Straight answers on cyber risk measurement.

• FundamentalsWhat is a cyber security rating?What a rating is, the four families of signal it is built from, and the genuine limits of a number produced without your participation.8 min read →
• FundamentalsWhat is a good Bitsight score?The bands, the peer percentile that matters more than the absolute number, and what "good" means to an insurer, a customer and a board.8 min read →
• FundamentalsHow to read your Cyber Risk Rating ReportWhat each panel of the report states, the order to read them in, and the questions to take into the walkthrough.6 min read →
• FundamentalsCyber insurance and security ratings: what a rating actually changesThe one conversation where a CRO and a CISO read the same number — and where claims about ratings are least often supported.9 min read →
• ReferenceCyber risk ratings glossaryEvery term used across these guides — the scale, the risk vectors, the third-party programme vocabulary, and the Indian regulatory terms no global glossary carries.12 min read →

India

• RegulationCyber security regulations in India: which one applies to youThe whole regulatory picture in one table, then a route from your entity type to the instrument that actually governs you.10 min read →
• ReferenceThe Indian cyber regulation registerThe complete list — thirty-two instruments across six regulators — with the date each was last checked at source, published as an open dataset.6 min read →
• RegulationThe RBI Directions of 31 July 2026: which of the seven applies to youNot one instrument but seven, issued the same day. The applicability test first, then the obligations, the timings, and the outsourcing track they deliberately left alone.15 min read →
• RegulationWhat the 2026 RBI Directions ask of an NBFCRBI/DoS/2026-27/461 is not the commercial banks instrument re-addressed. It has six chapters to their eight, and only one of three obligation chapters applies to any given NBFC.8 min read →
• RegulationWhat the 2026 RBI Directions ask of a UCBFour levels set by the digital services a bank actually offers, and the chapters are cumulative. Where the CISO and the operations centre first appear is the part worth knowing before budgeting.8 min read →
• RegulationSEBI CSCRF: what the framework requires, category by categoryWhich category you fall into and why it changes every April, what the framework actually demands, and the circular chain that moved the deadline twice.15 min read →
• RegulationSEBI CSCRF incident response: the 75 days after six hoursThe five reports Annexure-O owes after the first day, how severity decides forensics and review, and the recovery-time rule most summaries still quote in its 2024 form.10 min read →
• RegulationSEBI’s IT Resilience Index has to compute itselfNine weighted parameters, a half-yearly score that must be produced without human hands, and four dates ending 31 March 2027 — for market infrastructure institutions only.7 min read →
• RegulationIRDAI Information and Cyber Security Guidelines, 2026What the April 2026 Guidelines require of insurers, intermediaries and TPAs — and why the CISO reporting line is the provision a board can fail on an organisation chart.11 min read →
• RegulationCERT-In’s six-hour rule: what the 2022 Directions actually requireThe most widely applicable cyber instrument in India, and the least read. Who it binds, when the six-hour clock starts, and the five obligations that are not reporting.13 min read →
• RegulationDPDP security obligations: what Rule 6 asks you to build by May 2027Seven named safeguards, a one-year log retention, and two breach clocks that start on awareness — none of it in force until May 2027, all of it slower to build than to read.12 min read →
• RegulationAgentic AI in India: who answers when the agent actsFour Indian AI instruments, four different legal forces. Which of them actually binds a regulated entity that deploys agents, and what each requires.11 min read →
• RegulationRBI cyber security compliance: what Indian boards must evidenceIndian regulators now expect boards to evidence oversight, not assert it — and on 31 July 2026 the RBI reset the framework across its regulated entities. What that means in practice, and what evidence stands up.11 min read →
• RegulationWhat SEBI’s CDSL order says about the assets you forgot to listA single unlisted internet-facing server cost ₹1 crore, and the disaster recovery site was encrypted too. Why asset inventories fail, and what catches what they miss.9 min read →

Global

• RegulationNIST, ISO 27001, SOC 2, DORA: what binds you in IndiaThirteen names get used interchangeably in a vendor questionnaire. None of them substitutes for an Indian entity’s own obligations — here is the map between the two.12 min read →
• RegulationNIS2, DORA and SEC Reg S-P: what each demands of your vendorsWho is in scope, what each regime demands of third parties, the dates that already passed, and what evidence stands up to a supervisor.12 min read →
• RegulationThe Cyber Resilience Act starts reporting on 11 September 2026One article of the CRA applies more than a year before the rest, it binds non-EU manufacturers directly, and it reaches products you shipped years ago.9 min read →
• RegulationIncident reporting: nine clocks, and none of them start togetherThe trigger, not the duration, is what makes a filing late. Nine clocks across India, the EU and the US, and what each one actually starts from.10 min read →

• ComparisonCyber security rating vendors in India: how to choose oneWhat a ratings vendor is and is not, who is available in India, and the six criteria that separate them for an Indian buyer.9 min read →
• ComparisonBitsight vs SecurityScorecard, RiskRecon and UpGuardOne comparison, three rivals. Each turns on a different axis, and each section ends with the honest case for buying the other product instead.16 min read →
• PracticeThird-party risk management: from questionnaires to continuous evidenceWhy questionnaires fail for vendor risk, what US and EU regulators now expect, and how to build a tiered programme on continuous evidence.9 min read →
• PracticeThird-party risk management for Indian BFSIWhy questionnaires fail for vendor risk in BFSI, and how to build a tiered programme with continuous evidence instead.11 min read →
• PracticeSecurity questionnaires or security ratings: what each one can actually seeThe honest boundary between the two, including the four things a rating cannot see — written by a company that sells the rating.10 min read →
• PracticeAgentic vendor risk assessment: how to check suppliers’ AIThe intrusion the Cloud Security Alliance calls the first fully autonomous attack was a third-party problem. What agentic AI changes about vendor risk, and a five-step assessment to run on each supplier.12 min read →
• PracticeAttribution across Indian group structures: whose asset is itThe criterion most shortlists ignore and most deployments stall on — written from delivery experience with Indian conglomerates rather than from a datasheet.9 min read →
• RemediationHow to improve your Bitsight security ratingThe findings that actually move the score, the order to fix them in, and how quickly the rating responds.9 min read →