Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs
IFSCA-CSD/MSC/4/2026-DCS
This page is the record of the instrument itself — reference, dates, scope and source. For what it means in practice, read Every Indian cyber instrument, and who each one binds.
The record
| Reference | IFSCA-CSD/MSC/4/2026-DCS |
|---|---|
| Issued by | International Financial Services Centres Authority (IFSCA) |
| Instrument type | Circular |
| Date of issue | 27 October 2026 |
| Status | In force |
| Binds | All regulated entities in the IFSCs, with no exemption carved out, through named roles. The Designated Officer — at an MII, the CISO — must hold both the Basic and the Advanced NISM-IFSCA cyber security certifications; the Compliance Officer and staff running IT operations or information security, or holding privileged access to critical systems, must hold the Basic. Six months from the examination going live or from appointment, whichever is later. |
| Dates it sets |
|
What it says
- Requires the Designated Officer, and at an MII the CISO, to hold both the Basic and the Advanced NISM-IFSCA cyber security certifications.
- Requires the Compliance Officer, and staff responsible for IT operations or information security or holding privileged access to critical systems, to hold the Basic certification.
- Allows six months from the examination going live, or from appointment to the role, whichever is later. The Basic examination goes live on 18 November 2026 and the Advanced on 30 December 2026.
- Requires the certification to be held at all times while in the role, and the regulated entity to keep records it can produce to IFSCA.
- Encourages the Advanced certification for the Compliance Officer and the staff above, and the Basic for every other employee.
What accounts of this instrument get wrong
Read the instrument
The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.
Instruments that change what this one requires
Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.
- IFSCA Cyber Security Guidelines, 2025 IFSCA-CSD0MSC/13/2025-DCS — Any entity licensed, recognised, registered or authorised by IFSCA in GIFT City.
- IFSCA Cyber Security Guidelines Amendment, 2026 IFSCA-CSD0MSC/1/2026-DCS — Restructured the IFSCA exemptions into two tiers with different conditions.
- IFSCA MII Cyber Security Guidelines, 2026 IFSCA-CSD/MSC/2/2026-DCS — IFSC stock exchanges, clearing corporations and depositories, on top of the 2025 baseline.
This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.
Every instrument cited here was verified against the issuing regulator's own notification on .