# RBI, SEBI, IRDAI and CERT-In: a map of India’s financial-sector cyber rules

> Which Indian cyber and IT rules apply to banks, NBFCs, payment companies, brokers and insurers: and how to meet them with one control framework.

URL: https://securei3.com/insights/india-financial-sector-cyber-regulations/
Author: Secure iQube
Published: 2026-10-24

India’s financial regulators each set their own cyber and IT expectations, and many firms fall under more than one. Here is how the main instruments fit together.

| If you are… | Primary rules |
|---|---|
| A bank or NBFC | [RBI IT Governance Master Direction](/standards/rbi-it-governance/), [RBI Cyber Security Framework](/standards/rbi-cyber-security-framework/), [IT Outsourcing Direction](/standards/rbi-it-outsourcing/), [KYC Direction](/standards/rbi-kyc-master-direction/), [Fraud Risk Directions](/standards/rbi-fraud-risk-management/) |
| A payment system operator | [RBI cyber resilience directions for PSOs](/standards/rbi-pso-cyber-resilience/), [payment data localisation](/standards/rbi-payment-data-localisation/), [PCI DSS](/standards/pci-dss/) |
| A broker, depository participant, AMC or other SEBI entity | [SEBI CSCRF](/standards/sebi-cscrf/), [SEBI cloud framework](/standards/sebi-cloud-framework/) |
| An insurer or intermediary | [IRDAI Information and Cyber Security Guidelines](/standards/irdai-cyber-guidelines/) |
| Everyone | [CERT-In Directions](/standards/cert-in-directions/), [DPDP Act](/standards/india-dpdp/), [PMLA](/standards/india-pmla/) where you are a reporting entity |

## Build once, evidence many times

The overlap is large: governance and a CISO role, risk assessment, access control, logging and monitoring, incident response and reporting, vendor risk, business continuity and periodic audit. An ISO/IEC 27001 ISMS with ISO 22301 for continuity covers most of it. On top, add each regulator’s specifics, committee structures, reporting formats, audit frequency and timelines such as CERT-In’s six-hour incident reporting.

## Where firms most often fall short

- Board and committee oversight that exists on paper but is not minuted
- Vendor and cloud contracts missing audit and data location clauses
- Logs not retained for 180 days in India
- Incident escalation too slow to meet reporting windows
- BCP/DR plans never tested end to end

## Frequently asked questions

### Can one ISO 27001 programme satisfy RBI, SEBI and IRDAI?

It can be the backbone. Each regulator adds governance, reporting and audit specifics, so map those on top of a single ISMS rather than running separate programmes.