CybersecurityPolicies

Our cybersecurity offerings are strictly categorized into:

• Proactive Assurance: Vulnerability Assessments (VA), Penetration Testing (PT), and Architecture Reviews.
• Defensive Operations: Managed Detection & Response (MDR), SIEM deployment, and continuous monitoring.
• Reactive Response: Digital Forensics and Incident Response (DFIR) following a confirmed breach.
• Compliance & Governance: Audits against ISO 27001, CERT-In guidelines, and the IT Act 2000.

Pricing is transparent and modular, tied to the exact scope documented in the Statement of Work (SoW).

• Retainer Models: Billed monthly; covers MDR and continuous monitoring.
• Fixed-Bid Engagements: Used for point-in-time VAPT or audits. Payment milestones are strictly 50% upfront, 50% upon final report delivery.
• Incident Response: Billed hourly under an emergency rate unless strictly covered by an active retainer SLA.

Tests are executed strictly adhering to the approved RoE.

• No exfiltration of Personally Identifiable Information (PII) or sensitive operational data.
• Exploitation pauses immediately if systemic instability is observed.
• All client data generated or collected during assessments is stored on encrypted, offline volumes and securely destroyed 30 days post-engagement.

While testing is designed to be non-disruptive, MTA’s liability is strictly capped at the total fee paid for the specific engagement.

• Either party may terminate the engagement with 15 days written notice.
• Immediate termination rights apply in cases of legal violation or deliberate scope deviation by the client.

Our testing frameworks align with global industry standards:

• Web Applications: OWASP Top 10 integration.
• Infrastructure: PTES (Penetration Testing Execution Standard) and OSSTMM.
• Red Teaming: MITRE ATT&CK framework mapping.

Strict operational security (OpSec) protocols apply to all communication:

• Credentials must exclusively be transferred via our designated secure, self-destructing zero-knowledge channels (e.g., Bitwarden Send).
• Reports containing sensitive vulnerabilities are delivered over end-to-end encrypted messaging or PGP-encrypted email.

Following any critical incident or major engagement conclusion, a formal PIR must be documented within 5 business days.

• Root Cause Analysis (RCA) delivery.
• Timeline of attacker actions and responder containment steps.
• Strategic recommendations to prevent re-occurrence.