Security Governance Calendar

Security Governance Calendar

All recurring security and compliance activities at Buildwealth Technologies — meetings, training, drills, audits, and reviews. Calendar events live in Google Calendar. Evidence lives as GitHub Issues in wealthy/security.

Purpose

• Ensure IRDAI, SEBI CSCRF, CERT-In, and DPDP Act obligations are met on a recurring cadence
• Produce audit-ready evidence (MoMs, reports) for every activity
• Zero new tools — uses Google Workspace + GitHub already deployed

Cadence Summary

Meeting vs Activity — read this before the tables below

Every row on this calendar is either a Meeting or an Activity — and the distinction matters for how much of the team’s calendar gets consumed vs how much evidence is produced.

• Meeting = live human attendance with a Minutes-of-Meeting (MoM). Calendar slot booked.
• Activity = async work producing evidence (report, PDF, dashboard export, CSV, GitHub Issue body). No calendar slot required. May or may not involve a live call — usually doesn’t.

Both produce a GitHub Issue in wealthy/security as the immutable evidence hub. See “Evidence Chain” section below.

Framework column maps each row to a control ID in the India Compliance Framework — Wealthy’s consolidated register covering IRDAI Cyber Security Guidelines 2024, SEBI CSCRF Aug 2024, CERT-In Directions 2022, and DPDP Act 2023.

ID prefix key:

Section A — Governance Meetings (real meetings, MoM required)

Total live meetings: 9 / year (4 ISRMC + 4 ITSC + 1 Board). All others below are activities — no live meeting required, but each produces regulatory evidence.

Section B — Regulatory Activities (async, evidence-based, no MoM required)

Section C — Continuous Automated (no calendar slot — background operational activities)

Governance Meetings

G1 — ISRMC (Information Security Risk Management Committee)

• Cadence: Quarterly (changed from biannual under IRDAI 2024 amendments)
• Attendees: CISO (chair), CTO, RMC representative, Independent External Expert (IEE)
• Regulatory driver: IRDAI Guidelines 1.5(II), 1.6(13)

Standard agenda:

1. Review of open cyber incidents since last meeting
2. Status of non-conformities from last cyber audit
3. Risk register updates — top risks, treatment plan progress
4. Threat landscape — CERT-In advisories, vendor notices
5. VAPT findings and closure status
6. Policy exception approvals (CISO-tier)
7. Report to RMC on quarterly basis

Evidence: GitHub Issue with meeting:isrmc label, MoM attached, RMC brief attached.

G2 — IT Steering Committee (ITSC)

• Cadence: Quarterly
• Attendees: CTO (convener), CISO, Ops lead, Finance, Business reps
• Regulatory driver: IRDAI Guidelines 1.6(14) — new provision

Standard agenda:

1. IT strategy alignment with business needs
2. IT architecture and regulatory compliance posture
3. SLA and SOW compliance review
4. BCP and DR effectiveness
5. Policyholder data protection controls
6. IT procurement and SaaS subscriptions requiring CISO input
7. Update for RMC and CEO

Evidence: GitHub Issue with meeting:itsc label, MoM attached, RMC/CEO brief attached.

G3 — Board Cyber Review

• Cadence: Annual
• Attendees: Board of Directors, CISO, CTO, IEE
• Regulatory driver: IRDAI Guidelines 1.6(1) — Board responsibilities

Standard agenda:

1. Annual cyber audit report
2. Non-conformities and 12-month closure plan approval
3. Cyber budget approval for next FY
4. Risk appetite review
5. Major incidents of the year

Evidence: Board minutes with cyber agenda item, signed closure plan.

G4 — Vendor / Third-Party Risk Review

• Cadence: Annual
• Attendees: Procurement, CISO, Legal
• Regulatory driver: IRDAI (B6), SEBI Annexure-F

Checklist per critical vendor:

• NDA current, covers privacy / security / BC
• Data elimination clause present (for CSPs)
• Subcontracting permission clause present
• SLA within regulatory requirements
• Last audit / certification reviewed
• MeitY empanelment verified (CSPs)
• STQC audit status verified (CSPs)

Evidence: GitHub Issue with meeting:vendor label, vendor register attached.

Training

T1 — Security Training Programme

One annual programme covering everyone, with a common track for all staff plus role-specific tracks bolted on for those who need them. Keeps the calendar to a single event per year instead of two separate series.

• Cadence: Annual, plus mandatory on joining, plus ad-hoc (e.g. post-incident retraining, new regulation rollout, major control change)
• Duration: 90–120 minutes total — 45 min common + 45–75 min role track
• Owner: CISO + HR

Common track (all staff):

• Phishing recognition
• Password hygiene and MFA
• Device hardening (Mac/Windows)
• Data classification and handling
• DPDP Act obligations
• Incident reporting process
• Physical security and social engineering

Role-specific tracks (attend the one that matches your role):

Regulation: Indian regulations (IRDAI 2024, SEBI CSCRF, DPDP Act) require “regular” / “periodic” training without prescribing cadence or separating generic from role-specific. Annual + ad-hoc with role tracks satisfies all.

