Inspection Body
Scheme for Inspection of Critical Sector Entities
AWARDS &
RECOGNITIONS
See how brands like yours secure their IoT products with Payatu.
About Payatu
Payatu Security Consulting Pvt. Ltd. (“Payatu”) provides independent inspection services in accordance with applicable inspection criteria, contractual requirements, and relevant regulatory/scheme requirements.
Our inspection services validate the security posture of an organization’s Critical Information Infrastructure (CII) through independent, technical testing and assessment complementing management-system-focused certifications such as CSMS (Cyber Security Management System).
Payatu operates as a Type A Inspection Body as defined under ISO/IEC 17020:2012. As a Type A inspection body, Payatu is independent of the parties involved in the items it inspects and does not engage in the design, manufacture, supply, installation, purchase, ownership, use, or maintenance of the items inspected. Payatu is not linked to any separate legal entity engaged in such activities through common ownership, common appointees, shared higher-level management, or contractual commitments that could influence the outcome of an inspection.
Scope of Inspection Services :
Payatu provides inspection services within the scope defined in its approved scheme(s), competence framework, and applicable contractual/regulatory requirements. The scope of inspection services may include, as applicable:
- Inspection of cyber security / information security related controls, configurations, or technical implementations.
- Inspection against defined technical criteria, client specifications, contractual obligations, or applicable standards/schemes.
- Verification of implementation status of specified controls, safeguards, or technical requirements.
- Follow-up inspections where required to verify closure of identified nonconformities or observations.
- Remote or on-site inspection activities, depending on the nature of the inspection and the applicable scheme requirements.
The exact scope, criteria, deliverables, and methodology applicable to a particular inspection engagement shall be defined in the proposal/agreement.
Inspection Schemes Operated by Payatu
Payatu is a certified inspection body for the following types of management system inspections:
- Scheme for Cyber Security Management System (CSMS) — Basic Tier Certification, Level 1, under the NCIIPC-QCI Conformity Assessment Framework for Cyber Security of Critical Sector Entities (CAF_CS_CSE).
- ISO/IEC 27001:2022 — Information Security Management Systems.
The audit criteria for each scheme are as outlined in the applicable ISO standard (e.g. ISO/IEC 27001:2022) and any other normative documents specified by the relevant scheme owner. Where a client requires an explanation of how these criteria apply to its specific inspection programme, this is provided by Payatu’s inspection committee.
Commitment to Impartiality, Independence, and Integrity
Payatu is committed to maintaining impartiality, objectivity, and independence in all inspection activities. To safeguard impartiality:
- Inspection activities are performed in a manner that is free from commercial, financial, or other pressures (including trade, administrative, competitive, or moral pressures) that could compromise objectivity.
- Payatu identifies, reviews, and manages risks to impartiality arising from ownership, relationships, prior involvement, subcontracting, commercial arrangements, or personnel activities, on an ongoing basis.
- Inspection personnel are required to disclose any actual, potential, or perceived conflict of interest before accepting or conducting an inspection, and shall not participate in inspection decisions where their impartiality could be compromised.
- Payatu does not allow any undue influence from clients, external organizations, other inspection bodies, or internal functions to affect the outcome of inspection activities. Where another inspection body declines to provide service to a prospective client and that client approaches Payatu for the same service, Payatu investigates the reasons for the decline before undertaking any inspection activity for that client.
- Where an unacceptable threat to impartiality is identified and cannot be adequately mitigated, Payatu shall decline or discontinue the inspection activity.
Payatu reviews impartiality risks on an ongoing basis and takes appropriate action to eliminate or minimize such risks. This process is overseen by Payatu’s committee for safeguarding impartiality, which meets at least annually to review identified risks and the effectiveness of mitigating actions.
Confidentiality and Information Security
Payatu respects the confidentiality of all information obtained or created during the course of inspection activities. Accordingly:
- Information relating to a client’s organization, systems, processes, personnel, infrastructure, and inspection results is treated as confidential unless disclosure is required by law, regulation, accreditation requirements, or with the client’s written authorization.
- Payatu personnel, committee members, contractors, and any external resources acting on behalf of Payatu are bound by confidentiality obligations through executed Non-Disclosure Agreements (NDAs). Any outside organization engaged on Payatu’s behalf likewise executes an NDA covering both Payatu’s and the client’s confidential information, and abides by the client’s applicable security requirements.
