India Cybersecurity Compliance: From Requirement to Evidence

Start with one question. When did your organization first notice the incident, and where is that recorded? Under Indian cyber rules, much of compliance turns on the answer. The clock starts at noticing, the report is due in hours, and the proof is a timestamp that must exist before anyone asks for it.

Indian requirements are specific. They carry hard numbers for reporting, retention and testing, they come from several authorities at once, and they are enforced through evidence. That changes what a compliance assessment should look for. In India the gaps that matter are usually in evidence, not in policy: a control that exists but cannot be shown to have operated at the moment someone asks.

The requirements that carry hard numbers

The DPDP Rules commence in phases. Provisions that set up the Data Protection Board took effect on notification. Consent manager registration follows after twelve months. The substantive obligations, including security safeguards and breach intimation, follow after eighteen months. At the time of writing those substantive duties are not yet enforceable. The CERT-In Directions already are. The controls the DPDP Rules will require take time to build, so the phasing is a planning window rather than a reason to wait.

Sector regulators add their own clocks

Regulated entities carry a second layer. The Reserve Bank of India has issued technology-focused master directions covering cybersecurity, technology risk, resilience and assurance, and digital payment security controls. As reported by KPMG, they require incident reporting within six hours through the RBI’s DAKSH platform with proactive notification to CERT-In, vulnerability assessments at least every six months and penetration tests at least every twelve months for critical and internet-facing systems, and disaster recovery drills at least half-yearly for critical systems.

SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) is built around five goals: anticipate, withstand, contain, recover and evolve. It sorts regulated entities into categories by size and requires the largest to complete Cyber Capability Index assessments. IRDAI issues information and cyber security guidelines for insurers. Applicability and detail differ by entity type, so each regulated entity should read the direction written for its own category and not rely on a summary of another.

Where requirements collide

Clocks. CERT-In expects a report within six hours. Regulated financial entities face a six-hour RBI clock too. The DPDP Rules allow 72 hours for the detailed report to the Board. One incident should produce one timeline that feeds all three, with detection and awareness times recorded once and used everywhere. Separate timelines drift apart, and a regulator comparing them will notice.

Retention. CERT-In sets 180 days, the DPDP Rules refer to a minimum of one year for specified logs, and sector rules add periods of their own. In practice the longest applicable period becomes the default for the log sources it covers. Keeping everything for a year inside India is a cost decision, so scope it by system rather than applying it to every source.

Location. The CERT-In text says logs are to be maintained within Indian jurisdiction. A group SOC that centralizes logs outside India needs either a local copy or a documented position on how the requirement is met. How the wording interacts with architecture is a legal interpretation, and it is better settled with counsel before an assessor asks.

Assessing for evidence, not intent

A requirement-to-evidence assessment tests each obligation three ways. Can the organization do what is required? Can it prove it was done, from records and not recollection? And can it produce that proof on request, from a known location, owned by a named person? A control that passes the first test and fails the other two will fail in an audit.

The most useful single exercise is to take a recent incident or tabletop and rebuild the six-hour timeline from records alone. Places to look for gaps include: the moment of awareness recorded only in a chat message; retention configured on the SIEM but not on the source systems; time synchronization set on servers but not on network devices or SaaS exports; and systems that process personal data of people in India missing from the inventory. The DPDP Act reaches processing within India and processing outside India that relates to offering goods or services to individuals in India, so overseas systems can be in scope.

A sequence for the next quarter

1. Build an obligation list per legal entity and per system: which regulators apply, which systems process personal data of individuals in India, and which are classed as critical by a sector regulator.

2. Design one incident clock and one incident record that feed CERT-In, any sector regulator and the DPDP Board report, with named decision owners.

3. Write a retention schedule by log source, taking the longest applicable period and recording where the logs are held.

4. Create an evidence index: for each obligation, one owner, one storage location and one refresh cycle.

5. Re-run the six-hour timeline test every quarter and track the time it takes to find the evidence.

Investment made now in clocks, retention and evidence will serve the later DPDP duties as well. The organizations that find their evidence gaps in an exercise will have a better quarter than those that find them in a notice.

Sources

1. CERT-In: Directions on information security practices, procedure, prevention, response and reporting of cyber incidents – Six-hour reporting, 180-day log retention and time synchronization.

2. Ministry of Electronics and Information Technology: Digital Personal Data Protection Act and Rules – Phased commencement, security safeguards and breach intimation.

3. Reserve Bank of India: Master Directions – Primary text of the technology-focused master directions.

4. KPMG in India: RBI’s technology-focused Master Directions – Summary of reporting, testing and drill requirements. Confirm against the direction for your entity type.

5. Tsaaro: SEBI’s Cybersecurity and Cyber Resilience Framework, key insights – Goals, entity categories and Cyber Capability Index.

6. IRDAI: Information and Cyber Security Guidelines – Applicable to insurers.