IFSCA - Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs (10 March 2025)
AI / PRIVACY / CYBER RELEVANCE
Proportionate cyber framework for IFSCA-regulated entities, subject to paragraphs 21-22 conditional exemptions; separate CERT-In reporting remains relevant.
AI: ContextualPrivacy: ModerateCybersecurity: Very High
READ FIRST
- Paras 3-9 - oversight, designated officer and Information Security Policy
- Para 9(e) - annual VAPT
- Para 11 - six-month reviews for core-operation or critical-system third parties, risk-based frequency for others
- Paras 16-18 - permitted auditor categories, annual audit and submission timelines
- Paras 19-20 - six-hour incident report, three-day interim report, thirty-day root-cause report and seven-day mitigation
- Paras 21-22 - conditional three-year exemptions and parent-framework requirements
- Closing provision - effective 1 April 2025
PURVIEW
Sets a proportionate cyber-security and resilience framework for IFSCA-regulated entities from 1 April 2025. Paragraphs 3-9 assign oversight responsibilities, require a CISO or senior designated officer, and an Information Security Policy covering asset classification, access control, annual VAPT, recovery and forensic audit trails. Paragraph 11 requires six-month reviews for third parties supporting core operations or accessing critical systems; other vendors have risk-based review frequency. Paragraphs 16-17 require an annual independent audit by one of the permitted auditor categories, not exclusively a CERT-In empanelled auditor, with reporting within 90 days of financial-year end. Paragraph 19 requires incident reporting within six hours of detection; paragraph 20 requires interim reporting within three days, root-cause analysis within thirty days and mitigation within seven days. Paragraphs 21-22 provide conditional three-year exemptions for branches, group-only service entities, entities with fewer than ten employees and foreign universities. These are subject to parent-framework, parent-CISO, regulated-parent and annual-certification conditions; they are not blanket exclusions.
Classification and legal status. Circular IFSCA-CSD0MSC/13/2025-DCS dated 10 March 2025, issued under Sections 12 and 13 of the IFSCA Act, 2019; effective 1 April 2025, subject to the conditional exemptions in paragraphs 21-22.