The IFSCA Cyber Security and Cyber Resilience Guidelines for GIFT City entities establish mandatory cyber risk management standards, with conditional, time-limited exemptions introduced in March 2026 for specified regulated entities.

Scope and the Proportionality Principle

The IFSCA Guidelines on Cyber Security and Cyber Resilience, issued by circular dated 10 March 2025, apply to “Regulated Entities”, defined for this purpose as any entity licensed, recognised, registered or authorised by IFSCA. That is the widest formulation used in the IFSC rulebook, and it captures fund management entities, banking units, insurers, intermediaries, payment service providers, finance companies and others alike.

Implementation is to follow the principle of proportionality, taking into account the scale and complexity of operations, the nature of the activity, the entity’s interconnectedness with the financial ecosystem, and the corresponding cyber risks to which it is exposed. Proportionality is not an exemption; it calibrates the depth of controls.

The Guidelines have five components: governance; the cyber security and cyber resilience framework; third party risk management; communication and awareness; and audit.

Governance: the Oversight Body and the Designated Officer

Entities must have governance mechanisms with clear roles and responsibilities for managing cyber risk. The stakeholders involved are collectively the “Oversight Body”, which may comprise the governing board, senior management (the managing director, CEO, CISO, CTO, principal officer or compliance officer), or committees designated by them.

The governing board and senior management must possess sufficient expertise to understand and manage cyber risk, and must set the tone and cultivate a culture of cyber risk management at all levels.

Each entity must appoint a CISO, or designate a senior employee or management person, to assess, identify and reduce cyber security risks, respond to incidents, establish standards and controls, and direct the implementation of processes approved by the Oversight Body. That person is the “Designated Officer”.

The Framework Itself

The cyber security and cyber resilience framework must maintain the confidentiality, integrity and availability of IT assets, and must:

• aim to maintain and promote the ability to anticipate, withstand, contain and recover from cyber-attacks;
• take an integrated and comprehensive view of potential threats, including third party risks;
• define the entity’s cyber risk appetite and resilience objectives;
• outline people, process and technology requirements; and
• establish the roles, responsibilities and communication lines to be followed during a cyber incident.

An Information Security Policy must be formulated as part of the framework. Two requirements within it deserve particular attention.

VAPT. Vulnerability assessment and penetration testing must be conducted to detect vulnerabilities across critical systems, infrastructure components and other IT systems, at the frequency specified.

Defining “cyber incident”. The IS Policy must clearly define the term. This is more consequential than it appears: the definition determines when response, disclosure and reporting obligations are triggered, and entities must establish mechanisms to fulfil the disclosure and reporting requirements specified by IFSCA during and after an incident.

Audit trails must exist for IT assets so that they facilitate audit and serve as forensic evidence when required.

Third Parties, Training and Audit

Third party risk. Entities must adopt a collaborative security approach with third-party providers, covering incident reporting and adherence to security standards, and must review third-party arrangements periodically on a risk basis, including assessment for vulnerabilities or compliance gaps. Clear communication channels and escalation procedures are required. Crucially, the ultimate responsibility to mitigate cyber risks arising from third parties remains with the regulated entity.

Training and reporting channels. Regular employee training is required, including on password hygiene and incident reporting, and entities must establish clear and accessible channels for staff to report suspicious activity, vulnerabilities and potential incidents.

Audit. The entity’s cyber risk management must be audited annually by a CERT-In empanelled auditor, an independent auditor holding the specified certifications, or an auditor with prior experience of cyber security audits. The auditor must have no conflict of interest with the entity, and must certify whether the security controls implemented are adequate. The audit report must be submitted to IFSCA within 90 days from the end of the financial year, to the relevant supervision department or division. Entities may adopt a higher frequency than the minimum.

The 2026 Amendment: Conditional, Time-Limited Relief

By circular dated 10 March 2026, IFSCA amended the Guidelines after representations from entities about compliance difficulties. Two groups received three-year exemptions from the date of issuance of the amendment.

Group one, under the substituted paragraph 21: an RE operating as a branch of a regulated Indian or foreign entity; an RE providing services only to its group entities, such as a Global In-house Centre; and an RE with fewer than 10 employees.

The relief is conditional. During the exempted period such an entity must:

• adopt the cyber security and cyber resilience framework and IS Policy of its parent or the parent’s holding company;
• have the parent’s CISO act as its Designated Officer;
• have a parent or holding company, in India or overseas, that is regulated by a regulator or government body in its home jurisdiction;
• have its Designated Officer certify that all necessary systems and processes in line with the Guidelines are in place, submitted to the relevant IFSCA supervision department within 90 days of the end of each financial year; and
• submit the annual cyber security audit report to IFSCA.

Group two, under the inserted paragraph 23: a foreign university set up in the IFSC; an RE established as a newly incorporated standalone entity in the IFSC without a parent organisation; and a credit rating agency. During the exempted period, the Designated Officer must certify that the entity has implemented adequate cyber security measures proportionate to its risk exposure, submitted within 90 days of each financial year end.

Read carefully, the relief substitutes group-level compliance and annual certification for standalone implementation. It does not suspend the audit report obligation for group one, and it does not remove the need for a Designated Officer.

Related Instruments

Two further IFSCA instruments should be read alongside the Guidelines: the Guidelines on Cyber Security and Cyber Resilience for Market Infrastructure Institutions (MIIs) in IFSC, issued by circular dated 20 April 2026, which address exchanges, clearing corporations and depositories; and the advisory dated 4 June 2026 on heightened cyber security risks arising from frontier artificial intelligence models.

Entities should also consider obligations arising outside the IFSCA framework, including incident reporting duties under India’s cyber security law and the data protection obligations discussed in Article 37, which apply to personal data irrespective of the cyber framework.

Frequently Asked Questions

1. What are the IFSCA Cyber Security and Cyber Resilience Guidelines?

Issued on 10 March 2025, these Guidelines establish cyber security, governance, risk management, training and audit requirements for IFSCA-regulated entities.

2. Who must comply with the Guidelines?

They apply broadly to entities licensed, recognised, registered or authorised by IFSCA, subject to applicable exemptions.

3. What are the key compliance requirements?

Key requirements include appointing a Designated Officer, implementing a cyber security framework, conducting VAPT, managing third-party risks and completing an annual cyber security audit.

4. What exemptions were introduced in 2026?

The 10 March 2026 amendment grants conditional, three-year exemptions to specified categories of entities, subject to prescribed safeguards and certification requirements.

5. Are exempted entities free from all cyber security obligations?

No. Exempted entities must meet the conditions applicable to their category, including relevant framework adoption, annual certification and audit-reporting requirements.

The post IFSCA Cyber Security and Cyber Resilience Guidelines: Rules and Exemptions for GIFT IFSC appeared first on Bhatt & Joshi Associates.