India’s financial regulators each set their own cyber and IT expectations, and many firms fall under more than one. Here is how the main instruments fit together.
| If you are… | Primary rules |
|---|---|
| A bank or NBFC | RBI IT Governance Master Direction, RBI Cyber Security Framework, IT Outsourcing Direction, KYC Direction, Fraud Risk Directions |
| A payment system operator | RBI cyber resilience directions for PSOs, payment data localisation, PCI DSS |
| A broker, depository participant, AMC or other SEBI entity | SEBI CSCRF, SEBI cloud framework |
| An insurer or intermediary | IRDAI Information and Cyber Security Guidelines |
| Everyone | CERT-In Directions, DPDP Act, PMLA where you are a reporting entity |
Build once, evidence many times
The overlap is large: governance and a CISO role, risk assessment, access control, logging and monitoring, incident response and reporting, vendor risk, business continuity and periodic audit. An ISO/IEC 27001 ISMS with ISO 22301 for continuity covers most of it. On top, add each regulator’s specifics, committee structures, reporting formats, audit frequency and timelines such as CERT-In’s six-hour incident reporting.
Where firms most often fall short
- Board and committee oversight that exists on paper but is not minuted
- Vendor and cloud contracts missing audit and data location clauses
- Logs not retained for 180 days in India
- Incident escalation too slow to meet reporting windows
- BCP/DR plans never tested end to end
How Secure iQube can help
StandardRBI IT Governance Master DirectionRBI’s consolidated expectations on IT governance, IT risk, controls, business continuity and IS audit for regulated entities.StandardSEBI CSCRFSEBI’s unified cyber framework for regulated entities, scaled by category, with goals to anticipate, withstand, contain, recover and evolve. ServiceRegulatory complianceCompliance with local and international laws, data protection, cybersecurity and sector regulations.ServiceGap assessmentKnow exactly where you stand against a standard or law, and what it will take to close the gaps. CourseRBI IT Governance & Cyber Compliance Workshop1 day
Frequently asked questions
Can one ISO 27001 programme satisfy RBI, SEBI and IRDAI?
It can be the backbone. Each regulator adds governance, reporting and audit specifics, so map those on top of a single ISMS rather than running separate programmes.