India Tightens Cybersecurity Compliance With New CERT-In And SEBI Directives

India's cybersecurity regulatory environment has become significantly more stringent, forcing organizations to overhaul their data protection and incident response strategies. The Indian Computer Emergency Response Team (CERT-In) now mandates that critical cyber incidents be reported within six hours of detection. Additionally, organizations must maintain secure logs of all ICT systems for 180 days, with the requirement that these logs be stored within Indian jurisdiction.

The Securities and Exchange Board of India (SEBI) has formalized its Cybersecurity and Cyber Resilience Framework (CSCRF), which pushes regulated entities toward a more rigorous compliance model. This framework emphasizes enhanced cyber resilience and broader security testing to protect market integrity. These directives are part of a larger effort to ensure that financial and critical infrastructure remains robust against increasingly sophisticated digital threats.

The implementation of the Digital Personal Data Protection (DPDP) Act further reinforces these requirements. Data fiduciaries are now legally obligated to implement reasonable security safeguards to prevent personal data breaches. The act places a heavy emphasis on accountability, ensuring that organizations are held responsible for any lapses in data governance. Together, these regulations create a comprehensive security net, compelling businesses to prioritize cybersecurity as a core operational necessity rather than an optional IT function.