High-Level Control Areas
Identity & Access Management
Least-privilege access model. Administrative separation of duties. Session and access logging as default.
Encryption & Data Protection
Encryption in transit and appropriate encryption at rest.
Logging & Audit Trails
Designed for auditability — access logs, admin actions, policy changes, and operational events.
Vulnerability Management
Secure development expectations and release discipline.
Incident Response
Defined triage and escalation workflows.
Security configurations are not published publicly by design. All detailed control implementations are available to government reviewers under a formal NDA or RFP process.
CERT-In Readiness Framing
MTSAi's security posture is designed to be aligned with CERT-In cybersecurity guidelines. These references describe design intent. Final compliance is verified through government audit per contract scope.
CERT-In incident reporting timelines are incorporated into the incident response design. Notification workflows are documented and reviewable under NDA.
Evidence You Can Request
- Security Overview (vX.Y)
- Incident Response Playbook (vX.Y)
- Configuration Baseline Summary (public-safe; details under NDA) (vX.Y)
- Audit Event Catalog — sample/redacted (vX.Y)
- Pen-test / assessment plan (planned) where applicable (vX.Y)
What We Do Not Publish Publicly
By design, we do not publish exploitable configuration specifics, infrastructure diagrams with sensitive detail, security bypass instructions, or customer-specific/deployment-specific data. These are available under controlled NDA/RFP conditions.
Compliance Status
CERT-In Alignment
Security posture designed to align with CERT-In cybersecurity guidelines and incident reporting requirements.
IAM Controls
Least-privilege model and administrative separation of duties under implementation for production deployment.
Audit Log Export
Structured security event logging designed; export formats and schemas reviewable under NDA.
Access Security Materials
Request the versioned Security Overview or arrange a security diligence call with our team.
No live city implementations are currently operational. All deployment, outcome, and operational capability references are design specifications subject to government procurement, contract execution, and implementation.
All references to regulatory frameworks represent design intent and readiness posture. Final compliance is verified through government audit per contract scope.
Case study outcomes cited from London, Singapore, Stockholm, and other cities are external examples from independent transportation authorities, not MTSAi deployments.