Regulatory Traceability

Regulatory Traceability Matrix

Every Regulation 2–17 clause, plus the First and Second Schedules, mapped to a NXT GRID module and its coverage type — no orphan requirement (Section 14).

10Software
14Software + External
5Software + Infrastructure
1Software Record Only
30 of 30
RegulationRequirement CoverageNXT GRID ModuleCoverage Type
2Applicability by entity/type/capacity; vendor applicabilityApplicability EngineImplemented
4(3)Comply with CSIRT-Power directions/guidelinesRegulatory Update CenterExternal Dependency
5(1)-(8)CISO/Alternate designation, reporting, tenure, public contacts, trainingOrg/CISO ModuleExternal Dependency
5(9)24x7 India Information Security Division, staffing/certification/training/tenureISD Workforce ModuleExternal Dependency
5(10)-(11)Cyber Security Policy + CCMP approval/review/vettingPolicy Studio / CCMPExternal Dependency
5(12)-(15)CII separation, perimeter controls, web/app security devices and audit clearanceNetwork/Web Security GovernanceEvidence Valid
5(16)-(17)Critical classification and remote accessAsset Register / Remote AccessImplemented
5(18)Six-monthly awareness/exercisesTraining & ExercisesExternal Dependency
5(19)India-resident encrypted sensitive dataData GovernanceExternal Dependency
5(20)Vendor SLA/NDA/personnel risk/breach actionVendor ComplianceImplemented
5(21)Online/offline critical backupsBackup GovernanceEvidence Valid
5(22)-(24)Annual cyber audit, IT procurement compliance, ISO/TCCAudit & CertificationExternal Dependency
5(25)-(26)Asset register; cyber risk assessment/mitigationAsset / RiskImplemented
5(27)-(31)Pre-commissioning audit/VAPT; CSIRT info; NCIIPC/Protected; non-discoverability; FAT/SATCommissioning / Audit / CII / FAT-SATExternal Dependency
5(32)-(39)Time sync, training, physical/logical separation, IR plan, monitoring, logs, annual perimeter review, trusted sourceTime/Training/Network/IR/SecOps/VendorEvidence Valid
5(40)-(42)IT Act obligations, vulnerability disclosure, incident registerRegulatory / Vulnerability / IncidentExternal Dependency
6(1)-(9)OT isolation, perimeter controls, dedicated channels, remote ops, compliant/trusted OT equipment, segmentation, inter-entity channel securityOT Network & Remote OperationEvidence Valid
7(1)-(3)CISO qualifications/functions, reporting, reviews, threat intel, retention, patches, IPs, random tests, policies/registers/time syncCISO WorkspaceExternal Dependency
8(1)-(33)All required Cyber Security Policy contents/proceduresPolicy Studio linked to modulesImplemented
9CCMP detailed SOP, crisis criteria/scenarios, roles/comms, mitigation/recoveryCCMPImplemented
10Crisis communications, annual tests, post-crisis report/share/updateCrisis Exercise & After ActionExternal Dependency
11(1)-(7)Vendor recovery, signed/authenticated patches, integration requirements, EOL, BOM, hardening, vulnerability processVendor PortalExternal Dependency
12(1)-(3)DGR vendor India data residency, secure mutual auth/encryption, trusted-source infoDGR Vendor ComplianceEvidence Valid
13(1)-(3)Audit scope, prior finding closure, 6-week report and remediation deadlinesAudit WorkspaceExternal Dependency
14(1)-(2)CISO audit review, closure report, board reporting, third-party verification readinessAudit WorkspaceExternal Dependency
15Annual self-audit, closure before next audit, verification readinessSelf AuditImplemented
16Potential statutory proceedingsRegulatory record/notice registerNot Applicable
17Relaxation ordersRegulatory exception/waiver registerImplemented
First ScheduleRetention of 12 categories of documents/informationEvidence VaultImplemented
Second SchedulePrior-audit software update criteriaChange/Patch ClassifierImplemented