{
  "name": "BitScore India BFSI Readiness Index",
  "edition": "October 2026",
  "measuredOn": "2026-10-15",
  "publisher": "BitScore Cybertech LLP",
  "licence": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "BitScore India BFSI Readiness Index, October 2026 — bitscore.in",
  "page": "https://www.bitscore.in/reports/india-bfsi-quantum-readiness",
  "note": "Sector aggregates. Not a security rating: six externally visible readiness signals on each institution’s main website and domain.",
  "population": [
    {
      "label": "Scheduled commercial banks",
      "count": 49,
      "source": "RBI, Banks in India",
      "url": "https://www.rbi.org.in/commonperson/English/Scripts/BanksInIndia.aspx"
    },
    {
      "label": "Life insurers",
      "count": 26,
      "source": "IRDAI, list of life insurers",
      "url": "https://irdai.gov.in/list-of-life-insurers1"
    },
    {
      "label": "General insurers",
      "count": 28,
      "source": "IRDAI, list of general insurers",
      "url": "https://irdai.gov.in/list-of-general-insurers"
    },
    {
      "label": "Standalone health insurers",
      "count": 8,
      "source": "IRDAI, list of health insurers",
      "url": "https://irdai.gov.in/list-of-health-insurers"
    },
    {
      "label": "Stock exchanges",
      "count": 7,
      "source": "SEBI, recognised stock exchanges",
      "url": "https://www.sebi.gov.in/stock-exchanges.html"
    },
    {
      "label": "Depositories",
      "count": 2,
      "source": "SEBI, depositories",
      "url": "https://www.sebi.gov.in/depositories.html"
    },
    {
      "label": "Clearing corporations",
      "count": 5,
      "source": "SEBI, clearing corporations",
      "url": "https://www.sebi.gov.in/clearing-corporations.html"
    }
  ],
  "lenses": [
    {
      "id": "pq",
      "label": "Hybrid post-quantum key exchange",
      "test": "The main website completes a TLS 1.3 handshake offering only X25519MLKEM768, the hybrid group Chrome has offered by default since version 131."
    },
    {
      "id": "certValid",
      "label": "Valid certificate",
      "test": "The certificate is trusted, unexpired, names the host, and arrives with its full chain."
    },
    {
      "id": "cert100",
      "label": "Certificate already on a 100-day lifetime",
      "test": "The certificate in service was issued for 100 days or fewer — the maximum allowed from 15 March 2027."
    },
    {
      "id": "caa",
      "label": "CAA record published",
      "test": "The domain publishes a CAA record naming which certificate authorities may issue for it."
    },
    {
      "id": "dnssec",
      "label": "DNSSEC signed",
      "test": "The parent zone publishes a DS record, so the domain’s answers are signed."
    },
    {
      "id": "securityTxt",
      "label": "security.txt published (RFC 9116)",
      "test": "A current /.well-known/security.txt names a contact and an expiry date."
    },
    {
      "id": "dmarc",
      "label": "DMARC enforcing",
      "test": "The domain’s DMARC policy quarantines or rejects mail that fails authentication, on all of it."
    },
    {
      "id": "dmarcReject",
      "label": "DMARC at p=reject",
      "test": "The policy is reject, the strongest setting."
