Reference · PDF
The India Cyber Compliance Map
Which rules apply to whom, the clocks that start when you notice an incident, and the evidence to keep.
Who it is for
CISOs, compliance and legal teams, and founders who need one page to see what applies.
What is inside
- 1. The four layers
- National, sectoral, data and assurance regimes, and who each applies to
- 2. The regimes at a glance
- CERT-In directions, DPDPA, RBI, SEBI, IRDAI, ISO 27001 and SOC 2
- 3. Reporting clocks and retention
- A one-page calendar: 6 hours, without delay, 72 hours, 180 days, one year
- 4. One control, many asks
- Where regimes overlap and how to avoid duplicate work
- 5. The evidence checklist
- What to keep, who owns it and how long
A look inside
India has no single cyber security statute. What it has is a stack: a national incident-reporting direction, regulators for particular sectors, a new data protection law and the voluntary standards your customers ask for. The mistake is to build a programme per rule. The better approach is one control library, mapped many times.
Of everything in the stack, the reporting clocks are the part that catches teams out, because they run in parallel and start when you notice an incident, not when you finish investigating.
The rest unlocks when you enter your details.