Skip to main content

Cybersecurity and IT compliance for BFSISecurity and compliance for financial services.

Practical controls, evidence and testing for banks, NBFCs, brokers, insurers and fintechs working under Indian financial regulators.

Marble lobby of an office tower with a reception desk
[01]What's at stake

What's at stake.

  • 01

    Regulatory scrutiny

    Regulators expect documented IT governance, risk management and assurance, not just tools.

  • 02

    Fraud and account takeover

    Phishing, credential theft and spoofed email lead directly to financial loss.

  • 03

    Strict incident timelines

    Specified incidents must reach CERT-In within 6 hours, which needs logging and a plan in place first.

  • 04

    Card and customer data

    Cardholder data and personal data bring PCI DSS and DPDP obligations.

[02]Rules and standards

Rules and standards that usually apply.

Which ones apply depends on your licence, customers and data. Treat this as a starting list.

Rule or standard, Who it applies to, What it asks for
RBI Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions (2026)Applies to · Banks, NBFCs, UCBs and other RBI-regulated entities (entity-wise Directions)Asks for · IT and cyber governance, technology risk, resilience and assurance; issued 31 July 2026, replacing the earlier IT governance and cyber security framework instructions
SEBI CSCRF (2024)Applies to · SEBI-regulated entitiesAsks for · A cybersecurity and cyber resilience framework covering governance, protection, detection, response and recovery
IRDAI Information and Cyber Security Guidelines (revised 2026)Applies to · Insurers and insurance intermediariesAsks for · Information and cyber security governance, controls and reporting
PCI DSS v4.0.1Applies to · Anyone storing, processing or transmitting card dataAsks for · Security requirements for the cardholder data environment
CERT-In Directions (April 2022)Applies to · Service providers, intermediaries, data centres and body corporates in IndiaAsks for · Report specified cyber incidents to CERT-In within 6 hours; keep ICT system logs for 180 days within India
DPDP Act, 2023Applies to · Organisations processing digital personal data in IndiaAsks for · Consent or a specified legitimate use, clear notices, reasonable security safeguards and breach notification (main duties from 13 May 2027)
[03]How we help

How we help.

[04]Where to start

Where to start.

  1. Step 1

    Book the free 30-minute IT & security health check

  2. Step 2

    Start with a gap assessment against your regulator's framework

  3. Step 3

    Confirm 180-day log retention and a 6-hour CERT-In reporting path

Which RBI and SEBI cyber rules apply to you?

On 31 July 2026 the RBI issued entity-wise Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, with separate Directions for commercial banks, NBFCs, urban co-operative banks and other categories of regulated entity. The NBFC Directions repeal the earlier NBFC IT governance directions, and NBFC requirements scale by layer and asset size, so start with the Directions for your exact category (rbi.org.in).

SEBI-regulated entities, such as brokers, depository participants and fund managers, follow SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) (sebi.gov.in). CSCRF audits must be carried out by CERT-In-empanelled auditors; ITCCS is not one, and helps with readiness and remediation before and after that audit.

Whatever your regulator, CERT-In's Directions apply to all: specified incidents must be reported within 6 hours and ICT system logs kept for 180 days.

[05]FAQ

Questions, answered.

Still have questions?

info@cloudcyber.co.in

Yes. We map the applicable framework to your current controls, close gaps, and organise the policies and evidence an inspector is likely to ask for. The regulator's own review remains independent.

Where a regulator or framework requires a specific type of auditor, that audit stays with them. We prepare your systems and fix findings before and after it.

Often a reduced scope still applies. We help you work out which requirements apply to your set-up.

[06]Contact

Let's build what's next.

Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.

Email
info@cloudcyber.co.in
Response
Usually within one business day
Location
Worldwide

What happens next

  1. 01

    Reply

  2. 02

    Discovery call

  3. 03

    Proposal

We use these details to reply to your enquiry and, if you allowed advertising cookies, to measure which ads lead to enquiries. Our Privacy Notice explains retention and your rights.

This page is general guidance, not legal advice. Last reviewed October 2026.