Key Points

• Regulated Entities must establish clear cyber incident response and recovery policies, defining classification, communication, containment, and recovery procedures with documented roles and escalation protocols.
• They must conduct forensic analysis, implement corrective measures, and regularly test and update their preparedness through drills and crisis communication exercises.

Key Points

• Banks must implement a Board-approved Incident Response and Management Programme supported by BCP/DR capabilities, SOC integration, and defined procedures for detection, reporting, and coordinated response involving staff, vendors, and customers.
• They must enhance cyber resilience through continuous improvement, collaborative testing, secure threat intelligence sharing, and unified SOC–Incident Response–Forensics operations to minimize downtime and strengthen preparedness.

Key Points

• Regulated Entities must have an integrated Cyber Crisis Management and Incident Response Plan to ensure rapid containment, mitigation, and recovery for business continuity.
• They must conduct regular drills, maintain clear SOPs, and report all cybersecurity incidents to SEBI, CERT-In, and NCIIPC within prescribed timelines.

Key Points

• Regulated Entities must implement a Cyber Crisis Management and Incident Response Policy to ensure timely detection, containment, and recovery from incidents with minimal business disruption.
• They must conduct forensic and root cause analyses, define clear roles and escalation procedures, and report incidents promptly to CERT-In and PFRDA.

Key Points

• The framework supplements Section 4.1.5 of the 2024 Guidelines by classifying cybersecurity incidents into Critical, High, Medium, and Low levels based on severity and business impact.
• Regulated Entities must prioritize incidents affecting confidentiality, integrity, or availability and ensure timely, effective responses to maintain operational resilience.

Key Points

• MSMEs must implement and regularly test a formal Incident Response Plan detailing reporting, containment, investigation, recovery, and communication procedures.
• They must comply with CERT-In Directions under Section 70B(6) of the IT Act, 2000, and report all cybersecurity incidents within six hours of detection.

Key Points

• CII entities must maintain a centralized system to record, track, and manage all hardware and software assets with unique identifiers. Regular audits, controlled equipment movement, and management-approved disposal ensure security, prevent unauthorized access, and support maintenance and incident response.
• Organizations should establish a well-defined incident response plan with clear roles, escalation paths, containment, and recovery procedures. Post-incident analysis and vulnerability removal are crucial to prevent recurrence and strengthen the system’s resilience against physical, environmental, or cyber threats.

Key Points

• Telecommunication entities must report security incidents to the Central Government within six hours and submit a detailed report within twenty-four hours outlining impact and remediation.
• The government may disclose incidents, mandate audits, and issue directives with timelines to enhance transparency and prevent future occurrences.

Key Points

• Organizations must implement structured procedures and a dedicated Incident Response Team to detect, report, and manage all security incidents affecting information assets.
• The Help Desk must log, escalate, and coordinate incidents with IT, security teams, and vendors to ensure timely resolution and documentation.

Key Points

• Regulated Entities must report all cyber incidents to CERT-In within six hours and simultaneously inform IRDAI, submitting initial details within 24 hours.
• Updated reports with new forensic findings must be sent to IRDAI within 24 hours of receiving insights to ensure ongoing regulatory transparency.

Key Points

• All entities must synchronize ICT system time with NIC/NPL NTP servers, maintain logs for 180 days within India, and report listed cyber incidents to CERT-In within six hours..
• Each organisation must appoint a PoC for CERT-In coordination and comply with information-sharing or mitigation directives to avoid penalties under the IT Act, 2000.

Key Points

• Regulated Entities must maintain strong cyber preparedness through compliance with IRDAI’s 2023 Guidelines, including six-hour incident reporting, 180-day ICT log retention, synchronized system clocks, and an effective Cyber Crisis Management Plan.
• They must conduct timely forensic investigations using pre-empanelled certified experts, avoid conflicts of interest among vendors, and report compliance and Board meeting minutes to IRDAI.

Key Points

• Government organisations must form a cybersecurity team led by a CISO and follow structured incident response phases—Preparation, Detection & Analysis, Containment & Eradication, and Recovery & Lessons Learned.
• All cyber incidents must be reported to CERT-In within six hours and shared with relevant agencies like NIC-CERT, sectoral CSIRTs, and regulators.

Key Points

• Defines the Incident Response Team (IRT) composition, including team lead, sectoral coordinators, and forensic/domain experts, along with procedures for incident reporting, escalation, and coordination with victim organizations.
• Outlines steps for Incident Mitigation and Information Dissemination, including onsite response, evidence collection, coordination with CERT-In, and issuance of advisories on a need-to-know basis, ensuring timely response and regular SOP reviews.