Cyber security regulations in India: which one applies to you

Almost every summary of Indian cyber regulation is written from one instrument outwards, which is useful only if you already know which instrument binds you. This page runs the other way: what exists, who each thing binds, and where to read the text. The detailed pages sit one click away.

Every instrument, in one table

The RBI row names the commercial banks instrument because it is the one most readers arrive looking for. It is one of seven issued the same day — the others cover small finance banks, payments banks, urban co-operative banks, the all India financial institutions, NBFCs and credit information companies. All seven, with reference numbers sets out which is which.

Find yourself

The fastest route from an entity type to the instrument that governs it. Where an organisation holds more than one registration — a bank with a depository participant licence, an insurer with an asset management arm — it is in scope for both, and SEBI has clarified that its controls apply to the infrastructure used for SEBI-regulated activities rather than to the whole estate.

To do this interactively — and get the reference number, issue date and a link to the regulator's own notification for each instrument — use the regulation finder.

Banks, NBFCs, co-operative banks and credit bureaux

One of the seven RBI Directions of 31 July 2026. Which one depends on your licence, and the obligations then scale within it — by layer for NBFCs, by level for urban co-operative banks. Outsourcing sits in a separate instrument that the 2026 Directions deliberately preserved.

Brokers, AMCs, RTAs, depositories and exchanges

SEBI's CSCRF, at the standard set by your category — Market Infrastructure Institution, Qualified RE, Mid-size, Small-size or Self-certification. The category is re-fixed at the start of each financial year on the previous year's data, so it is not a permanent property of the firm. The CSCRF guide covers the thresholds.

Insurers, brokers, corporate agents, web aggregators and TPAs

IRDAI's Information and Cyber Security Guidelines, 2026, which replaced the 2023 Guidelines on 6 April 2026 and reach the intermediary chain as well as the insurer.

Everyone, regardless of sector

CERT-In's six-hour incident reporting under section 70B(6) of the IT Act 2000, and the DPDP Act and Rules for anyone processing digital personal data. Neither is a financial-sector instrument and neither can be discharged by satisfying a sector regulator.

Indian entities serving clients abroad inherit a second set on top of these, arriving through the customer contract rather than from an Indian regulator: NIS2, DORA and SEC Regulation S-P each place obligations on their regulated firms' suppliers, wherever those suppliers sit.

What the regulators have converged on

The instruments were written separately and read very differently, but four expectations now appear in all of them. Where three regulators independently arrive at the same requirement, it is worth treating as the direction of travel rather than as one regulator's preference.

• The board is named. Not “senior management” — the board, with specified committees and, in the RBI's case, a composition test for the IT Strategy Committee that a board either passes or does not.
• CISO independence is structural. The RBI wants the CISO reporting into the executive overseeing risk; IRDAI states the CISO must not report to the Head of IT and must not carry business targets; SEBI sets the CISO's standing at least equivalent to the CTO or CIO for its larger entities. Each is a reporting line, visible on a chart.
• Assurance is continuous, not annual. Half-yearly vulnerability assessment, annual penetration testing at minimum, half-yearly disaster recovery drills, continuous auditing of critical systems where practicable.
• Third parties are a first-class obligation. Every one of these instruments carries a third-party chapter, and none of them accepts that liability travels with the contract.

Regulatory positions are taken from the issuing regulators' own notifications, each linked above. Every instrument cited here was verified against the issuing regulator's own notification on 11 August 2026. The RBI's notification search is the canonical place to check whether this family has been added to. This page is general information, not legal advice — confirm applicability and current status with your own counsel and compliance function.

Where BitScore fits, and where it does not

One theme runs through every instrument above: the regulator wants evidence of oversight rather than an assertion of it. A security rating is useful for exactly that and for nothing beyond it. It is calculated by an outside party from attacker-visible signals, updated continuously, benchmarked against sector peers, and reviewable as a trend — so it is an artefact the organisation did not produce about itself and could not have assembled retrospectively.

It is not compliance with any instrument on this page, and presenting it as such would be a serious misreading of both the regulation and the rating. It says nothing about internal controls, incident response capability, consent architecture or DPDP readiness. What it does is convert “we take cyber seriously” into a measured, independently calculated, trended position that a director can interrogate and a supervisor can be shown.

The three regulator pages below carry the clause-level detail, including what a rating evidences under each instrument and what it leaves untouched.

Read next

• The Indian cyber regulation register — the complete list rather than the seven above, with each instrument's status, the dates it sets and when it was last checked at source. Downloadable as JSON and CSV.
• The RBI Directions of 31 July 2026 — all 7, and which one applies to you.
• SEBI CSCRF — categories, the Cyber Capability Index, and the audit cadence.
• IRDAI's 2026 Guidelines — what changed for insurers and their intermediaries.
• What Indian boards must evidence — the same landscape read from the board pack backwards.