Evidence: Attendance list (common + role tracks), training decks, signed acknowledgment from each employee. GitHub Issue with training label plus role tag.

T2 — Phishing Simulation

• Cadence: Half-yearly, plus ad-hoc campaigns (e.g. after a real phishing incident, after a new joiner cohort, or when a new attack theme is trending)
• Duration: Asynchronous (campaign runs over 1 week)
• Owner: CISO
• Regulation: No Indian regulation prescribes a phishing-sim cadence — “regular” / “periodic” is the bar (IRDAI 2024, SEBI CSCRF, DPDP, ISO 27001 A.7.2.2). Half-yearly + ad-hoc is the chosen floor; cadence is raised if click rate or repeat-offender rate exceed POL-025 targets.

Metrics tracked:

• Click rate
• Credential entry rate
• Reporting rate (good signal — people recognizing and flagging)

Follow-up:

• Individual coaching for repeat clickers
• Awareness training content updates
• Report to ISRMC

Evidence: GitHub Issue with phishing-sim label, campaign report attached.

Operational Reviews

O1 — Quarterly Access Review

• Cadence: Quarterly
• Attendees: CISO, DevOps, HR
• Regulatory driver: IRDAI (C5), SEBI

Systems reviewed:

• GCP IAM (all projects)
• AWS IAM
• Google Workspace
• GitHub org (wealthy)
• Wazuh Dashboard
• CloudSQL
• Cloudflare
• Any new system added in the quarter

Output:

• Users to be removed (stale)
• Roles to be downgraded (over-privileged)
• Privilege escalations to review

Evidence: GitHub Issue with access-review label, CISO sign-off on actions taken.

O2 — Privileged Access Verification

• Cadence: Weekly
• Duration: 15 minutes
• Owner: CISO or on-call
• Driver: SEBI CSCRF (C4)

Simple weekly check: log into GCP/AWS IAM audit, confirm no unexpected privileged access grants in last 7 days. One-line GitHub Issue update each week.

Evidence: GitHub Issue with access-review + weekly checklist ticked.

O3 — Threat Hunting Exercise

• Cadence: Quarterly
• Duration: 3 hours
• Owner: Security team
• Driver: SEBI CSCRF Annexure-N Domain 5

Structure:

• Test 1 hypothesis based on open vulnerability
• Test 1 hypothesis based on known IoC
• Test 1 hypothesis based on known TTP (IoA)

Query Wazuh, GCP, AWS, GitHub, endpoint logs. Document findings. Create new SIEM rules if gaps identified.

Evidence: GitHub Issue with threat-hunt label, hypotheses + findings + new rules.

O4 — SOC Efficacy Review (Annexure-N)

• Cadence: Half-yearly
• Signed by: MD / CEO / Board member
• Driver: SEBI CSCRF mandatory

Full 5-domain scoring per SEBI Annexure-N:

• Asset Coverage (25%)
• SOC Operations (25%)
• Personnel Competency (20%)
• SOC Governance (15%)
• SOC Enrichments (15%)

Evidence: Signed PDF report, GitHub Issue with soc-efficacy label. Kept on file for SEBI audit.

DR & Resilience

D1 — DR Drill

• Cadence: Half-yearly
• Duration: 2 hours
• Attendees: DevOps, CTO, CISO
• Driver: IRDAI (I4), SEBI Annexure-C

Rotate scenarios:

• CloudSQL restore from backup
• Application failover to DR region
• Full region failover
• Ransomware recovery drill

Metrics captured: Actual RTO vs target, actual RPO vs target, issues encountered.

Evidence: GitHub Issue with dr-drill label, timeline + RTO/RPO achieved + CTO/CISO sign-off.

D2 — Backup Integrity Verification

• Cadence: Monthly
• Duration: 30 minutes
• Owner: DevOps

Pick one backup at random. Restore to isolated test environment. Verify data integrity. Document result.

Evidence: GitHub Issue with dr-drill label, restore test result.

Audit & Testing

A1 — VAPT (Grey/White box PT)

• Cadence: Half-yearly (changed from annual black-box under IRDAI 2024)
• Auditor: Must be CERT-In empaneled
• Driver: IRDAI (G1) — updated to grey/white box half-yearly

Scope:

• Internet-facing applications
• Internal applications
• Network devices
• Cloud infrastructure

If test env used instead of prod: ISRMC must approve, and test env must resemble production in version and configuration.

Closure target: All findings closed within 12 months per IRDAI Board mandate.

Evidence: GitHub Issue with vapt label, auditor report, closure tracking against 12-month target.

A2 — Annual Cyber Audit

• Cadence: Annual
• Auditor: CERT-In empaneled
• Driver: IRDAI (G4), SEBI

Scope:

• IRDAI Cybersecurity Guidelines 2024 — Annexure-III checklist
• SEBI CSCRF compliance
• ISO 27001 (if certified)

Post-audit actions:

• Board submission of findings
• 12-month closure plan approved by Board
• Annexure-III submission to Insurer/s within 30 days

Evidence: GitHub Issue with cyber-audit label, auditor report, Board resolution, closure plan.

