# Selling to Indian Banks: The Security Review Your SaaS Will Face

> Updated 2026-10-25 - 9 min read

If your SaaS product is being evaluated by an Indian bank, NBFC or SEBI-regulated entity, the vendor-security review you'll face is shaped directly by regulatory obligations your buyer has to satisfy - RBI's cyber security framework, SEBI's CSCRF, CERT-In's directions. It looks different from a typical US or EU enterprise security questionnaire, and knowing what's coming saves real deal time.

## Why this review is different from a generic security questionnaire

Your buyer's own regulator holds them accountable for the vendors they use, so their review isn't generic due diligence - it's them building evidence for their own compliance file. That changes what they'll ask for and how strictly they'll enforce it.

## What's almost always asked for

- A VAPT report on your product, often required to be from a CERT-In empanelled auditor or at minimum structured in that format.
- Data localization confirmation, if any payment or sensitive personal data is involved - RBI's payment-data localization rule has no general foreign-vendor exemption.
- Evidence of ISO 27001 or an equivalent security management framework.
- Incident-reporting commitments aligned to CERT-In's six-hour window and your buyer's own regulatory timeline.
- Clarity on where data is hosted and who can access it, often with specific contractual language required.

## Where global-standard certifications help, and where they don't

SOC 2 or ISO 27001 certification is genuinely useful evidence and speeds up the conversation, but it typically doesn't fully substitute for a CERT-In-aligned VAPT report or India-specific data-localization commitments - these are usually additive requirements, not alternatives.

## What to prepare before the review starts, not during it

- A CERT-In-aligned VAPT report, refreshed within the last 12 months.
- A clear, written answer on data residency for any India-related data.
- A named point of contact and process for incident notification within the required timeline.
- Your ISO 27001/SOC 2 certification, if held, mapped explicitly to the specific controls your buyer is likely to ask about.

## FAQ

**We already have SOC 2 - why is this still so involved?**
SOC 2 is good evidence, but your buyer's own regulator (RBI, SEBI) expects specific India-context requirements - data localization, CERT-In-aligned testing, incident-reporting timelines - that SOC 2 doesn't cover by itself.

**How long should we budget for this review?**
If you prepare the core evidence (VAPT, data-residency answer, certification mapping) before the review starts rather than scrambling once it's requested, it moves significantly faster - budget weeks, not days, if starting from zero.