IFSCA - Guidelines on Cyber Security and Cyber Resilience for Market Infrastructure Institutions (MIIs) in IFSC (20 April 2026)
AI / PRIVACY / CYBER RELEVANCE
MII-specific cyber framework for IFSC exchanges, clearing corporations and depositories; read with the IFSCA 2025 baseline and applicable CERT-In reporting.
AI: ContextualPrivacy: ModerateCybersecurity: Very High
READ FIRST
- Para 5 - Govern, Identify, Protect, Detect, Respond, Recover and Resilience
- CISO - dedicated, reporting to the MD or CEO
- Standing Committee on Technology - review twice a year
- Access logs - kept for at least two years
- Quantum-computing and evolving threats
- Effective date - 1 April 2026
PURVIEW
Builds a more granular, prescriptive cyber framework on top of the March 2025 baseline for regulated entities, because market infrastructure institutions are systemically critical. The Guidelines follow seven functions: Govern, Identify, Protect, Detect, Respond, Recover and Resilience. They strengthen board and senior-management accountability, require a dedicated CISO reporting directly to the MD or CEO (and following NCIIPC guidance where the MII is a critical information infrastructure), and require the Standing Committee on Technology to review the policy twice a year. Access to critical systems must be uniquely identified and logged, with logs kept securely for at least two years. They also cover internet-access controls, isolation of web browsing from endpoints, incident detection and reporting, recovery, and emerging risks including quantum computing.
Classification and legal status. Circular IFSCA-CSD/MSC/2/2026-DCS dated 20 April 2026 to stock exchanges (including the bullion exchange), clearing corporations and depositories in IFSC; effective from 1 April 2026, with compliance within the timelines set in each provision.