Swapnil Tripathi

📢 On a mission to make Governance, Risk & Compliance more approachable, practical, and strategic—for companies and professionals alike.

[Swapnil Tripathi @SwapnilTripa]

@TheSleepCo_ Hey @TheSleepCo_ I have already added the ticket number what else you need in DM?

[Swapnil Tripathi @SwapnilTripa]

@TheSleepCo_ Motorised recliner broken since 3 Nov. Technician visit: no repair. Re-visit raised 9 Nov: daily calls, "24 hrs" promises, still nobody. Store: "we only do sales." Tickets 212812, 208122. Who owns after-sales?

[Swapnil Tripathi @SwapnilTripa]

@BookMyForex My forex card has been declining every transaction since 12 PM CET yesterday - stuck abroad with no way to pay. Called support and was told the helpline only handles new card sales, not existing customers with active issues. Great business model.
#BadCustomerService

[Swapnil Tripathi @SwapnilTripa]

My take: GRC isn’t just about protecting your walls — it’s about securing your ecosystem.

[Swapnil Tripathi @SwapnilTripa]

#TrustTuesday
Why Vendor Security Is Everyone’s Blind Spot — Until It’s Too Late

⚠️ When JPMorgan’s CISO writes an open letter to all suppliers, you know this isn’t just a “compliance checkbox” anymore — it’s a real business risk.

#PracticalGRC #ThirdPartyRisk #VendorSecurity

[Swapnil Tripathi @SwapnilTripa]

So what should companies actually do?
✅ Maintain a live, risk-tiered vendor inventory
✅ Perform assessments before onboarding
✅ Define controls, breach notification terms in contracts
✅ Regularly review critical vendors
✅ Offboard vendors with the same rigour you onboard

[Swapnil Tripathi @SwapnilTripa]

Here's what I see far too often during audits:
🔸 No clear inventory of vendors
🔸 No due diligence before onboarding
🔸 No continuous monitoring after onboarding
🔸 No contractual security obligations in place
🔸 No process to offboard vendors securely

[Swapnil Tripathi @SwapnilTripa]

#GRC #CyberSecurity #Compliance #InfoSec #SOC2 #ISO27001 #PCIDSS #StartHere

[Swapnil Tripathi @SwapnilTripa]

After years of working in the GRC and InfoSec space — from auditing fintechs and SaaS companies to helping clients navigate frameworks like ISO 27001, SOC 2, PCI DSS, GDPR — I’ve decided to share my learnings and journey publicly.

[Swapnil Tripathi @SwapnilTripa]

The goal is simple: 📢 Make GRC less boring and way more actionable. If you’re a founder, CISO, compliance lead, or someone trying to break into cybersecurity — I’d love to have you on this ride. Let’s build something valuable together

[Swapnil Tripathi @SwapnilTripa]

Starting next week, I’ll be posting every Monday, Wednesday, and Friday on:
🔹 Real-world GRC insights
🔹 Compliance strategies that actually work
🔹 Cybersecurity news decoded
🔹 Career lessons from switching into infosec
🔹 Framework breakdowns (with a twist)

[Swapnil Tripathi @SwapnilTripa]

Took Uber in Gurgaon, asked for AC—driver got furious, said Uber doesn’t pay for AC rides. When I objected, he threatened me & asked me to get out. Reported it—3 days later, just an acknowledgment. Now Uber emails me saying I caused the driver discomfort. Wild! @UberIN_Support