For heads of IT, IT risk and security · India
You will run it. You do not want to build it.
Sastrum runs as SaaS, in your own cloud account or in your data centre, with the AI model you choose, roles and approval chains you configure in the browser, and a record that answers the RBI Cyber Security Framework questions without a project.
Your situation
Every GRC tool promises integration. You end up owning the glue.
Problems
- Controls, evidence and policies sit in tools that do not talk to each other, and you are the one asked to reconcile them.
- the RBI Cyber Security Framework wants evidence that is current; what you have is a folder from the last audit.
- CERT-In wants an incident reported within six hours, and the DPDP Act adds breach notice on top of the sector rules.
Needs
- A deployment choice that fits the policy: SaaS, your own cloud account, or on-premise, the same product in each case.
- Roles, separation of duties and approval chains you configure yourself, without a change request to the vendor.
- A way to load what you already have: registers, controls and incidents, by file, not by re-keying.
Desires
- An AI assistant that drafts controls and policies but never publishes without a named approver.
- An audit trail you can hand to the auditor as it is, filtered by module, actor and date.
What you would love
- A system the business runs itself, where you are consulted and not paged.
- Sensitive work routed to a model inside your perimeter, and everything else to the cloud, by rule.
Three things that are different
Yours to run, not yours to build.
- 01
Deploy it your way, including the AI.
SaaS, private cloud in your account, or on-premise with the models inside. Hosting in an Indian region is stated in the contract, and the on-premise option keeps everything, including the AI models, inside the country. Per-task routing keeps high-sensitivity work on the model you choose; keys are encrypted at rest and masked on screen.
- 02
Configure, do not customise.
Nine permission areas, custom roles from a permission matrix, conflict rules for separation of duties, and review chains and templates set in the browser. What you change is recorded, not patched.
- 03
A record built for the RBI Cyber Security Framework.
Every change in an immutable trail, including requests to Lumina. Maker, checker and head of department on every approval, with an SLA clock, so the evidence for the auditor is the system itself.
Coverage for India
The standards you are measured against, already mapped.
RBI CSF, SEBI CSCRF, CERT-In directions and the DPDP Act are mapped, alongside ISO 27001 and the other global standards your controls already follow. The chip colour says whether each is in the product today or comes as a content pack.
Your regulators
Frameworks for you
- RBI CSF
- SEBI CSCRF
- CERT-In directions
- DPDP
- MeitY
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Co-operative banks, NBFCs, microfinance lenders, insurers and brokers
RBI CSF, SEBI CSCRF, IRDAI, DPDP, CERT-In
Why this matters now
The obligations are dated and the penalties are public.
Indian figures, each linked to its source.
353
penalties imposed by the RBI on banks and other regulated entities in FY25
₹25.5 cr
average cost of a data breach in India, 2026
₹250 cr
maximum penalty under the DPDP Act
6 hours
to report a cyber incident to CERT-In
Bring your questions. We open on the admin console.
Sixty minutes with the product team: the role matrix, the approval chain, the audit trail, model routing and the deployment options, on a sample Indian tenant.