{
  "standard": "ISO/IEC 27001:2022 & ISO/IEC 27002:2022",
  "certificationType": "Information Security Management System (ISMS)",
  "organization": {
    "legalName": "JOHN THOMAS FINTECH PRIVATE LIMITED",
    "cin": "U62099KL2026PTC106017",
    "pan": "AAHCJ5884B",
    "tan": "CHNJ05481A",
    "gstin": "32AAHCJ5884B1ZN",
    "dateOfIncorporation": "2026-09-01",
    "registeredOffice": "69/1854 A, A1, A2, SRM Road, Ernakulam North, Kochi, Ernakulam - 682018, Kerala, India",
    "mcaMoaDocument": "/iso27001/17878067411002_INC-33_1-27156774214 MOA.pdf"
  },
  "scope": "Design, engineering, cloud hosting, and secure operations of enterprise cloud accounting, ERP, statutory payroll, GST e-invoicing, and MCA WORM audit trail SaaS platform.",
  "auditReadiness": "STAGE 1 & STAGE 2 EXTERNAL AUDIT READY",
  "statementOfApplicability": {
    "totalControls": 93,
    "implementedControls": 93,
    "excludedControls": 0,
    "implementationPercentage": 100.0,
    "themes": {
      "clause5_organizational": {
        "total": 37,
        "implemented": 37,
        "status": "COMPLIANT"
      },
      "clause6_people": {
        "total": 8,
        "implemented": 8,
        "status": "COMPLIANT"
      },
      "clause7_physical": {
        "total": 14,
        "implemented": 14,
        "status": "COMPLIANT"
      },
      "clause8_technological": {
        "total": 34,
        "implemented": 34,
        "status": "COMPLIANT"
      }
    }
  },
  "statutoryAndRegulatoryAlignments": [
    {
      "name": "Digital Personal Data Protection Act (DPDP Act) 2023",
      "status": "COMPLIANT",
      "controls": "POL-03, POL-04, Data Classification & Principal Rights"
    },
    {
      "name": "CERT-In Cyber Security Directions (April 2022)",
      "status": "COMPLIANT",
      "sla": "6-Hour Mandatory Reporting SLA, 180-Day Log Retention, time.cert-in.org.in NTP sync"
    },
    {
      "name": "Reserve Bank of India (RBI) Cyber Security Guidelines",
      "status": "COMPLIANT",
      "controls": "MFA, Encrypted Financial Payloads, API Gateway"
    },
    {
      "name": "Companies (Accounts) Rules, 2014 & MCA Rule 11(g)",
      "status": "COMPLIANT",
      "controls": "WORM Edit Trail, SHA-256 Merkle Chaining, 8-Year Retention"
    },
    {
      "name": "Information Technology Act 2000 (Section 43A & 72A)",
      "status": "COMPLIANT",
      "controls": "Reasonable Security Practices, Confidentiality"
    }
  ],
  "ismsDocumentation": {
    "totalOfficialDocuments": 34,
    "masterPortalUrl": "/iso27001/INDEX.html",
    "downloadZipUrl": "/downloads/John_Thomas_Fintech_ISO_27001_Audit_Pack.zip",
    "directDownloadEndpoint": "/download/iso-27001-audit-pack",
    "zipSizeBytes": 7024667,
    "officialPdfPath": "/iso27001/03_Official_PDF_Documents/"
  },
  "cryptographicSeal": "B50FE4247AB5C615A1273E3C7335CF4B5EF1EE4CBFA994ECED3269819FA58CD8"
}