- Confidential records, whether physical or electronic, are protected through appropriate administrative, technical, and physical controls. Hard-copy client records collected for audit purposes are kept under lock and key and returned at the earliest opportunity once no longer required. Soft-copy client records are stored on access-controlled systems protected by individual user identification and password, and are removed when no longer required.
- Information received from third parties in relation to an inspection activity, complaint, or appeal (e.g. from a regulator or complainant) is handled with due confidentiality.
- Payatu shall inform the client in advance of any information it intends to place in the public domain. Except for information the client makes publicly available, or as otherwise agreed between Payatu and the client (e.g. for the purpose of responding to a complaint), all information obtained during inspection activities is treated as proprietary and confidential.
- Where disclosure is legally required, Payatu shall, unless prohibited by law, inform the concerned client of the information to be disclosed in advance.
Inspection Process
Payatu follows a defined inspection process to ensure that inspection activities are planned, executed, reviewed, and reported consistently.
Enquiry / Application
The inspection process begins when a prospective client submits an enquiry or request for inspection, typically by completing an application form covering basic organizational information, the people involved, and operational processes. Payatu may obtain further relevant information such as:
- organization details;
- subject / scope of inspection;
- applicable inspection criteria / standard / scheme;
- locations / systems / assets to be inspected;
- timelines and specific client requirements;
- legal / contractual / confidentiality considerations.
Review of Request and Proposal
Payatu reviews the request to determine: whether the scope of work is clearly defined; whether Payatu has the competence and resources to perform the inspection; whether impartiality or conflict-of-interest risks exist; whether the inspection criteria are appropriate and agreed; and whether any subcontracting, remote assessment, or special arrangements are necessary.
Based on this review, Payatu furnishes a proposal to the client containing complete details, including costing, methodology, requirements, accreditation scope, timescales, terms and conditions, and general requirements.
Contract Review and Acceptance
Following the client’s acceptance of the proposal, an agreement is signed between the client and Payatu. Payatu confirms the inspection scope, applicable criteria, timelines, and deliverables. The inspection is scheduled only after the requirements are adequately understood and agreed by both parties.
Inspection Planning
Post-agreement,Payatu prepares a detailed audit/inspection plan, which is shared with and agreed upon by the client. The plan may include, as applicable: scope and objectives of inspection; inspection criteria/references; inspection locations/systems/processes; inspection dates and timelines; assigned inspection personnel; sampling approach where relevant; documentation/access requirements; and reporting and communication arrangements.
Conduct of Inspection
The inspection may be carried out on-site, remotely, or through a combination of methods, depending on the nature of the inspection and applicable requirements. For management system inspections, the inspection is conducted in two stages:
- Stage 1: Payatu reviews the management system documentation received from the client to determine its adequacy with respect to the relevant standard, and compiles a report/observations based on this review, which is discussed with the client. The client addresses any inadequacies identified and prepares its documentation to demonstrate compliance. A detailed, on-site review of the client’s implemented documented system against its working practices and the applicable standard is then conducted.
- Stage 2: An assessment inspection carried out once Stage 1 inadequacies have been addressed and the organization is ready to demonstrate compliance with the selected standard. At the close of the Stage 2 inspection, the Lead Inspector/Auditor shares recommendations with the client organization; any nonconformances raised are discussed at the earliest opportunity.
Inspection activities may include, as relevant: review of documents, records, and evidence; interviews with relevant personnel; observation of activities, controls, or operations; verification of implementation against defined criteria; technical examination, testing witness, or review of system configurations/settings where applicable; sampling and validation of records and review of previous findings and the status of corrective actions where applicable.
Inspection Findings and Reporting
At the conclusion of the inspection, Payatu documents the inspection outcome in an inspection report or other applicable inspection document. The inspection output may include, as applicable: identification of the client/inspected entity; description of the subject of inspection; scope and criteria of inspection; date(s) of inspection; inspection activities performed; observations, findings, and conclusions; nonconformities/deviations/opportunities for improvement, where applicable; limitations, exclusions, or conditions affecting the inspection outcome; and authorized approval/issue details.
