Security Audit Firms Categorization

Keeping in view rapidly increasing security threats, PTA Authority issued Critical Telecom Data and Infrastructure Security Regulations (CTDISR) on 8th September 2020 and directed all PTA licensees to implement CTDISR controls by July 2021, to give licensees sufficient time to allocate budget and deploy necessary security controls for compliance. Similarly, PTA directed all licensees to conduct 3rd Party Audits from PTA’s approved Cyber Security Audit Firm.

Since audit companies have grown to a reasonable number therefore, there was need to standardize the audit firms. PTA in this regard prepared Cyber Security Audit Firms Criteria after going through extensive due-deliberation and consultation process with Telecom operators and Security Audit firms. Upon which, several security firms had submitted applications to PTA. Upon assessment of documents in the light of the approved Cyber Security criteria appropriate categories were assigned.

Following is the list of firms listed in accordance with their categories. This list will be constantly updated, as new firms are approved, or categories of existing firms are elevated:

It is imperative to mention here that, as per approved Cyber Security audit criteria, audit firms can perform audit of their respective categories or downward in the hierarchy. For instance, firms qualifying for Cat-I, can also perform audit of licensees falling under Cat-II to Cat-IV. Similarly, firms qualifying for Cat-II, can also perform audit of Cat-III and Cat-IV, however, firms qualifying for Cat-IV cannot perform audit of licensees upward in the hierarchy i.e. Cat-III to Cat-I.