    }
  ],
  "cohorts": [
    {
      "id": "all",
      "kind": "group",
      "label": "All institutions",
      "institutions": 125,
      "lenses": {
        "pq": {
          "passed": 65,
          "tested": 117,
          "notRead": 8
        },
        "certValid": {
          "passed": 117,
          "tested": 122,
          "notRead": 3
        },
        "cert100": {
          "passed": 12,
          "tested": 122,
          "notRead": 3
        },
        "caa": {
          "passed": 24,
          "tested": 125,
          "notRead": 0
        },
        "dnssec": {
          "passed": 56,
          "tested": 125,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 2,
          "tested": 94,
          "notRead": 31
        },
        "dmarc": {
          "passed": 107,
          "tested": 125,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 78,
          "tested": 125,
          "notRead": 0
        }
      },
      "passingOfFive": [
        9,
        30,
        47,
        26,
        13,
        0
      ]
    },
    {
      "id": "banks",
      "kind": "group",
      "label": "Banks",
      "institutions": 49,
      "lenses": {
        "pq": {
          "passed": 19,
          "tested": 45,
          "notRead": 4
        },
        "certValid": {
          "passed": 45,
          "tested": 48,
          "notRead": 1
        },
        "cert100": {
          "passed": 3,
          "tested": 48,
          "notRead": 1
        },
        "caa": {
          "passed": 12,
          "tested": 49,
          "notRead": 0
        },
        "dnssec": {
          "passed": 34,
          "tested": 49,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 36,
          "notRead": 13
        },
        "dmarc": {
          "passed": 41,
          "tested": 49,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 36,
          "tested": 49,
          "notRead": 0
        }
      },
      "passingOfFive": [
        4,
        7,
        20,
        13,
        5,
        0
      ]
    },
    {
      "id": "insurers",
      "kind": "group",
      "label": "Insurers",
      "institutions": 62,
      "lenses": {
        "pq": {
          "passed": 40,
          "tested": 59,
          "notRead": 3
        },
        "certValid": {
          "passed": 61,
          "tested": 62,
          "notRead": 0
        },
        "cert100": {
          "passed": 9,
          "tested": 62,
          "notRead": 0
        },
        "caa": {
          "passed": 7,
          "tested": 62,
          "notRead": 0
        },
        "dnssec": {
          "passed": 14,
          "tested": 62,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 2,
          "tested": 51,
          "notRead": 11
        },
        "dmarc": {
          "passed": 54,
          "tested": 62,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 33,
          "tested": 62,
          "notRead": 0
        }
      },
      "passingOfFive": [
        3,
        19,
        26,
        10,
        4,
        0
      ]
    },
    {
      "id": "mii",
      "kind": "group",
      "label": "Market infrastructure",
      "institutions": 14,
      "lenses": {
        "pq": {
          "passed": 6,
          "tested": 13,
          "notRead": 1
        },
        "certValid": {
          "passed": 11,
          "tested": 12,
          "notRead": 2
        },
        "cert100": {
          "passed": 0,
          "tested": 12,
          "notRead": 2
        },
        "caa": {
          "passed": 5,
          "tested": 14,
          "notRead": 0
        },
        "dnssec": {
          "passed": 8,
          "tested": 14,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 7,
          "notRead": 7
        },
        "dmarc": {
          "passed": 12,
          "tested": 14,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 9,
          "tested": 14,
          "notRead": 0
        }
      },
      "passingOfFive": [
        2,
        4,
        1,
        3,
        4,
        0
      ]
    },
    {
      "id": "psb",
      "kind": "sector",
      "label": "Public sector banks",
      "institutions": 12,
      "lenses": {
        "pq": {
          "passed": 3,
          "tested": 12,
          "notRead": 0
        },
        "certValid": {
          "passed": 12,
          "tested": 12,
          "notRead": 0
        },
        "cert100": {
          "passed": 0,
          "tested": 12,
          "notRead": 0
        },
        "caa": {
          "passed": 4,
          "tested": 12,
          "notRead": 0
        },
        "dnssec": {
          "passed": 9,
          "tested": 12,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 10,
          "notRead": 2
        },
        "dmarc": {
          "passed": 11,
          "tested": 12,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 10,
