NPCI in a statement said, “NPCI handles all sensitive information like card data in line with PCIDSS requirements. PCIDSS norms also allows clear card information under certain circumstances for permitted functions, with appropriate controls. We have been subject to regular PCIDSS audits through externals QSA’s, qualified by PCI council. NPCI is fully compliant to these standards. NPCI proactively has adopted global best practices in handling personal identifiable information (PII) and is one of the early practitioners in India.”
NPCI’s statement comes after Reuters reported that nearly over 40 critical and high risk security vulnerabilities were found in NPCI in the internal audit conducted by the central government in 2019.
The report citing the audit said there were lapses in storing of the 16 digit card numbers and personal information of card holders were stored in plain text leaving it unprotected incase if the system was breached.
Lt General Rajesh Pant, NCSC, in a statement said, “We conduct Special Cyber Audits as part of the nation’s effort to protect and safe guard all critical enterprises such as NPCI, UIDAI, NIC etc, thereby helping to ensure the overall National Security. NPCI has provided higher levels of access to NCSC that are not normally made available to any stakeholders during regular course of business, as an effort to strengthen its cyber defense.”
Dilip Asbe, MD & CEO, NPCI said, “We consider audits as an important governance layer for the IT systems that evolves constantly, for appropriateness and adequacy of controls deployed so as to ensure that the critical systems, processes and data under its purview remain safe and secure. As a process, NPCI has ensured that there are adequate controls across multiple levels and Audit findings are remediated immediately and closed to satisfaction of auditing entities.”
