provision in the framework. It establishes three distinct requirements across its sub-clauses: need-based access for all users under Clause 19(a), close supervision of privileged users with logged system activities under Clause 19(b), and multi-factor authentication for privileged users accessing critical information … Continue reading Access Controls for Indian Banks. What Need-Based Access Requires Technically.

Introduction SEBI CSCRF’s Protect function contains the Access Authentication sub-category PR.AA, which runs from PR.AA.S1 through PR.AA.S17 and represents the most detailed set of identity and access management requirements in any Indian regulatory framework. The Detect function’s continuous monitoring sub-category DE.CM adds a layer of anomaly detection and real-time visibility requirements that most capital markets … Continue reading SEBI CSCRF Access Controls: What PR.AA and DE.CM Require From Your Identity Stack

Introduction DPDPA Clause 6 sets specific conditions for consent as a lawful basis for processing personal data. Consent must be free, specific, informed, unconditional, and unambiguous. It must be as easy to withdraw as it is to give. The controller must be able to demonstrate that consent was given. These are not abstract principles. Each … Continue reading DPDPA Consent Management: What Explicit, Informed, and Withdrawable Looks Like Technically