Insights
Practitioner notes on offensive security, compliance, and infrastructure from Kathmandu.
ISO 27001 Certification in Nepal: Process, Timeline Drivers and Choosing a Certification Body
A practical guide to ISO 27001 certification in Nepal: how the process runs, what drives the timeline, and how to check a certification body before you sign.
Read article →ISO 27701 and Nepal's Individual Privacy Act, 2075
How ISO 27701 in Nepal helps organizations manage personal data, what changed in the 2025 edition, and how to approach privacy compliance under the 2075 Act.
Read article →IT and Information Security Expectations for Insurers Regulated by NIA
What Nepal Insurance Authority's directives expect from insurers on IT, cyber risk and MIS audit, and a checklist for insurance cybersecurity in Nepal.
Read article →NRB IS Audit: What Nepal's Banks and Financial Institutions Should Prepare
What Nepal Rastra Bank's IT Guidelines and Cyber Resilience Guidelines expect from an NRB IS audit, and a checklist banks can use to prepare evidence.
Read article →VAPT in Nepal: Scoping, What a Good Report Contains, and VAPT vs Red Team
How to scope VAPT in Nepal, what a useful penetration testing report contains, and when a red team exercise is the better choice.
Read article →vCISO for Regulated Institutions in Nepal: When It Makes Sense
What NRB expects of an information security officer and CISO, when a vCISO in Nepal helps a regulated institution, and when it does not.
Read article →From NIST CSF Profile to ISO 27001 Certificate: The Triggers That Should Move a Fintech
A fintech should not certify on a calendar. It should certify when its customers' regulators start asking it for third-party assurance a self-assessment can't give. Here are the triggers, and how to use a CSF profile until they arrive.
Read article →The Branch Hotspot Problem: When Outage Workarounds Break NRB Network Controls
A phone tethered to a branch PC during a link outage is an unmanaged path into the core banking network. NRB's IT Guidelines and Cyber Resilience Guidelines leave no room for it. Engineer the failover so nobody needs the workaround.
Read article →'Immediately' Means Immediately: Incident Reporting Under NRB's Cyber Resilience Guidelines
Secondary commentary often cites a 24-hour window for reporting cyber incidents to Nepal Rastra Bank. The Cyber Resilience Guidelines 2023 say material incidents should be reported immediately. Here is how to build an incident response plan around that word.
Read article →The 2% Result: What a 19,500-Employee Study Says About Embedded Phishing Training
An eight-month randomized study at UC San Diego Health found annual awareness training had no significant link to phishing failure, and embedded training cut failure rates by about 2%. Here is what to change in your program.
Read article →Beyond SMS OTP: SIM Swaps, OTP-Stealing Apps and Stolen Sessions
SMS OTP fails three ways: the number gets moved, the device gets compromised, or the attacker skips login by stealing the session. FIU-Nepal documents the first two. NIST SP 800-63B-4 now classes SMS as restricted. Here is the migration path for digital banking teams.
Read article →NIST CSF 2.0's Govern Function, Read as a Bank Board's Job Description
CSF 2.0 added Govern as a sixth function. For Sri Lankan licensed banks, CBSL's Banking Act Direction No. 16 of 2021 already turns most of it into board obligations. Here is how to map one to the other and what the board pack should contain.
Read article →DORA and PCI-DSS v4.0: The End of 'Checkbox' Security Awareness
Two major regulatory frameworks now ask for more than an annual, generic awareness module. Here's what PCI DSS v4.0 Requirement 12.6 and DORA Article 13(6) actually require, and how to close the gap.
Read article →Surviving the NRB CRG 2023: How to Build a Compliant Cross-Disciplinary Steering Committee
NRB's Cyber Resilience Guidelines expect a cross-disciplinary steering committee to own cyber resilience strategy — not just an IT one. Most Nepali BFIs have formed the committee and skipped the part that makes it functional.
Read article →The 'Re. 1 Ping': Hunting Automated Mule Account Validation in Digital Wallets
Fraud networks debit as little as Re. 1 from mule accounts to check whether they have been frozen before moving the rest. FIU-Nepal documents the pattern. Here is how to turn it into a detection rule that fires before the money moves.
Read article →Mapping the RBI IT Master Direction to ISO 27001:2022: A CISO's Guide to Unified Compliance
RBI's IT Governance, Risk, Controls and Assurance Practices Direction replaced twelve scattered circulars with one enforceable framework. Here's how an ISO 27001:2022 ISMS satisfies it structurally rather than symbolically.
Read article →The Cryptography Trap: Auditing PFX Implementations in Open Banking APIs
PFX/PKCS#12 certificate mishandling is one of the most common and least discussed failure points in South Asian open banking integrations. Here's what a VAPT engagement should actually be checking for.
Read article →Building a Two-Hour Incident Response Engine: Navigating CBSL Circular No. 2 of 2025
Sri Lanka's central bank now requires cyber incidents to be reported within two hours of detection. That timeline makes most existing incident response plans structurally non-compliant — here's what closing the gap actually requires.
Read article →Why Click Rates Lie: Operationalizing the NIST Phish Scale in Enterprise Training
Your phishing simulation click rate is not a security metric — it's a difficulty score in disguise. Here's how to use the NIST Phish Scale to stop confusing lure design with organizational resilience.
Read article →The CISO's Guide to NRB's Unified Payment Systems Directive: Why ISO 27001 Is No Longer Optional
Nepal Rastra Bank now defines non-compliance with standards such as ISO 27001 as a technology risk for institutions in the payment system. Here's what that means for BFIs and PSPs still treating ISO 27001 as discretionary.
Read article →From Out-of-Scope to High Severity: How One Rejected Bug Report Became a 50-Organization Study
How an unsigned identify call let attackers impersonate users on dozens of companies' Featurebase feedback portals, and the TBDSR method used to find them.
Read article →