Inspection Decision, Review and Approval
Following the inspection stage, once corrective actions (where required) have been verified, the inspector recommends certification to Payatu’s inspection committee, which comprises three members. The inspection decision is taken by person(s) different from those who carried out the inspection. The committee’s review includes:
- analysis of Stage 1 and Stage 2 inspection findings;
- verification of satisfactory correction and corrective action for any major nonconformities; and
- the initial inspection decision, or the decision on renewing/maintaining inspection, as applicable.
Upon verification of the inspector’s report and acceptance by the committee, the certificate is granted to the client within fifteen working days of verification of corrective actions.
Follow-up / Repeat Inspection
Where the inspection scheme, contract, or nature of findings requires follow-up verification, Payatu may conduct a follow-up or repeat inspection to verify corrective actions or reassess the inspected scope.
Maintaining, Suspending, and Withdrawing Certification
1. Re-Inspection (Recertification) Audits
Re-inspection audits are carried out to verify the continuing effectiveness, improvement, and achievement of the client’s policies and objectives. These audits follow the same Inspection Process described in Section 5 above.
3. Suspension of Certification
PAYATU does not, in the normal course of events, suspend certified clients, and will only do so under exceptional circumstances and on a case-by-case basis. While a certificate is under suspension, the certified management system is invalid until the suspension is lifted; this is reflected on PAYATU’s client directory. Circumstances that may lead to suspension include, but are not limited to:
- the client’s certified management system has persistently or seriously failed to meet inspection requirements;
- the certificate holder does not allow surveillance or rectification audits to be conducted at the required facilities; or
- the certificate holder voluntarily requests a suspension.
Failure to resolve the issues that resulted in a suspension within the time established by PAYATU may result in withdrawal or reduction of the scope of inspection.
2. Special Audits
Intermediate audits may be carried out in the following scenarios:
- extensions to the scope of certification;
- suspending, withdrawing, or reducing the scope of inspection; or
- short-notice audits in response to complaints or pending suspension.
4. Status and Verification of Certificates
Information about certificates granted, suspended, or withdrawn, and the means to confirm the validity of a given certificate, is maintained by PAYATU. For ISO/IEC 27001:2022 certificates, validity can be confirmed via www.iafcertsearch.org. Certificate status information is updated within 90 days of the date of release of the certificate, or of any subsequent update to that information.
Client Responsibilities
To enable Payatu to perform inspection activities effectively, clients are expected to:
- provide complete and accurate information relevant to the inspection;
- define the scope of inspection clearly;
- provide access to relevant locations, personnel, systems, records, and evidence;
- ensure availability of responsible representatives during inspection activities;
- communicate any health, safety, security, legal, or confidentiality constraints relevant to the inspection;
- inform Payatu of significant changes that may affect the scope, conditions, or outcome of inspection;
- cooperate in the resolution of identified findings, complaints, or appeals where applicable; and
- use inspection reports, certificates, and references in a truthful and non-misleading manner.
Complaints Handling
Payatu has a documented process for handling complaints relating to its inspection activities, personnel, conduct, or inspection outputs. A complaint may be submitted by a client or any interested party, by e-mail, fax, written, or verbal means, through the designated communication channels of Payatu. Payatu accepts complaints only with proper identification of the complainant, and acknowledges receipt of each complaint.
Complaint handling principles:
- Complaints are acknowledged, recorded, and gathered/verified by Payatu’s committee to validate the complaint.
- Complaints are reviewed to determine whether they relate to Payatu’s inspection activities; if the complaint concerns a certified client, it is communicated to that client at an appropriate time.
- Complaints are investigated by personnel who were not directly involved in the subject matter of the complaint or in the original inspection decision, wherever practicable.
- Where the complaint is against a certified client, the investigation considers the effectiveness of the certified management system, and any required actions are decided and tracked by the committee.
- Appropriate correction, corrective action, or response is initiated and tracked to completion where required.
- The complainant is informed of the progress and outcome of the complaint, subject to confidentiality obligations; a progress report is sent and feedback requested within fifteen days, and the complaint is treated as resolved if no further response is received. Formal notice is given to the complainant upon closure.
- Complaint handling shall not result in discriminatory treatment of the complainant.
- Payatu determines, together with the client and complainant, whether and to what extent the subject of the complaint and its resolution shall be made public.
Confidentiality is maintained throughout the complaint handling process, both as it relates to the complainant and to the subject of the complaint. Progress on complaint handling is shown to and discussed with Payatu’s impartiality committee.
