Author · Sumrite
Nishant Sharma, Senior Consultant at Sumrite.
Nishant Sharma is a Senior Consultant at Sumrite.
RoleSenior Consultant
Articles15
Based inNew Delhi, India
About Nishant Sharma
Nishant Sharma is a Senior Consultant at Sumrite. He works on security testing evidence and compliance engagements for SOC 2, ISO 27001 and data protection frameworks, including India’s DPDP Act and SEBI’s CSCRF.
- Role
- Senior Consultant, Sumrite
- Company
- Sumrite, New Delhi (legal name Summit Printrite Private Limited)
- Focus
- Compliance evidence for SOC 2 and ISO 27001; Data protection frameworks (DPDP, PDPL, GDPR); Regulatory VAPT requirements
Articles by Nishant Sharma (15)
ComplianceHow to Find Personal Data Before SDAIA Does: Data Discovery for PDPL A practical method from Sumrite.You cannot protect, delete or report data you cannot find. A step-by-step method for PDPL data discovery, data mapping and records of processing that stand up to SDAIA.ComplianceMapping ISO 27001 to NCA ECC-2: Reuse the Controls You Already Have A domain-level map from Sumrite.How an ISO 27001:2022 ISMS maps to NCA ECC-2:2024 at domain level, which ECC requirements ISO does not cover, and a step-by-step method to reuse your evidence.CompliancePDPL Cross-Border Data Transfers: Rules for Sending Saudi Personal Data Abroad The transfer rules, explained by Sumrite.How to send Saudi personal data abroad lawfully under the PDPL: Article 29 conditions, SDAIA's SCCs and binding common rules, risk assessments and what the 2026 draft would change.ComplianceCST Cybersecurity Regulatory Framework (CRF): A Guide for Saudi ICT Providers A compliance guide from Sumrite.The CST Cybersecurity Regulatory Framework (formerly CITC CRF): who must comply, how compliance levels work, what it says on penetration testing and how to prepare.ComplianceDraft PDPL Implementing Regulation Amendments (October 2026) What the draft proposes, explained by Sumrite.SDAIA's October 2026 draft would add an in-Kingdom storage rule, drop the harm test for breach reports and widen registration. What it proposes and how to respond.ComplianceRBI VAPT requirements for banks and NBFCs Sumrite on what the IT Master Direction asks for.Which banks and NBFCs are covered, how often critical and DMZ systems need VA and PT, who can test, and the evidence an RBI inspection looks for.ComplianceDPDP Rules 2025: deadlines and security safeguards A rule-by-rule Sumrite checklist.The DPDP Rules 2025 phase in to May 2027. The deadlines, what Rule 6 security safeguards and Rule 7 breach reporting require, and a checklist to work through.ComplianceSEBI CSCRF VAPT requirements Sumrite on who tests, how often and what to submit.Who must do VAPT under SEBI's CSCRF, how often by category, why the auditor must be CERT-In empanelled, and the closure and revalidation deadlines.ComplianceHIPAA penetration testing requirements Sumrite on what is required and what changes in 2026.The HIPAA Security Rule does not name penetration testing today, but a proposed update would. What is required now, what may change, and how testing fits.ComplianceGDPR penetration testing requirements Sumrite on what Article 32 asks and how to evidence it.GDPR never says penetration test, but Article 32 requires regular testing of your security, and regulators fine firms that skip it. What to test and how often.ComplianceWhat is the DPDP Act in India? Sumrite's plain-English guide for businesses.India's Digital Personal Data Protection Act and Rules in plain English: who is covered, consent, security safeguards, breach reporting, deadlines and penalties.ComplianceUAE PDPL compliance guide for businesses What the law asks and how Sumrite helps you prove it.A practical guide to the UAE's federal data protection law: scope and free-zone carve-outs, controller duties, breaches, transfers and the security evidence to build.ComplianceISO 27001 VAPT audit: what you need to know, from Sumrite.ISO 27001 never says 'penetration test', yet auditors expect one. The controls behind it, the evidence they check and how to scope your VAPT.ComplianceNCA Critical Systems Cybersecurity Controls (CSCC): Who Must Comply and How Scope, cadence and evidence, explained by Sumrite.Who must comply with NCA's Critical Systems Cybersecurity Controls (CSCC-1:2019), how critical systems are identified, and the testing cadence and evidence CSCC expects.ComplianceWhat does a SOC 2 VAPT report look like? A section-by-section Sumrite walkthrough.Scope, methodology, findings, retest letter and criteria mapping: what goes into a SOC 2 penetration test report and what your auditor looks for.
Other authors
Want an expert to look at your application?
Fixed-scope quote, expert-led testing, retest included.