Choose your security architecture — and write down why.

NIST names them in SP 800-160 Vol. 1 Rev. 1, Appendix H.4.3: findings and recommendations (AR-3.3), agreement on the security aspects of the architecture (AR-4.1), a record of key decisions and the rationale (AR-4.2), traceability (AR-4.3), showing which requirement each control answers, and baseline artifacts (AR-4.4). No score, maturity level or percentage is on the list.

Some of it, eventually: NIST's zero trust planning guide, CSWP 20 of 6 May 2022, says some changes "may involve the purchase and deployment of new infrastructure". But the first work is produced, not bought: the survey NIST SP 800-207 leaves with you, the inventory and network diagram SEBI already requires, the trade-offs RBI wants written down, and the 56 of 153 CIS Safeguards in IG1. Your own people can start all four.

Three SEBI texts bear on it, and they differ. PR.AA (identity and access) Standard 4 of the CSCRF says "follow Zero Trust Model", with no definition. A PR.AA guideline, applicability "MIIs and Qualified REs (Mandatory)" (market infrastructure institutions and qualified regulated entities), denies access to critical systems by default. SEBI's 28 August 2025 circular replaced it with suggested strategies approved by the IT Committee. The framework's 205 pages never cite NIST SP 800-207, so you reconcile from SEBI's own words. NIST calls its own seven tenets "the ideal goal", adding that not all may be fully implemented.

No, and the refusal is NIST's. SP 800-160 Vol. 1 Rev. 1 says Appendix E's thirty principles should not be "used as a basis for making judgments on conformance", and that they may conflict. NIST's criteria are the four in Table 3, which give findings, not a rating.

RBI names none; choosing and recording is the work. As checked on 10 September 2026, access differs: NIST SP 800-160, SP 800-207 and CSWP 20 are direct PDF downloads from nvlpubs.nist.gov; the TOGAF Standard (an enterprise architecture framework) redirects to an Open Group login; the white papers index of SABSA (a security architecture method) is "restricted to members only", though ten named documents are free on request. Internal use of SABSA is "Free to use with brief copyright citation", but training on it needs the SABSA Institute's "prior written consent".

RBI has issued separate sets since 31 July 2026; check paragraph 3 of yours. The commercial banks set covers banking companies, corresponding new banks and the State Bank of India as the Banking Regulation Act, 1949 defines them, but not local area banks. Small finance banks, payments banks, Credit Information Companies, the five All India Financial Institutions and non-banking financial companies (NBFCs) have their own sets; the NBFC set puts the architecture duty in Chapter V, which covers only the Top, Upper and Middle Layers, not Core Investment Companies. Foreign banks in branch mode take paragraph 4's comply-or-explain route, where a deviation is "subject to examination and acceptance by RBI of a reasonably justifiable explanation". RBI's circular DoS.CO.PPG.66/11.01.005/2026-27 of the same date lists the 2016 Cyber Security Framework in Banks and the 2023 IT Governance Directions among the circulars it repealed.

No on both counts. This is advisory work: no audit under section 70B of the Information Technology Act, no certificate or attestation, and SecWiz is not a CERT-In empanelled auditing organization. Where a regulator requires one, the work goes to a firm that holds the empanelment. You get evidence and a decision record for your own named body to approve; the obligation stays with you.

Not in this engagement: it is bounded advisory work in business hours, with no monitoring. SecWiz does not operate a security operations center. Where a managed security retainer includes security monitoring, its coverage hours and escalation path are agreed in writing; see managed security services. The duty stays with you: RBI's paragraph 143 says a bank "shall set up a CSOC to ensure continuous surveillance", paragraph 28(4) places the SOC in the bank's own CISO office, and Rule 6(1)(c) of the DPDP Rules, 2025 puts log visibility on the Data Fiduciary.