Sector cyber rules in brief: RBI, SEBI CSCRF and IRDAI for regulated entities and their vendors

If your business is regulated by RBI (banks, NBFCs, payment system operators and others), SEBI (brokers, depositories, mutual funds, investment advisers and other market entities) or IRDAI (insurers and intermediaries), your regulator's cyber security rules apply on top of the CERT-In Directions, and they usually say that outsourcing a function does not outsource responsibility. They often require a board-approved policy, a designated security officer, a SOC or equivalent monitoring, regular audits and incident reporting to the regulator on its own timelines. If you are an MSME supplying such an entity, its rules will reach you through contract clauses. This guide is a brief, hedged map; it belongs to why managed security engagements fail. Always read the current text on the regulator's website.

RBI-regulated entities

The RBI has issued cyber security and IT governance requirements over several years, and it has recently consolidated them into entity-wise directions:

• the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices of 7 November 2023 (RBI/2023-24/107, in effect from 1 April 2024) consolidated earlier circulars on IT governance, business continuity and information systems audit; for banks it sat alongside the 2016 Cyber Security Framework in Banks circular;
• on 31 July 2026 the RBI issued entity-wise Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, for example for commercial banks (RBI/DoS/2026-27/410) and NBFCs. They apply immediately and repeal the earlier cybersecurity framework and IT governance instructions for those entities;
• the Master Direction on Outsourcing of Information Technology Services of 10 April 2023 (in effect from 1 October 2023) has been folded into entity-wise Managing Risks in Outsourcing Directions, 2025 of 28 November 2025. Their IT outsourcing chapter expressly covers managed security services and has SOC-specific terms on rules, logs and incident response. VAPT and other external audit services are excluded from it.

Which set applies depends on your entity type (commercial bank, small finance or payments bank, co-operative bank, NBFC layer and so on). Check the current list on the RBI's Master Directions page.

What this tends to mean when buying managed security:

Check the current directions and their applicability on RBI.

SEBI-regulated entities: CSCRF

SEBI issued the Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI-regulated entities by circular dated 20 August 2024 (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, as reported in published summaries; sebi.gov.in could not be reached to confirm), replacing several earlier cyber security circulars. It groups entities into categories (market infrastructure institutions, qualified, mid-size, small-size and self-certification entities) with graded requirements, and covers governance, identification, protection, detection (including SOC requirements, with the option for smaller entities to use a market SOC set up by market infrastructure institutions, as we understand it), response, recovery and audits. Compliance timelines have been extended and clarified by later circulars.

If you are a SEBI-regulated entity, check on SEBI:

1. your category under the CSCRF;
2. which requirements apply to you and from when;
3. whether your SOC arrangement meets the framework's expectations;
4. audit requirements and who may perform them (CERT-In empanelled auditors are referenced for some audits).

IRDAI-regulated entities

IRDAI has issued information and cyber security guidelines for insurers and intermediaries, with requirements on governance, audits and incident reporting. Check the current guidelines on IRDAI.

Critical information infrastructure

Systems declared protected systems or critical information infrastructure fall under the National Critical Information Infrastructure Protection Centre framework. Most MSMEs are not, but some suppliers to power, telecom, transport and finance sectors may meet related requirements through contracts. See NCIIPC.

If you are an MSME supplier to a regulated entity

Expect your customer to ask for:

• a security questionnaire and evidence (policies, VAPT reports, certifications);
• incident notification to them within a short time, often hours;
• audit rights over your systems that handle their data;
• data location and deletion commitments;
• flow-down of their regulator's outsourcing terms.

A managed security service and a virtual CISO can help you meet these, but price them into the contract you sign with your customer.

Questions for a provider that serves regulated entities

If you are regulated, add these to your RFP questions:

1. Which regulated entities of our type and size do you serve today? (No names needed; ask about categories.)
2. Will you accept audit and inspection rights for us and our regulator, in writing?
3. Can you produce reports in the format our regulator or auditors expect?
4. How do your notification times leave room for our regulator's reporting timelines as well as CERT-In's six hours?
5. Where are our logs stored, how long, and how fast can you hand them over?
6. What is your exit and transition plan, and how do you manage concentration risk if many of your clients are in our sector?

A provider that hesitates over audit rights or exit plans is a poor fit for a regulated entity, whatever its price.

Illustrative cost effect

A small NBFC's managed SOC quote rises from an illustrative ₹18 lakh to ₹24 lakh a year once regulator-format reports, audit support, longer retention and the right of audit are added: a 33% increase. The extra ₹6 lakh is not a hidden cost if it is required; it is the real price of the service the entity must have.

FAQ

Does SEBI or RBI approve managed security providers?

Generally, regulators set requirements for the regulated entity, which must do due diligence on its providers. Check whether your regulator maintains any lists or specific requirements for your category.

Are CERT-In timelines replaced by regulator timelines?

No. Both may apply. Prepare one incident record that serves CERT-In, your regulator and, from 13 May 2027, the Data Protection Board.

We are a fintech partner of a bank. Do RBI rules apply to us?

Not directly in most cases, but through the bank's outsourcing contract. Read the contract's security schedule carefully.

Sources

• RBI — Master Directions page: IT governance (2023), Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions (2026), Managing Risks in Outsourcing Directions (2025)
• SEBI — Cybersecurity and Cyber Resilience Framework (CSCRF) circulars
• IRDAI — information and cyber security guidelines
• NCIIPC — critical information infrastructure
• CERT-In — Directions of 28 April 2022