PFRDA - Information and Cybersecurity Policy Guidelines, 2024 for Intermediaries / Regulated Entities
AI / PRIVACY / CYBER RELEVANCE
The cyber governance baseline for the National Pension System ecosystem, which holds large volumes of subscriber personal and financial data.
AI: ContextualPrivacy: ModerateCybersecurity: Very High
READ FIRST
- Circular para 2 - issued under Section 14 of the PFRDA Act
- Governance - roles of the Board, CISO and Information and Cyber Security Risk Management Committee
- CISO - dedicated team, liaison with PFRDA and CERT-In
- Controls - cloud, patching, disposal, VAPT
- Log retention - perimeter and SIEM logs for 180 days
PURVIEW
Lays down the information and cybersecurity policy framework for pension-sector intermediaries and regulated entities, to protect subscribers' interests and the integrity of the pension architecture. Each entity must have a board-approved policy that sets the roles of the Board, board committees, senior management, CISO, CTO or CIO, audit and risk committees. It must have a CISO with a dedicated cybersecurity team, preferably separate from IT operations, who liaises with PFRDA and CERT-In. It must also set up an Information and Cyber Security Risk Management Committee of the CISO, CRO, CTO and functional heads. Indicative controls cover cloud security, patch management, secure disposal of systems and storage devices, and vulnerability assessment and penetration testing. Logs of perimeter devices and the SIEM must be kept for a rolling 180 days.
Classification and legal status. Circular PFRDA/2024/14/ICS/01 dated 1 August 2024 to all intermediaries and regulated entities of PFRDA, effective 1 August 2024.