          "tested": 12,
          "notRead": 0
        }
      },
      "passingOfFive": [
        0,
        3,
        4,
        4,
        1,
        0
      ]
    },
    {
      "id": "private",
      "kind": "sector",
      "label": "Private sector banks",
      "institutions": 21,
      "lenses": {
        "pq": {
          "passed": 10,
          "tested": 18,
          "notRead": 3
        },
        "certValid": {
          "passed": 20,
          "tested": 21,
          "notRead": 0
        },
        "cert100": {
          "passed": 2,
          "tested": 21,
          "notRead": 0
        },
        "caa": {
          "passed": 6,
          "tested": 21,
          "notRead": 0
        },
        "dnssec": {
          "passed": 15,
          "tested": 21,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 16,
          "notRead": 5
        },
        "dmarc": {
          "passed": 18,
          "tested": 21,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 15,
          "tested": 21,
          "notRead": 0
        }
      },
      "passingOfFive": [
        2,
        2,
        7,
        7,
        3,
        0
      ]
    },
    {
      "id": "sfb",
      "kind": "sector",
      "label": "Small finance banks",
      "institutions": 11,
      "lenses": {
        "pq": {
          "passed": 4,
          "tested": 11,
          "notRead": 0
        },
        "certValid": {
          "passed": 8,
          "tested": 10,
          "notRead": 1
        },
        "cert100": {
          "passed": 0,
          "tested": 10,
          "notRead": 1
        },
        "caa": {
          "passed": 2,
          "tested": 11,
          "notRead": 0
        },
        "dnssec": {
          "passed": 9,
          "tested": 11,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 5,
          "notRead": 6
        },
        "dmarc": {
          "passed": 9,
          "tested": 11,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 8,
          "tested": 11,
          "notRead": 0
        }
      },
      "passingOfFive": [
        0,
        2,
        6,
        2,
        1,
        0
      ]
    },
    {
      "id": "payments",
      "kind": "sector",
      "label": "Payments banks",
      "institutions": 5,
      "lenses": {
        "pq": {
          "passed": 2,
          "tested": 4,
          "notRead": 1
        },
        "certValid": {
          "passed": 5,
          "tested": 5,
          "notRead": 0
        },
        "cert100": {
          "passed": 1,
          "tested": 5,
          "notRead": 0
        },
        "caa": {
          "passed": 0,
          "tested": 5,
          "notRead": 0
        },
        "dnssec": {
          "passed": 1,
          "tested": 5,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 5,
          "notRead": 0
        },
        "dmarc": {
          "passed": 3,
          "tested": 5,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 3,
          "tested": 5,
          "notRead": 0
        }
      },
      "passingOfFive": [
        2,
        0,
        3,
        0,
        0,
        0
      ]
    },
    {
      "id": "life",
      "kind": "sector",
      "label": "Life insurers",
      "institutions": 26,
      "lenses": {
        "pq": {
          "passed": 19,
          "tested": 25,
          "notRead": 1
        },
        "certValid": {
          "passed": 26,
          "tested": 26,
          "notRead": 0
        },
        "cert100": {
          "passed": 3,
          "tested": 26,
          "notRead": 0
        },
        "caa": {
          "passed": 3,
          "tested": 26,
          "notRead": 0
        },
        "dnssec": {
          "passed": 6,
          "tested": 26,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 21,
          "notRead": 5
        },
        "dmarc": {
          "passed": 23,
          "tested": 26,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 14,
          "tested": 26,
          "notRead": 0
        }
      },
      "passingOfFive": [
        1,
        7,
        12,
        4,
        2,
        0
      ]
    },
    {
      "id": "general",
      "kind": "sector",
      "label": "General insurers",
      "institutions": 28,
      "lenses": {
        "pq": {
          "passed": 15,
          "tested": 26,
          "notRead": 2
        },
        "certValid": {
          "passed": 28,
          "tested": 28,
          "notRead": 0
        },
        "cert100": {
          "passed": 6,
          "tested": 28,
          "notRead": 0
        },
        "caa": {
          "passed": 2,
          "tested": 28,
          "notRead": 0
        },
        "dnssec": {
          "passed": 7,
          "tested": 28,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 2,