Appeals Handling
Payatu has a documented process for handling complaints relating to its inspection activities, personnel, conduct, or inspection outputs. A complaint may be submitted by a client or any interested party, by e-mail, fax, written, or verbal means, through the designated communication channels of Payatu. Payatu accepts complaints only with proper identification of the complainant, and acknowledges receipt of each complaint.
Complaint handling principles:
- Complaints are acknowledged, recorded, and gathered/verified by Payatu’s committee to validate the complaint.
- Complaints are reviewed to determine whether they relate to Payatu’s inspection activities; if the complaint concerns a certified client, it is communicated to that client at an appropriate time.
- Complaints are investigated by personnel who were not directly involved in the subject matter of the complaint or in the original inspection decision, wherever practicable.
- Where the complaint is against a certified client, the investigation considers the effectiveness of the certified management system, and any required actions are decided and tracked by the committee.
- Appropriate correction, corrective action, or response is initiated and tracked to completion where required.
- The complainant is informed of the progress and outcome of the complaint, subject to confidentiality obligations; a progress report is sent and feedback requested within fifteen days, and the complaint is treated as resolved if no further response is received. Formal notice is given to the complainant upon closure.
- Complaint handling shall not result in discriminatory treatment of the complainant.
- Payatu determines, together with the client and complainant, whether and to what extent the subject of the complaint and its resolution shall be made public.
Confidentiality is maintained throughout the complaint handling process, both as it relates to the complainant and to the subject of the complaint. Progress on complaint handling is shown to and discussed with Payatu’s impartiality committee.
Use of Payatu Name, Mark, and References to Inspection
Clients shall not use Payatu’s name, logo, inspection mark, inspection reports, certificates, or references to inspection in a misleading or unauthorized manner.Payatu has a legally enforceable arrangement with certified clients covering the following conditions of use:
- A client is authorized to use only the Inspection Mark (incorporating, as applicable, the Payatu / NABCB / IAF logo) corresponding to the applicable management system inspection scheme, and only while holding a valid certificate of conformity.
- Reference to inspection, including use of the Inspection Mark, shall only be made in relation to the actual scope inspected by Payatu, and must not imply that the inspection applies to activities or parts of the organization outside that scope.
- The Inspection Mark shall be used on the client’s letters, documents, and other promotional material. For management system inspection schemes, the Inspection Mark must not be used in a way that may be interpreted as denoting product conformity, and accordingly must not appear on a product, product packaging, product samples, or test certificates for products. Nor may Payatu’s Inspection Mark be applied to laboratory tests, calibration, or inspection reports.
- The Inspection Mark shall only be shown in its standard size and design (available from Payatu on request), shown in its entirety, and never larger than the client’s own logo.
- Payatu’s name or mark shall not be used in a way that implies product certification, regulatory approval, or endorsement unless explicitly authorized, nor in a way that brings Payatu or the inspection system into disrepute or causes loss of public trust.
- Where an inspection output is withdrawn, superseded, suspended, or amended, or where a certificate is suspended or withdrawn, the client shall immediately cease using the outdated, invalid, or all advertising matter containing a reference to that inspection, and shall modify communication and advertising materials accordingly in the case of a reduction in scope.
- Inspection outputs shall not be modified, misquoted, or used selectively to create a misleading impression. A client shall not make or permit any misleading statement with respect to its inspection status, nor allow misleading use of any inspection document or part thereof.
- The management system certified by Payatu shall not be used by a client in a way that implies Payatu has certified a product (including a service) or process, nor in any manner that gives the impression that the inspection applies to activities outside the certified scope.
Misuse of inspection outputs, status, or marks, or incorrect reference to inspection status, may result in Payatu requesting corrective action, suspension or withdrawal of the certificate, publication of the transgression, or, where necessary, legal action.
Contact Information
For enquiries regarding inspection services, complaints, appeals, or verification of inspection-related information, clients and interested parties may contact Payatu through the official communication channels published here as.
Payatu Security Consulting Pvt. Ltd.
Office no. 704 (7th floor, Sky Vista, Mhada Colony, Viman Nagar, Pune, Maharashtra 411014
Email : [email protected]
TRUSTED BY BRANDS AROUND THE WORLD
