Secure · Governance, risk and compliance
Enterprise risk management (ERM) for Indian organisations whose risks sit in separate lists, with vendors on none of them. NetScale runs risk assessments with each business function, builds one register with an owner for every risk, puts vendors on it and tracks each treatment. The register and its reports are yours to keep.
Enterprise Risk Management (ERM)
Enterprise risk management (ERM) is one register of what could go wrong across every level and business function.
Each risk is rated, owned and tracked to a treatment. For IT it means outages, breaches, vendor failures and compliance gaps are described by their effect on the business. They are rated on the same scale as other risks, so leadership can decide what to treat first.
Vendors are included. Each vendor with access to your systems or personal data is assessed, rated and placed on the same register, with an owner on your side.
Risk reviews of the technical design sit under Security architecture and GRC.
The policies and controls that treat each risk sit under Governance, risk and compliance frameworks.
Vendors were given access to get work done. Their breach becomes yours. Whose risk register are they on?
Our answer: Vendor and third-party risk
Each department keeps its own risk list. Which one does the board see?
Our answer: Risk register
A risk was accepted to meet a deadline. Who signed it off?
Our answer: Treatment and acceptance tracking
Risks are rated high, medium and low. Which ones has anyone acted on?
Our answer: Reporting to risk owners
Risks identified, assessed and mitigated across every level and business function, vendors included.
Workshops with each business function to find what could go wrong, rated by likelihood and impact on criteria agreed with you first.
One register across every level and business function, each risk with an owner, a rating, a treatment and a review date.
Vendors, processors and their access reviewed against their contracts, rated and placed on the same register as every other risk.
Each treatment tracked to closure, and each accepted risk signed off by its owner with a date to review it again.
A short report for each risk owner and one for leadership, drawn from the same register, on a schedule agreed in writing.
One management system, drawn three times.
You can stop at any phase boundary. The assessment is free, and each phase is priced in writing before it starts.How we engage
Under the DPDP Act, a data fiduciary stays responsible for personal data processed on its behalf. It may engage a processor only under a valid contract, so processors sit on the register, contract and all.
Source: Digital Personal Data Protection Act, 2023 (external site)
Which vendors count as processors under the Act, and what their contracts must say, is for your counsel. We assess the access, the controls and the risk.
Business functions and levels the register covers.
Vendors and processors to assess, and how much access each one has.
Starting point: whether a register exists, and in how many places.
Review schedule: how often the register is reviewed and reported after it goes live.
The most relevant engagement, with its numbers. Client names and the full write-up are shared in conversation.
Co-working · Two Indian cities
How a co-working space operator measured its readiness under India’s Digital Personal Data Protection Act and scoped the work to close the gaps.
Our own information security and privacy management systems, run under both standards.
Certifications and technologyIt means IT risks sit on the same register as the business’s other risks, rated the same way and owned by a named person. An outage, a breach or a vendor failure is described by its effect on the business. Leadership can then compare it with other risks and decide what to treat first.
By what each vendor can reach and what its contract says. We list the vendors with access to your systems or personal data and review that access and the contract terms. Each one is rated and put on the register. Vendors with the most access are reviewed first and most often.
Each risk, its owner, its rating and what is being done about it. A useful entry also says what could happen, the controls in place, the treatment chosen, a target date and the next review date. Accepted risks are recorded with who accepted them and why.
As often as agreed in writing, and whenever something material changes. A new vendor, system, site or incident should trigger a review of the risks it touches. The schedule for full reviews is set with you during delivery and written into the engagement, so it is kept rather than remembered.
A security risk assessment looks at the technical design; ERM keeps every risk in one register. The assessment finds weaknesses in networks, identity and cloud. ERM takes those findings, alongside operational, vendor and compliance risks, rates them on one scale and tracks each to a treatment with an owner.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