          "tested": 25,
          "notRead": 3
        },
        "dmarc": {
          "passed": 24,
          "tested": 28,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 16,
          "tested": 28,
          "notRead": 0
        }
      },
      "passingOfFive": [
        1,
        12,
        9,
        4,
        2,
        0
      ]
    },
    {
      "id": "health",
      "kind": "sector",
      "label": "Health insurers",
      "institutions": 8,
      "lenses": {
        "pq": {
          "passed": 6,
          "tested": 8,
          "notRead": 0
        },
        "certValid": {
          "passed": 7,
          "tested": 8,
          "notRead": 0
        },
        "cert100": {
          "passed": 0,
          "tested": 8,
          "notRead": 0
        },
        "caa": {
          "passed": 2,
          "tested": 8,
          "notRead": 0
        },
        "dnssec": {
          "passed": 1,
          "tested": 8,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 5,
          "notRead": 3
        },
        "dmarc": {
          "passed": 7,
          "tested": 8,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 3,
          "tested": 8,
          "notRead": 0
        }
      },
      "passingOfFive": [
        1,
        0,
        5,
        2,
        0,
        0
      ]
    },
    {
      "id": "mii",
      "kind": "sector",
      "label": "Market infrastructure (SEBI)",
      "institutions": 14,
      "lenses": {
        "pq": {
          "passed": 6,
          "tested": 13,
          "notRead": 1
        },
        "certValid": {
          "passed": 11,
          "tested": 12,
          "notRead": 2
        },
        "cert100": {
          "passed": 0,
          "tested": 12,
          "notRead": 2
        },
        "caa": {
          "passed": 5,
          "tested": 14,
          "notRead": 0
        },
        "dnssec": {
          "passed": 8,
          "tested": 14,
          "notRead": 0
        },
        "securityTxt": {
          "passed": 0,
          "tested": 7,
          "notRead": 7
        },
        "dmarc": {
          "passed": 12,
          "tested": 14,
          "notRead": 0
        },
        "dmarcReject": {
          "passed": 9,
          "tested": 14,
          "notRead": 0
        }
      },
      "passingOfFive": [
        2,
        4,
        1,
        3,
        4,
        0
      ]
    }
  ],
  "certificateLifetimes": {
    "read": 122,
    "upTo100": 12,
    "ninetyDay": 11,
    "from101To200": 81,
    "from201To398": 29,
    "caps": [
      {
        "from": "2026-03-15",
        "maxDays": 200
      },
      {
        "from": "2027-03-15",
        "maxDays": 100
      },
      {
        "from": "2029-03-15",
        "maxDays": 47
      }
    ]
  },
  "bankIn": {
    "banks": 49,
    "onBankIn": 49,
    "legacyKnown": 47,
    "legacyRedirects": 29,
    "legacyNoWebsite": 3,
    "legacyNotRedirecting": 15,
    "legacyNoDmarc": 7,
    "legacyNoDmarcNoMx": 6,
    "legacyExpiredCertificate": 1
  },
  "notRead": {
    "securityTxt": 31,
    "pq": 8,
    "tls": 3
  },
  "sources": [
    {
      "label": "RBI Press Release 2026-2027/325",
      "detail": "Expert Committee for a Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE), 25 May 2026",
      "url": "https://rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=62803"
    },
    {
      "label": "RBI/2025-26/28",
      "detail": "Circular — Migration to ‘.bank.in’ domain, 22 April 2025",
      "url": "https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12837"
    },
    {
      "label": "DST, Quantum-Safe Ecosystem in India",
      "detail": "National Quantum Mission task force report: CII quantum resiliency by 2029, enterprise-wide PQC by 2033 (page as archived 8 June 2026)",
      "url": "https://web.archive.org/web/20260608142420/https://dst.gov.in/quantum-safe-ecosystem-in-india"
    },
    {
      "label": "CA/Browser Forum Ballot SC-081v3",
      "detail": "Schedule of reducing certificate validity: 200 days from 15 March 2026, 100 from 15 March 2027, 47 from 15 March 2029",
      "url": "https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/"
    },
    {
      "label": "NIST FIPS 203",
      "detail": "Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM), 13 August 2024",
      "url": "https://csrc.nist.gov/pubs/fips/203/final"
    },
    {
      "label": "Google Security Blog",
      "detail": "A new path for Kyber on the web — Chrome 131 offers hybrid ML-KEM (X25519MLKEM768), 13 September 2024",
      "url": "https://security.googleblog.com/2024/09/a-new-path-for-kyber-on-web.html"
    },
    {
      "label": "RFC 9116",
      "detail": "A File Format to Aid in Security Vulnerability Disclosure (security.txt)",
      "url": "https://www.rfc-editor.org/rfc/rfc9116"
    }
  ]
}