Who the baseline guidelines cover
The March 2025 guidelines apply to any entity licensed, recognised, registered or authorised by IFSCA. They are applied proportionately, having regard to the scale and complexity of operations, the activity, the entity's interconnectedness and its cyber risks. They are organised in five parts: governance, the cyber security and cyber resilience framework, third-party risk, communication and awareness, and audit.
Activity regulations repeat the duty. The Capital Market Intermediaries Regulations, 2025, for example, require a capital market intermediary to have a robust cyber security and cyber resilience framework in accordance with IFSCA's requirements (regulation 21).
Matters to settle early
- Oversight body. Governance may sit with the board, senior management or a committee designated for technology or cyber risk. Board and senior management must have enough expertise to understand cyber risk.
- Designated Officer. Appoint a CISO, or designate a senior employee, to assess and reduce cyber risk, respond to incidents and run the processes the oversight body approves.
- Framework and IS Policy. The framework sets risk appetite, roles and recovery objectives and is reviewed periodically. The Information Security Policy covers an inventory and classification of IT assets, protective controls aligned to standards such as NIST or ISO 27000, access control on need-to-know and least-privilege principles, physical security, recovery, incident management (including a definition of 'cyber incident') and audit trails.
- Testing. Vulnerability assessment and penetration testing of critical and other IT systems at least once a year.
- Third parties. Critical service providers are reviewed every six months. The entity remains responsible for cyber risk arising from third parties. See cloud, outsourcing and data location.
- Training for staff, and clear channels for reporting suspicious activity.
Incident reporting and audit timelines
| Step | Regulated entities (2025 guidelines) | MIIs (2026 guidelines) |
|---|---|---|
| First report | To IFSCA at [email protected], copied to IFSCA's CISO, within 6 hours of detection | To IFSCA and CERT-In within 6 hours of noticing or being told of the incident |
| Interim report | Within 3 days | Within 3 days |
| Root cause analysis | Within 30 days | Within 30 days |
| Mitigation measures | Within 7 days | Within 7 days of detection |
| Periodic reporting | Not specified | Quarterly, within 15 days of each quarter end |
| Cyber audit | Annual, by a CERT-In empanelled auditor, a suitably certified independent auditor (CISA, CISM, GSNA or CISSP) or an experienced cyber auditor; report to IFSCA within 90 days of the financial year end | Annual, by a CERT-In empanelled auditor only, for at most three consecutive years; report within 120 days of the financial year end, with a declaration from the MD or CEO |
A broker-dealer, clearing member or depository participant that files a cyber audit report with an MII or bullion exchange may give IFSCA the same report within 7 days of that filing.
CERT-In. Independently of IFSCA, CERT-In's directions of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000 require body corporates to report listed cyber incidents to CERT-In within 6 hours, to synchronise system clocks with the prescribed time sources, to designate a point of contact, and to keep logs of all ICT systems securely for a rolling 180 days within Indian jurisdiction. If the incident involves personal data, the breach-intimation duties in the Digital Personal Data Protection Rules also apply. See data protection.
The March 2026 exemptions
The amending circular of 10 March 2026 exempts some entities from the guidelines for three years from the date of issuance:
- Paragraph 21: branches of regulated Indian or foreign entities; entities serving only their group, such as Global In-house Centres; and entities with fewer than 10 employees. During the exemption they must adopt the cyber framework and IS Policy of the parent or its holding company, use the parent's CISO as Designated Officer, have a parent or holding company regulated by a regulator or government body at home, file a Designated Officer's certificate within 90 days of each financial year end, and file the annual cyber audit report.
- New paragraph 23: foreign universities in the IFSC; newly incorporated standalone entities with no parent; and credit rating agencies. Their Designated Officer certifies each year, within 90 days of the year end, that cyber measures are adequate and proportionate to the risk.
An exemption is conditional. A branch whose parent's framework does not actually cover the IFSC operation, or that files no certificate, is exposed.
Market infrastructure institutions and newer risks
The MII guidelines (in force from 1 April 2026) are more prescriptive. Among other things they require a board-approved policy reviewed by the Standing Committee on Technology twice a year, a dedicated CISO reporting to the MD or CEO, a board-approved list of critical assets, annual risk assessment including post-quantum risk, access logs kept for at least two years, a Cyber Crisis Management Plan, and ISO 27001 certification within two years.
On 4 June 2026 IFSCA issued an advisory on cyber risks from frontier AI models, with immediate effect. It asks entities to treat newly disclosed critical vulnerabilities as exploitable within hours, to include frontier-AI scenarios in risk assessments placed before the board, to keep a software bill of materials and an inventory of APIs, to require critical service providers to show preparedness, and to keep human oversight of AI-assisted remediation. See algorithms and AI.
Weak controls can also become an enforcement matter. In July 2026 IFSCA passed an interim order against a fund manager after a business email compromise diverted a scheme investment, finding prima facie that robust systems and controls had not been in place. See inspections, enforcement and penalties.