Cyb-D Solutions Pvt. Ltd. is a Chennai based Cyber security firm. This firm was hired by AB Bank after regulators flagged compliance gaps. During the audit, the bank faced insider fraud, were manipulation of online banki

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · PYQS · June 2026
Cyb-D Solutions Pvt. Ltd. is a Chennai based Cyber security firm. This firm was hired by AB Bank after regulators flagged compliance gaps. During the audit, the bank faced insider fraud, were manipulation of online banking records was detected. Cyb-D collected logs and e-mails, but in court, the defence challenged the forensic preservation methods. Regulator also objected to AB bank's merged IT and cyber security policy. According to this policy, RBI mandates a separate cyber security framework. Cyb-D drafted a new cyber security policy covering incident response. VAPT, encryption and data protection, while keeping IT operations distinct. Later, AB Bank's lawyers wanted to use legal analytics tool to predict the outcome of customer disputes. While these tools gave useful insights, concerns about privacy and admissibility in court were raised. Cyb-D solved this by anonymizing data, taking consent and following the IT and data protection bill. In another fraud case, Cyb-D did forensic imaging of employee laptops but the defence argued that missing hash values and time stamps weakened the chain of custody. Cyb-D responded by maintaining proper custody logs and using standard forensic methods. Finally, Cyb-D VAPT testing found serious weaknesses in the bank's mobile app. Manager delayed fixing them and hackers later exploited these flaws causing a customer data breach. The bank was sued for negligence. To prevent this in future, Cyb-D setup a risk escalation system, having strict timelines for fixing issues and a high-level committee. In the light of the above case scenario, answer the following questions: AB Bank Managers delayed fixing issues found in VAPT, which led to a data breach and lawsuits. How did Cyb-D leverage the VPAT to provide crucial and timely oversight of cybersecurity risks for portfolio managers, thereby safeguarding against such damaging outcomes.

Answer & Explanation:

Vulnerability Assessment and Penetration Testing (VAPT) Portfolio Managers shall carry out periodic VAPT, inter-alia, including critical assets and infrastructure components like servers, networking systems, security devices, load balancers, other IT systems pertaining to the activities done as Portfolio Manager, etc., in order to detect security vulnerabilities in the IT environment and in-depth evaluation of the security posture of the system through simulations of actual attacks on its systems and networks. VAPT assists organizations by proactively identifying vulnerabilities before attackers exploit them. It strengthens cyber resilience, assists regulatory compliance, supports risk management, protects sensitive customer information and reduces the likelihood of financial and reputational losses arising from cyber incidents. Portfolio Managers shall conduct VAPT at least once in a financial year. However, for the Portfolio Managers, whose systems have been identified as "protected system" by National Critical Information Infrastructure Protection Centre (NCIIPC) under the Information Technology (IT) Act, 2000, VAPT shall be conducted at least twice in a financial year. Further, all Portfolio Managers shall engage only Indian Computer Emergency Response Team (CERT In) empaneled organizations for conducting VAPT. The final report on said VAPT shall be submitted to SEBI after approval from Technology Committee of respective Portfolio Manager, within 1 month of completion of VAPT activity. Any gaps or vulnerabilities detected shall be remedied on immediate basis and compliance of closure of findings identified during VAPT shall be submitted to SEBI within 3 months post the submission of final VAPT report. In addition, Portfolio Managers shall perform vulnerability scanning and conduct penetration testing prior to the commissioning of a new system which is a critical system or part of an existing critical system.

Topics: Cyber Security

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic