For CEOs, CFOs, CROs and CISOs · India
You answer to RBI, SEBI and IRDAI and the board. Your GRC lives in spreadsheets.
Sastrum puts risk, compliance and audit on one record, with RBI CSF, SEBI CSCRF, CERT-In directions and the DPDP Act already mapped, at a size and price that fits a co-operative bank, NBFC, microfinance lender, insurer or broker.
Your situation
The regulator's list is long. Your team is not.
Problems
- A new circular or standard every quarter, and a register that cannot keep up.
- Risk in one spreadsheet, compliance in another, audit findings in email.
- RBI, SEBI, IRDAI and CERT-In issue circulars faster than the team can map them, and the board sees several versions of the truth.
Needs
- One view of risk and compliance across the firm, in RBI, SEBI and IRDAI's own terms.
- Reports in the format the regulator and the board expect, without a scramble.
- A cost and a project size that fit a firm your size.
Desires
- Walk into the board meeting and the inspection with a dashboard, not a binder.
- Know today, not at year end, where the gaps are and who owns them.
What you would love
- The next circular is already mapped before anyone asks.
- A regulator's request answered the same day, from the system, with the trail attached.
Three things that are different
Built the way a regulator reads it, sized the way you buy it.
- 01
Risk-first, as RBI reads it.
Onboarding starts with a risk profile scoped to your sector and RBI CSF, SEBI CSCRF, CERT-In directions and the DPDP Act, and compliance follows from it. Most GRC tools start from a checklist; Sastrum starts from what could go wrong at your firm.
- 02
Sized for a small team.
Enterprise GRC without the enterprise project. Packs for your regulator make implementation configuration, not a build, and Lumina drafts policies and controls for a named person to sign.
- 03
A record the regulator can trust.
Maker, checker and head of department on every change, an immutable audit trail, and dashboards for each leadership role. SecurEyes, the company that built Sastrum in India, stands behind the product.
Coverage for India
Your regulators and standards, already mapped.
RBI CSF, SEBI CSCRF, CERT-In directions and the DPDP Act are mapped to controls, risks, policies and audit tests, alongside the global standards your auditors ask about. The chip colour says whether each is in the product today or comes as a content pack.
Your regulators
Frameworks for you
- RBI CSF
- SEBI CSCRF
- CERT-In directions
- DPDP
- MeitY
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Co-operative banks, NBFCs, microfinance lenders, insurers and brokers
RBI CSF, SEBI CSCRF, IRDAI, DPDP, CERT-In
Why this matters now
The cost of getting it wrong is public.
Indian figures, each linked to its source.
353
penalties imposed by the RBI on banks and other regulated entities in FY25
₹25.5 cr
average cost of a data breach in India, 2026
₹250 cr
maximum penalty under the DPDP Act
6 hours
to report a cyber incident to CERT-In
Thirty minutes, opened on your regulators.
We open the demo on an Indian risk universe scoped to RBI, SEBI and IRDAI. Bring your register; we will show you where it lands.