A3 — Annexure-III Submission to Insurer

• Cadence: Annual (within 30 days of cyber audit completion)
• Driver: IRDAI (G6) — new provision 2024

Document pack:

• Annexure-III completed checklist
• Board / RMC / Principal Officer comments
• CERT-In empaneled auditor report

Evidence: GitHub Issue with annexure-iii label, submission confirmation from Insurer.

Calendar Setup — Step by Step

1. Create the shared calendar

Google Workspace Admin
→ Calendar → Create shared calendar
→ Name: "Wealthy Security & Compliance"
→ Owner: CISO
→ Write access: CISO, CTO, RMC members, Compliance Officer
→ Read access: All staff (for training events only)

2. Create recurring events

For each row in the Cadence Summary table, create a recurring event. Example:

• Event name: “ISRMC Quarterly Meeting”
• Frequency: Every 3 months
• Reminder: 2 weeks before
• Description: Link to this doc + agenda template link
• Invitees: Permanent attendee list per role

3. Color coding

• Blue — Governance meetings (ISRMC, ITSC, Board, Vendor)
• Green — Training (all staff awareness, phishing sim, role-specific)
• Red — Technical (DR drills, VAPT, threat hunting)
• Orange — Operational reviews (access review, SOC efficacy)

4. Annual refresh

At year-end (December), review the calendar:

• Check all events fired on time
• Update attendee lists (role changes, new hires)
• Add any new frameworks that came into force

Evidence Chain — Mandatory for Every Governance Activity

Rule: every governance event on this calendar produces an evidence record. No exceptions. An activity without an evidence trail is equivalent to it not having happened in an audit.

Evidence lives as a GitHub Issue in wealthy/security using the matching template under .github/ISSUE_TEMPLATE/. The Issue is the hub — all artefacts attach to it or link from its body. Issue stays open until sign-off checklist complete, then closed → becomes immutable audit evidence (GitHub retains closed Issues indefinitely with full edit history).

Minimum evidence required for every meeting

Every meeting-type event (ISRMC, ITSC, Board, Vendor, Training, Review) MUST produce at minimum:

1. Minutes of Meeting (MoM) — attached to the GitHub Issue as a PDF or a Google Doc link. Includes: date, attendees (names + roles), agenda, decisions, action items with owners + deadlines.
2. Attendance list — either inline in the MoM or a separate CSV/Sheet. Required for training / attendance-gated activities.
3. Artefacts discussed — PDF exports of any Sheet / Doc reviewed during the meeting (e.g. risk register snapshot, vendor register, access-review report). Attach to the Issue.
4. Sign-off confirmation — last comment on the Issue from the designated reviewer (CISO / CTO / Board Chair) explicitly confirming closure.

Additional evidence (attach whatever is available)

• Meeting recordings — if Google Meet “Record meeting” is enabled, the MP4 auto-lands in Drive. Link it from the Issue body. Do NOT attach video directly (size limits) — link to Drive with view permission for auditors on request.
• Screenshots — before / after states for config changes, dashboards showing metrics reviewed, etc.
• Tool exports — Wazuh alert exports, Gophish campaign CSVs, Classroom completion dashboards, access-review CSVs from IAM.
• Signed documents — any point-in-time artefact requiring sign-off (Annual Risk Assessment Report, Board resolution, closure plan, CERT-In submission receipt) — PDF with signatures attached to the Issue (see Risk Register for the typed-name + version-history flow on Business Starter).
• External auditor reports — VAPT report, external cyber audit report, Annexure-III filing receipt.
• Communications — copies of security bulletins sent, partner notifications, customer comms.

Why GitHub Issues (not Drive folders)

• Immutable per-event audit trail — once closed, edit history preserved
• Label + search queries make auditor evidence requests trivial (see example below)
• Cross-references (mentions of PRs, commits, other Issues) give full context
• Can be exported in bulk per label for handover
• Access-controlled (private repo) — auditor gets read-only access, no risk of tampering

Labels — one per event type

Closure checklist (every Issue)

Every Issue uses its template’s sign-off checklist. Minimum items to tick before closing:

• MoM / report attached
• Attendance list recorded (if meeting)
• Action items created as follow-up Issues (if any) and linked
• Artefacts discussed attached or linked
• Reviewer sign-off comment posted
• Next-event date scheduled (for recurring events)

Auditor evidence query (example)

1# "Show me last 4 ISRMC meetings"
2gh issue list --repo wealthy/security --label meeting:isrmc --state closed --limit 4
3
4# "Show all security training from 2026"
5gh issue list --repo wealthy/security --label training --search "created:2026-*"
6
7# "Show all DR drills"
8gh issue list --repo wealthy/security --label dr-drill --state closed

Roles & Ownership

Framework Coverage Summary

This calendar alone closes the following regulatory obligations:

Related Documents

• CERT-In Compliance Policy
• Cyber Crisis Management Plan (POL-005)
• Disaster Recovery Policy (POL-012)
• Business Continuity Policy (POL-002)
• VAPT Execution SOP
• Incident Response SOP

Owner: CISO Review cycle: Annual (or on regulatory change) Last reviewed: 2026-04-22