Resources Categories
INDUSTRY FACT FILE · ASSET MANAGEMENT
Applicable Cybersecurity Services and Codec Networks Bundles for Asset and Investment Managers
How Codec Networks services and bundled service models help asset managers resolve their threats, comply with SEBI's CSCRF and system audit requirements, and protect investors.
|
In this document 1. Our approach 2. Mapping threats to services 3. Codec Networks service catalogue for the sector 4. Codec Networks bundles for the sector 5. Sector programmes built from the bundles 6. Packages: Foundation, Assurance and Continuous Resilience 7. Regulatory requirement-to-bundle mapping 8. Threat-to-bundle coverage matrix 9. Delivery methodology and deliverables 10. Why Codec Networks 11. Annex: indicative commercial ranges |
1. Our approach
Asset managers need assurance that follows the investor and the fund across partners. Codec Networks works on four principles:
- Start with registrations and category: map each SEBI registration to its CSCRF category and system audit requirements.
- Follow the investor journey: test onboarding, transactions, bank-change and redemption flows end to end.
- Include the partners: RTAs, custodians, fund accountants, distributors and vendors are part of the attack surface.
- Prove closure: close findings on time and document evidence for SEBI, trustees and the Board.
2. Mapping threats to services
The table maps the 18 threats identified in Document 4 of this set to the Codec Networks services that help mitigate them.
|
Threat / challenge |
Applicable Codec Networks services |
Intended outcome |
|
Redemption and bank-mandate fraud |
Transaction-flow testing, IAM & MFA bypass testing, SOC fraud use cases |
Fewer fraudulent redemptions |
|
Investor account takeover |
App and portal testing, authentication review |
Stronger account security |
|
Front-running and order leakage |
Dealing-room controls review, DLP, insider simulation |
Protected order information |
|
Ransomware |
Ransomware simulation, backup testing, IR retainer |
Tested recovery |
|
Phishing and BEC |
Phishing simulation, executive impersonation testing, DMARC review |
Reduced impersonation success |
|
Investor data leakage |
DPDPA readiness, data discovery, DLP |
Reduced data exposure |
|
Third-party and RTA compromise |
Third-party risk management, RTA and vendor assessments |
Managed provider risk |
|
NAV and pricing tampering |
Integrity controls review, vendor assessment |
Trusted NAVs |
|
Distributor API abuse |
API security testing, partner assessment |
Protected folios |
|
Fake apps and scams |
Brand and app monitoring, takedown |
Faster removal of impersonation |
|
Deepfake fund managers |
Social-media monitoring, deepfake simulation, awareness |
Protected brand and investors |
|
Insider misuse of data |
Access reviews, data exfiltration simulation |
Accountable access |
|
Cloud misconfiguration |
SEBI cloud framework assessment, posture monitoring |
Compliant cloud use |
|
Supply-chain compromise |
Supply-chain testing, vendor SDLC review |
Trusted software |
|
Weak detection and response |
Managed SOC, M-SOC readiness, playbooks |
Reliable 6-hour reporting |
|
Backup and recovery failure |
BCP/DR testing against objectives |
Proven recovery |
|
Unauthorised portfolio trading |
Access and approval controls testing |
Protected client portfolios |
|
Deal-data theft |
Data-room and email security review |
Protected confidentiality |
3. Codec Networks service catalogue for the sector
|
Service line |
Sector-relevant services |
|
Security Vulnerability Assessment & Penetration Testing |
CSCRF VAPT by a CERT-In empanelled auditor; investor app, portal and distributor API testing; network and cloud testing |
|
Information security audit & compliance |
CSCRF categorisation and gap assessments, CSCRF cyber audits, SEBI mutual fund system audits, ISO/IEC 27001:2022 |
|
Offensive security & simulation |
Phishing and executive impersonation testing, insider threat simulation, deepfake testing, red teaming for larger AMCs |
|
Data privacy & protection |
DPDPA readiness, investor data mapping across partners, DLP, breach response |
|
24/7 Managed SOC & threat monitoring |
SOC-as-a-Service, M-SOC readiness, fraud and insider use cases, brand monitoring |
|
Business continuity & resilience |
BCP and DR reviews, recovery objective testing, ransomware readiness, crisis communication |
|
Cyber forensics |
Incident triage, fraud and insider investigations, root-cause analysis |
|
Third-party risk management |
RTA, custodian, fund accountant, pricing vendor and distributor assessments |
|
Emerging technology security |
AI security testing and governance for research and investor-servicing tools |
4. Codec Networks bundles for the sector
Eleven of the twelve bundles in the Codec Networks Bundled Service Models apply directly to asset and investment managers; the Global Cyber Back-Office SPV Program (Bundle 12) is offered separately for international clients.
