Guidelines on Classification of Cybersecurity Incidents
PFRDA/2025/05/ICS/01
This page is the record of the instrument itself — reference, dates, scope and source. For what it means in practice, read Every Indian cyber instrument, and who each one binds.
The record
| Reference | PFRDA/2025/05/ICS/01 |
|---|---|
| Issued by | PFRDA (PFRDA) |
| Instrument type | Circular |
| Date of issue | 4 September 2025 |
| Status | In force |
| Binds | All PFRDA intermediaries and regulated entities, alongside the 2024 Guidelines. Four categories — Critical, High, Medium and Low — and one firm rule: an incident that disrupts normal operations or service delivery must be classified High or Critical. |
| Dates it sets | In effect on issue. The instrument sets no further dates. |
What it says
- Supplements section 4.1.5 of the 2024 Guidelines, which set out incident response but did not classify incidents.
- Advises prioritising incidents by potential business impact and estimated recovery effort, not by order of arrival or ease of recovery.
- Sets four categories with examples: ransomware and exfiltration of sensitive data are Critical, unauthorised access to servers is High, and targeted scans are Medium.
- Requires an incident that disrupts, stops or varies normal operations and affects service delivery to be classified High or Critical.
Read the instrument
The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.
Instruments that change what this one requires
Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.
- PFRDA Cyber Security Guidelines, 2024 PFRDA/2024/14/ICS/01 — NPS intermediaries — CRAs, pension funds, PoPs, the trustee bank, custodians and RAs.
- CERT-In Directions, 2022 No. 20(3)/2022-CERT-In — Very nearly every organisation in India, with a six-hour incident report to CERT-In.
This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.
Every instrument cited here was verified against the issuing regulator's own notification on .