Governance gap
Responsibility is unclear, so decisions, escalation and evidence arrive late.
CA-led cybersecurity & data protection
Compliance that stands up to an audit and an attack.
MERA KAVACH combines Chartered Accountant-led governance, Indian regulatory readiness and hands-on security implementation for organisations that cannot afford superficial compliance.
No generic checklistNo software sales pitchPractical exposure view
MERA KAVACH / CONTROL SIGNALACTIVE
Data→Identity→Systems→Vendors→AI→Governance
DPDP ACT 2023CERT-InISO/IEC 27001ISO/IEC 42001NIST CSF 2.0
Framework references indicate advisory alignment and service capability. They do not imply endorsement by authorities or standards bodies.
Threat reality
Exposure rarely stays inside one department.
Identity, data, vendors, recovery and employee decisions interact. This build publishes no unverified headline statistics; every external fact must trace to a current authoritative source.
Control gap
A policy exists, but access, recovery, deletion or monitoring has not been tested.
AI visibility gap
Teams use public AI before approved data boundaries and permissions exist.
Five equal pillars
One control environment. Five connected disciplines.
Start with the trigger you can see. Then trace the dependencies that create the real risk.
Digital Data Protection
Turn personal-data obligations into owned, evidenced workflows.
DPDP readinessData mappingRights & consent
AI-Era Risk
Govern public models, retrieval, agents, tools and human approval without blocking useful adoption.
Shadow AIPrompt injectionISO 42001
Corporate & IT Security
Validate identities, endpoints, cloud, monitoring, resilience and incident readiness.
MFA & accessRecoveryCERT-In
Certifications & Assurance
Build a working management system before certification evidence is tested.
ISO 27001ISO 27701SOC 2 readiness
Personal Cybersecurity
Protect founders, directors, senior employees and high-risk family members.
Account hardeningDeepfake defenceRecovery
A client asked for ISO 27001
Define scope, gaps, risk, evidence, internal audit and certification coordination.
We collect data but have no map
Start with Digital Data Protection and a bounded data-inventory sprint.
Employees use public AI
Map tools, information classes, vendors, permissions and approval controls.
MERA KAVACH Framework
From exposure to operating discipline.
A serious methodology: Know, Assess, Validate, Correct and Hold.
Know
Map data, people, systems, vendors, obligations and dependencies.
Assess
Identify regulatory, technical, contractual, operational and human risk.
Validate
Test whether policies, configurations, backups and workflows work.
Correct
Implement proportionate, risk-ranked improvements with accountable owners.
Hold
Monitor, train, review, test and improve continuously.
| Dimension | What is captured | Management evidence |
|---|---|---|
| Inputs | Interviews, records, architecture, contracts, incidents and dependencies | Approved scope and source register |
| Activities | Mapping, risk analysis, testing, remediation and training | Test records, decisions and exception approvals |
| Outputs | Risk view, control set, action plan and evidence register | Named owners, due dates and review criteria |
| Review | Event-driven checks plus planned management review | Minutes, metrics, incidents and improvement actions |
DPDP readiness check
Twenty practical questions. A weighted action plan.
Governance, visibility, notice, rights, vendors, retention, safeguards, breach readiness, training and evidence.
0/100
Top three priorities
Seven days
Confirm accountability, protect critical identities, preserve evidence and agree urgent actions.
30 days
Complete data and vendor visibility, close notice/workflow gaps and test breach escalation.
90 days
Embed controls, training, monitoring, management review and a repeatable evidence cycle.
Unlock your detailed report
DPDP Act reference hub
From legal text to working controls.
A substantive educational overview for Indian organisations, not a superficial sales page.
General educational information, not legal advice. Applicability depends on facts, sector regulation, contracts and current government notifications. Commencement and subordinate requirements must be checked against current official sources.
What it covers
The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data while recognising individual protection and lawful processing. Territorial reach can extend to certain processing outside India connected with offering goods or services to people in India.
