Page 202 - 1-37

TRANSFORMING TRANSFORMING TRANSFORMING
SUSTAINABILITY REPORT FY 2023
Third-party certifications and assessments are also conducted twice a year.
Certification/Assessment
Internal Vulnerability Assessment and
Penetrating Testing (VAPT) Program, including
stimulated hacker attacks
External Vulnerability Assessment and
Penetrating Testing (VAPT) Assessment
ISO 27001, ISO 22301, ISO 31000,
and ISO 27701
Awareness and Capacity Building
As part of the onboarding process, all
new joiners at Vedanta are required to
attend mandatory cybersecurity training
to ensure their awareness and
understanding of security protocols.
100% of our employees are trained on
cybersecurity. In addition, an Online
Awareness Training Capsule is made
available on a self-service basis. The
Information Security function closely
monitors and tracks the training status of
users, conducting periodic follow-ups to
promote completion. Virtual Classroom
sessions are also organised periodically,
allowing voluntarily participation and
self-nomination for further training. To
assess the level of user awareness, BUs
conduct Dip-Stick Assessments in the
form of periodic tests and quizzes. Based
on the effectiveness of these
assessments, targeted trainings and
communications are conducted
throughout the organisation. Phishing
simulations are carried out for all users to
evaluate their vigilance and awareness.
Service provider
Information Security Function through a
third-party expert agency
Group Management Assurance System
(through Third-Party Expert Agency)
Surveillance audit conducted through an
audit partner
Lessons learned from these simulations
are shared with the users, while individuals
who fall prey to the simulations are required
to undergo specific phishing training
videos for further learning.
Performance Evaluation and Reporting
Each employee in the IT function has
well-defined KRA/KPI, in line with Vedanta’s
Information Security Goals as part of their
Annual Goals and Performance
Management process and requirements.
Performance evaluation of Information
Security is carried out based on the
following aspects:
• People
• Process
• Technology
Performance of the employee is measured
against these goals. Similarly, employees
working on OT environment and managing
such systems also have KPI aligned to
Vedanta’s Information Security Goals in
their Annual KRA/KPA Plan.
COMMUNITIES
Incident Reporting
Security incidents are addressed by
diligent tracking and monitoring until
resolution. A comprehensive root cause
analysis is conducted, and action plans are
developed to mitigate future incidents. We
have a well-defined Incident Management
& Data Breach Policy communicated to all
stakeholders. To facilitate incident
reporting, Vedanta has a centralised email
address for reporting suspicious activities
related to information security.
Incidents are generated through various
channels, including 24/7 monitoring of
critical IT assets, daily monitoring of data
movement using data leakage prevention
tools, incident reports from end users, and
internal security organisation observations.
Each reported incident is thoroughly
investigated by the Chief Information
Security Officer (CISO), and appropriate
actions are taken. Vedanta uses advanced
tools and technologies to continuously
monitor IT assets and data movement,
automatically generating incidents based
on predefined rules. These incidents are
then tracked and resolved by the IT
Operations Team with guidance from the
Information Security Organization.
During the reporting period, no incidents of
leaks, thefts, or data loss were identified,
resulting in no impact on clients,
customers, or employees.
THE PLANET THE WORKPLACE
Escalation Process
Vedanta diligently tracks and monitors all
security incidents, ensuring they are
thoroughly investigated, and actions are
taken for their resolution. To encourage
reporting, Vedanta's BUs have established
a central email address:, gc@vedanta.co.in,
where users can report any suspicious
activities related to Information Security.
Reported incidents undergo investigation
by the Chief Information Security Officer
(CISO), and appropriate measures are
implemented to address each incident.
Incidents reported through the Security
Information and Event Management (SIEM)
system by employees and end users are
evaluated by the BU’s CISO and further
reviewed by the BU’s Chief Information
Officer (CIO). Data incidents reported
through Data Loss Prevention (DLP)
systems and by end users are evaluated by
the BU’s Data Governance and Privacy
Officer (DGPO)/BU’s CISO and reviewed by
the BU’s CIO. The severity and impact of
these incidents and observations are
reported and discussed in various forums,
including the BU’s Executive Committee
(EXCO), Vedanta Group's Executive
Committee (EXCO), the BU’s Audit & Risk
Committee, and Vedanta’s Audit & Risk
Committee. Compliance with agreed-upon
observations is reported on a quarterly
basis to ensure timely and effective
resolution.
102