Figure 6: Codec Networks bundles applied to the sector.
|
Bundle |
Name |
Sector-relevant scope |
Best suited for |
Key deliverables |
|
B1 |
Cyber Assessment & VAPT Assurance Program |
CSCRF VAPT by CERT-In empanelled auditor, retest |
All SEBI regulated managers |
VAPT reports and revalidation |
|
B2 |
Application, API & DevSecOps Security Program |
Investor apps, portals, distributor APIs, secure SDLC |
AMCs and wealth platforms |
Application and API risk report |
|
B3 |
Cloud, Infrastructure & Zero Trust Security Program |
SEBI cloud framework, segmentation, IAM |
Managers using cloud |
Cloud framework assessment |
|
B4 |
Regulatory Cybersecurity Audit & Compliance Assurance Program |
CSCRF cyber audits, MF system audits, evidence |
AMCs, PMs, AIF managers |
Audit reports and compliance matrix |
|
B5 |
GRC, ISO, SOC 2 & Cyber Maturity Program |
ISO 27001, policies, risk registers |
Managers formalising governance |
Maturity scorecard and policies |
|
B6 |
Data Privacy, DPDPA & Data Protection Program |
Investor data mapping, consent, DLP |
All managers handling investor data |
Privacy gap assessment |
|
B7 |
Managed SOC, MDR & Continuous Threat Monitoring Program |
24x7 SOC, M-SOC readiness, insider monitoring |
Entities needing SOC under CSCRF |
SOC reports and efficacy metrics |
|
B8 |
Digital Forensics, Incident Response & Malware RCA Program |
Fraud and insider investigations, 6-hour reporting support |
Any manager facing an incident |
Forensic report and RCA |
|
B9 |
Third-Party Risk Management & Supply Chain Cyber Risk Program |
RTA, custodian, fund accountant and vendor assessments |
Managers relying on service providers |
Vendor risk assessments |
|
B10 |
Cyber Simulation, Awareness, Tabletop & Crisis Readiness Program |
Phishing, deepfake and tabletop exercises |
Boards, dealing, investor services |
Exercise and campaign reports |
|
B11 |
Emerging Technology, AI, Web3 & Future Security Program |
AI security testing and governance |
Managers deploying AI tools |
AI risk assessment |
5. Sector programmes built from the bundles
Codec Networks packages the catalogue bundles into six asset management programmes.
|
Programme |
Built from bundles |
Challenges addressed |
|
CSCRF and System Audit Programme |
B4, B1 |
Categorisation, cyber audits, VAPT and system audits |
|
Investor Journey Security |
B2, B7 |
Account takeover, redemption and bank-change fraud |
|
Dealing-Room and Insider Controls |
B7, B6 |
Front-running, order leakage and insider misuse |
|
Third-Party and RTA Assurance |
B9, B4 |
Provider, pricing vendor and distributor risk |
|
Investor Data Protection |
B6, B3 |
DPDP readiness across partners |
|
Resilience and BCP/DR |
B10, B8 |
Ransomware, recovery and 6-hour reporting |
6. Packages: Foundation, Assurance and Continuous Resilience
|
Package element |
Foundation |
Assurance |
Continuous Resilience |
|
Typical manager |
Advisers, small PMS and AIF managers |
Mid-sized AMCs, PMS and platforms |
Large AMCs (Qualified REs) |
|
Testing |
B1: annual VAPT |
B1 + B2: VAPT, app and API testing |
B1 + B2 + B10: frequent VAPT, red teaming |
|
Audit and GRC |
B4: CSCRF gap review and audit |
B4 + B5: cyber and system audits, policies |
B4 + B5 + B9: audits, RTA and vendor assurance |
|
Cloud and privacy |
B3: cloud quick review |
B3 + B6: cloud framework and DPDPA |
B3 + B6 + B11: continuous assurance, AI governance |
|
Monitoring and response |
M-SOC readiness (B7) |
B7: managed SOC + B8 |
B7: SOC, insider monitoring, threat hunting + B8 |
|
Reporting |
Compliance checklist |
Consolidated risk reporting |
Board and trustee reporting |
7. Regulatory requirement-to-bundle mapping
|
Requirement (SEBI CSCRF unless stated) |
How Codec Networks helps |
Bundle |
|
Cyber audit by a CERT-In empanelled auditor, frequency by category |
CSCRF cyber audit with closure |
B4 |
|
VAPT by a CERT-In empanelled auditor, with closure and revalidation |
VAPT and revalidation |
B1 |
|
SOC for larger REs; Market SOC onboarding for smaller REs |
Managed SOC and M-SOC readiness |
B7 |
|
Cyber incidents reported to SEBI within six hours; CERT-In in parallel |
IR retainer and reporting support |
B7, B8 |
|
SEBI system audit framework for mutual funds and AMCs |
MF system audit |
B4 |
|
SEBI cloud framework (March 2023) |
Cloud framework assessment |
B3 |
|
Third-party risk management for service providers |
RTA, custodian and vendor assessments |
B9 |
|
DPDP safeguards and breach intimation (from May 2027) |
DPDPA programme |
B6 |
|
Auditor eligibility and independence CSCRF requires cyber audits and VAPT to be performed by CERT-In empanelled IS auditing organisations. Codec Networks is CERT-In empanelled and confirms auditor eligibility and independence in each proposal. |
8. Threat-to-bundle coverage matrix
|
Threat / challenge |
Primary bundle |
Supporting bundles |
|
Redemption and bank-mandate fraud |
B2 |
B7 |
|
Account takeover |
B2 |
B7 |
|
Front-running and leakage |
B7 |
B6 |
|
Ransomware |
B7 |
B8, B10 |
|
Phishing and BEC |
B10 |
B7 |
|
Investor data leakage |
B6 |
B3 |
|
Third-party and RTA |
B9 |
B4 |
|
NAV and pricing tampering |
B9 |
B4 |
|
Distributor API abuse |
B2 |
B9 |
|
Fake apps |
B7 |
B10 |
|
Deepfake fund managers |
B10 |
B7 |
|
Insider misuse |
B7 |
B6 |
|
Cloud misconfiguration |
B3 |
B7 |
|
Supply chain |
B9 |
B2 |
|
Weak detection |
B7 |
B8 |
|
Recovery failure |
B10 |
B1 |
|
Unauthorised portfolio trading |
B2 |
B7 |
|
Deal-data theft |
B6 |
B3 |
“Primary” and “supporting” indicate suggested combinations, not guaranteed mitigation or complete coverage.