Key roles
- Data Principal: the individual concerned
- Data Fiduciary: determines purpose and means
- Data Processor: processes for a Data Fiduciary
- Consent Manager: registered consent-management point
- Significant Data Fiduciary: notified status; never assume designation
Primary reference: MeitY: Digital Personal Data Protection Act, 2023. Verify the latest Gazette notifications before publication.
AI security hub
What your team thinks it is doing and what may leave your control.
Visibility first. Then data boundaries, permissions, human approval and evidence.
What the team thinks it is doing
- Summarising a client agreement
- Cleaning a customer spreadsheet
- Uploading a board presentation
- Connecting an assistant to email
- Generating sales outreach
- Asking an agent to update records
What may be leaving control
- Personal and confidential information
- Authentication tokens and internal instructions
- Client documents and sensitive prompts
- Embedded malicious instructions
- Excessive agent permissions
- Unsafe output copied downstream
Interactive exposure map
User → prompt → model → action.
Shadow AI
Map tools, uploads, connectors and departmental use before policy design.
Prompt & retrieval attacks
Treat instructions inside external content as untrusted input.
Agent authority
Bound tools, permissions, transaction values and irreversible actions.
AI procurement
Assess provider terms, data handling, security, monitoring and exit risk.
Deepfake defence
Verify high-risk instructions through independent channels.
ISO/IEC 42001
Build an accountable AI management system. MERA KAVACH does not issue accredited certificates.
Representative scenarios
Engagement structures, not invented client claims.
Each scenario remains clearly illustrative until replaced with approved client evidence.
SaaS DPDP readiness
Challenge: enterprise diligence without a dependable data map.
Approach: map processes and processors; establish rights, retention and evidence ownership.
Example deliverables: data map, processor review, response workflow and roadmap.
MSME cyber hardening
Challenge: limited visibility over critical accounts, endpoints and recovery.
Approach: prioritise identity, endpoint baselines, backup testing and incident preparation.
Example deliverables: control baseline, exception register and recovery evidence.
AI governance
Challenge: public AI adoption without approved data or vendor boundaries.
Approach: map use, classify information, assess vendors and constrain actions.
Example deliverables: use policy, model register, risk review and approvals.
Research desk
Useful resources, ready inside this website.
Each article opens as a complete page view inside this single HTML website.
DPDP Act Readiness Checklist for Indian MSMEs
A practical sequence from uncertain scope to owned controls.
MERA KAVACH Research Desk
Build a Data Inventory Without Buying a New Tool
Start with business processes, not software procurement.
MERA KAVACH Research Desk
The First Hour After a Business Email Compromise
Contain access, preserve evidence and control payment risk.
MERA KAVACH Research Desk
Shadow AI and Confidential Data Leakage
Find where public AI use meets client information.
MERA KAVACH Research Desk
ISO 27001 Evidence Auditors Actually Ask For
Turn policy statements into repeatable operating evidence.
MERA KAVACH Research Desk
Cybersecurity for Directors and Promoter Families
Protect the personal identities attackers use to reach the business.
MERA KAVACH Research Desk
About MERA KAVACH
Governance discipline. Security implementation. One accountable view.
Compliance without implementation fails. Security without accountability fails. AI changes both.
Firm philosophy
Assess reality. Rank risk. Implement proportionate controls. Test them. Give management evidence it can use.
Values
Accuracy, independence, proportionality, confidentiality and plain-speaking accountability.
CA-led approach
Connect regulatory interpretation, audit discipline, management ownership and practical security engineering.
Team & credentials
[ADD VERIFIED DIRECTOR AND TEAM PROFILES]
No qualifications, awards, client history or experience claims have been invented.
Independence
Recommendations should follow risk and evidence. Conflicts must be disclosed and managed before scope acceptance.
Tool-vendor neutrality
Technology should follow a documented need, fit assessment, security review and total operating responsibility.
Contact
Start with scope, urgency and the next decision.
Do not submit passwords, OTPs, private keys, payment-card details or highly sensitive incident evidence.
A practical first step
Find the gaps before an auditor, attacker, client or regulator does.
The first discussion identifies scope, urgency and the right next action. It is not a software sale.