Loading…
Official Indian cybersecurity acts, directives, and operational guidelines.
Loading…
Ministry of Electronics and Information Technology (MeitY) • 2023
India's first comprehensive data protection law, establishing rights for data principals and obligations for data fiduciaries handling personal data of Indian citizens. Modelled partly on GDPR.
Key Provisions
Indian Computer Emergency Response Team (CERT-In) • 2022
Mandatory cybersecurity directions issued under the IT Act, 2000, requiring organizations to report cyber incidents within 6 hours, maintain system logs for 180 days, and synchronize with NTP servers.
Key Provisions
National Security Council Secretariat (NSCS) • 2023
India's national cybersecurity framework aligning with global standards (NIST CSF). Provides a risk-based approach for organizations across critical sectors to identify, protect, detect, respond, and recover from cyber threats.
Key Provisions
Reserve Bank of India (RBI) • 2016
Comprehensive cybersecurity framework applicable to all Scheduled Commercial Banks in India. Mandates baseline security controls, 24x7 SOC operations, and quarterly reporting to RBI on cybersecurity posture.
Key Provisions
Securities and Exchange Board of India (SEBI) • 2024
Updated cybersecurity framework for all SEBI-regulated entities (stock brokers, depository participants, mutual funds, etc.), consolidating 25 earlier circulars and introducing mandatory Security Operations Centres and vulnerability management programs.
Key Provisions
Department of Electronics and Information Technology (DeitY) • 2013
India's original national-level cybersecurity policy, setting up the foundational security architecture including CERT-In, NTRO, and National Critical Information Infrastructure Protection Centre (NCIIPC). Being superseded by NCRF 2023.
Key Provisions