9. Delivery methodology and deliverables
Figure 7: The Codec Networks delivery methodology.
Typical deliverables include a CSCRF categorisation and gap matrix, CERT-In empanelled cyber audit and VAPT reports, an MF system audit report, a cloud framework assessment, a third-party risk register, a privacy gap assessment and Board and trustee reporting packs.
10. Why Codec Networks
- CERT-In empanelled for information security auditing services, and empanelled with NICSI for application audit and compliance services (start-up category).
- Certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
- Full stack: VAPT, regulatory audit, managed SOC, forensics, privacy and Board advisory from one partner, so findings, monitoring and closure stay connected.
- Asset management depth: investor journey, redemption, distributor API, dealing-room and fund-accounting controls testing aligned to CSCRF and SEBI system audit requirements.
- Recognised frameworks and tools: OWASP ASVS/MASVS and API Top 10, MITRE ATT&CK, NIST CSF, ISO 27001 and PCI DSS; tools such as Burp Suite, Nessus, Metasploit, Prowler and leading SIEM/EDR platforms.
- Certified people: CEH, OSCP, CPENT, CISA, ISO 27001 LA/LI, CHFI, CTIA and ECIH professionals.
Annex: Indicative commercial ranges
For internal sales reference only—remove this annex before sharing externally. Ranges are taken from the Codec Networks Bundled Service Models and are subject to scoping, asset counts, frequency and service levels.
|
Bundle |
Package examples and indicative ranges |
|
B1 VAPT Assurance |
Essential ₹1.5–5 lakh; Professional ₹5–15 lakh; Enterprise ₹15–40 lakh; Annual retainer ₹25 lakh–₹1.5 crore |
|
B2 AppSec & DevSecOps |
API Quick Check ₹2–6 lakh; AppSec Professional ₹8–20 lakh; DevSecOps Maturity ₹12–35 lakh; Secure SDLC retainer ₹3–15 lakh/month |
|
B3 Cloud & Zero Trust |
Cloud Essential ₹3–8 lakh; Professional ₹8–25 lakh; Enterprise ₹25–75 lakh; Continuous assurance ₹2–10 lakh/month |
|
B4 Regulatory Audit |
Gap review ₹5–15 lakh; Full regulatory audit ₹15–50 lakh; Multi-framework audit ₹30 lakh–₹1.25 crore; Annual retainer ₹3–20 lakh/month |
|
B5 GRC, ISO, SOC 2 |
ISO readiness ₹5–15 lakh; ISO implementation ₹15–45 lakh; SOC 2 readiness ₹15–60 lakh; GRC retainer ₹2–12 lakh/month |
|
B6 Privacy & DPDPA |
Quick assessment ₹3–10 lakh; Implementation ₹10–40 lakh; DPO-as-a-Service ₹2–8 lakh/month; Privacy retainer ₹3–15 lakh/month |
|
B7 Managed SOC |
Starter ₹2–5 lakh/month; Professional ₹5–15 lakh/month; Enterprise ₹15–50 lakh/month; co-managed per FTE/shift |
|
B8 Forensics & IR |
Triage ₹3–15 lakh; Full investigation ₹15–75 lakh; Ransomware response ₹25 lakh–₹1.5 crore; IR retainer ₹5–50 lakh/year |
|
B9 TPRM |
₹25,000–₹2 lakh per vendor; batch pricing for 50–500 vendors; retainer ₹3–25 lakh/month |
|
B10 Simulation & Tabletop |
Awareness ₹1–5 lakh; Phishing simulation ₹2–10 lakh; Tabletop ₹5–20 lakh; Cyber war-game ₹15–75 lakh; Annual retainer ₹10 lakh–₹1 crore/year |
|
B11 Emerging Tech |
AI/LLM risk review ₹5–25 lakh; Smart contract audit ₹5–50 lakh; Emerging tech retainer ₹5–25 lakh/month |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Service scope, deliverables, monitoring coverage and service levels are confirmed during engagement scoping. Services support risk reduction and assurance but do not guarantee prevention of all cyber incidents or regulatory compliance. Regulatory references are summaries; confirm against the official instruments applicable to each entity.