UIDAI AUA/KUA Audit - RNR Consulting

Overview

Getting enrolled with UIDAI will enable organizations to provide E-KYC and Aadhaar based authentication. Becoming an Authentication User Agency (AUA) is required for any agency/institution registered in India, which is looking to use Aadhaar authentication services of UIDAI. It is also a requisite step in registering as KYC User Agency (KUA) for using the Aadhaar eKYC service, the instantaneous pre-ratified Aadhaar based KYC solution.

UIDAI Guidelines

As per UIDAI Guidelines, the client application is to be audited by the information systems auditor(s) certified by CERT-IN and compliance audit report to be submitted to UIDAI.

CERT-IN (Computer Emergency Responses Team – India) is the Central Nodal Agency responsible for any Computer Security Incidents in the Indian subcontinent. The empanelled auditors will assess the information security risks and determine the effectiveness of information security controls over information resources and assets that support operations in the auditee organizations on their request. As a part of any audit, the auditors may interview key personnel, conduct vulnerability assessments & penetration testing, catalogue existing security policies and controls, and examine IT assets.

Why is UIDAI Compliance Audit Required?

AUAs / KUAs shall ensure that their operations are audited to ensure UIDAI compliance by an information systems auditor certified by a recognized body atleast annually The audit report shall be shared with UIDAI upon request.

UIDAI has recently updated the AUA audit guidelines. There have been various changes including obtaining consent, transparency and purpose limitation, amongst others. AUAs/KUAs shall ensure that their operations are audited by an information systems auditor certified by a recognised body on an annual basis and on a need basis to ensure compliance with UIDAI standards and specifications. The audit report shall be shared with UIDAI upon request.

What We Deliver ?

It’s an important practice that gives organizations visibility into real-world threats to your security. As part of a routine security check, penetration tests allow you to find the gaps in your security before a hacker does by exploiting vulnerabilities and providing steps for remediation.