Information and Cyber Security Policy Guidelines – 2024 for Intermediaries/Regulated Entities
PFRDA/2024/14/ICS/01
This page is the record of the instrument itself — reference, dates, scope and source. For what it means in practice, read Every Indian cyber instrument, and who each one binds.
The record
| Reference | PFRDA/2024/14/ICS/01 |
|---|---|
| Issued by | PFRDA (PFRDA) |
| Instrument type | Guidelines |
| Date of issue | 1 August 2024 |
| Status | In force |
| Binds | Every intermediary and regulated entity under the PFRDA Act, 2013, in two categories. Category I — CRAs and pension funds — takes the whole instrument. Category II — Points of Presence including APY service providers, the trustee bank, custodians and non-individual retirement advisers — may rely on its principal regulator’s equivalent, but still reports incidents to CERT-In and PFRDA within six hours. |
| Dates it sets | In effect on issue. The instrument sets no further dates. |
What it says
- Binds every intermediary and regulated entity under the PFRDA Act, 2013, and consolidates PFRDA’s 2017 cyber security guidelines.
- Applies in full to Category I: Central Recordkeeping Agencies and pension funds, including pension funds registered as Points of Presence.
- Lets Category II — Points of Presence including APY service providers, the trustee bank, custodians and non-individual retirement advisers — rely on equivalent RBI, SEBI, IRDAI or NHB guidelines, if it certifies compliance with them.
- Requires every entity to report cyber incidents to CERT-In and PFRDA within six hours of noticing them or being told of them.
- Requires Category I to report its CERT-In incidents to PFRDA quarterly, and any incident affecting subscribers within 48 hours.
- Requires an annual compliance report within 30 days of the financial-year end, an external audit by a CERT-In empanelled auditor every financial year, and an internal audit every six months.
What accounts of this instrument get wrong
Read the instrument
The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.
Instruments that change what this one requires
Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.
- PFRDA Incident Classification Guidelines, 2025 PFRDA/2025/05/ICS/01 — NPS intermediaries, classifying cyber incidents as Critical, High, Medium or Low.
- CERT-In Directions, 2022 No. 20(3)/2022-CERT-In — Very nearly every organisation in India, with a six-hour incident report to CERT-In.
This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.
Every instrument cited here was verified against the issuing regulator's own notification on .