Cybersecurity Risk Compliance in India

Abstract

The Cyber risk to all Companies is real and present.  It impacts not only financially but also adversely to the company’s reputation and its brand. The Companies Act 2013 has made the Board of Directors responsible for appropriately manage risk to the company (S. 134), while auditors are accountable for reporting any risk to the company (S. 177). The Auditing standard AAS 29 (SA 401) requires computer security auditing. Therefore annual auditor’s report will be incomplete without assessing Cybersecurity risk management policy and its implementation. The Auditors may seek experts help to complete the effective audit. Therefore Cybersecurity risk management is a statutory 4compliance requirement.