ISO 27001 Certification Audit for a Leading Payment Gateway Service Provider & Its Global Subsidiaries

This case study explores how QRC supported an ISO 27001 certification audit for a leading Indian payment gateway service provider and its seven global subsidiaries. Regional requirements, complex IT environments, and differing levels of security maturity made consistent information security governance a key challenge. The engagement assessed the parent organization’s Information Security Management System and the controls operating across its subsidiaries. Key areas covered included:

• ISMS documentation, risk assessments, and certification scope
• Subsidiary-specific security and regulatory requirements
• Access controls, incident management, and business continuity
• Central oversight and consistency of security practices
• Corrective-action reviews and certification audit evidence

The engagement helped the organization address compliance gaps and strengthen information security across its global operations. The case study describes how coordinated audits, tailored recommendations, and follow-up assessments supported ISO 27001 certification and more consistent protection of financial and customer information.