ISO 27001 in India
Indian security rules on one page, and where the ISMS fits
An Indian company can answer to CERT-In, the DPDP Act and a sector regulator at once. Each asks for security in its own words and at its own depth. This page lays them side by side in one table, so you can see which ones touch you and where a single ISMS can carry the shared work.
Back to ISO 27001 services01 · How to read it
How to read the map
Four columns, cautious by design.
- Instrument
- The law, rule or regulator document, named as precisely as we could confirm.
- Reaches
- Who it applies to, broadly. Exact applicability depends on licences, size and definitions.
- Asks, broadly
- The kind of security it expects. Not a full list of duties.
- How an ISMS answers
- What an ISO 27001 system can carry and evidence. It never means the instrument is satisfied by a certificate.
Regulators revise these instruments often. Rows marked as checked against the primary text were read for this page; the others are summaries to confirm with the regulator's current text and your counsel.
02 · Cross-sector rules
Rules that reach almost everyone
Start here: these apply whatever your sector.
| Instrument | Reaches | Asks, broadly | How an ISMS answers |
|---|---|---|---|
| CERT-In directions of 28 April 2022 under IT Act section 70B(6) (checked against text) | Service providers, intermediaries, data centres, body corporate, Government organisations | Report listed incidents within 6 hours; 180-day logs kept in India; NTP sync to NIC or NPL; a Point of Contact | Incident, logging and clock controls carry the process; you prove the specific numbers yourself |
| IT Act section 43A and the reasonable security practices rules of 2011 | Body corporate handling sensitive personal data | Reasonable security practices; the rules name ISO 27001 as one recognised standard | A strong fit while the provision stands; check its status as the DPDP Act commences |
| Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 | Data fiduciaries processing digital personal data in India, and some abroad | Reasonable security safeguards, breach intimation, plus consent, notice and rights duties | Carries the safeguards duty for data in scope; consent, notices and rights sit outside |
03 · Sector rules
Sector regulators
Each sets its own governance and reporting layer on top.
| Instrument | Reaches | Asks, broadly | How an ISMS answers |
|---|---|---|---|
| RBI master directions on IT governance and on cyber security, and related circulars | Banks, NBFCs and other RBI-regulated entities, by category | Board-level IT and security governance, risk management, audits, incident reporting to RBI | Risk, supplier, logging and incident controls carry much of it; board oversight and RBI reporting are added on top |
| SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) | SEBI-regulated entities, graded by category | Governance, identify-protect-detect-respond-recover controls, audits and reporting to SEBI | Annex A covers much of the control set; SEBI's audit, reporting and category rules remain |
| IRDAI Information and Cyber Security Guidelines | Insurers and other IRDAI-regulated entities | Security policy, governance roles, audits and incident reporting | Clause 5 leadership and Annex A carry the policy and controls; IRDAI's specific roles and reporting remain |
| Telecom cyber security rules under the Telecommunications Act, 2023 | Telecommunication entities | Security policies, incident reporting, a security officer | Incident and governance controls help; telecom-specific duties remain |
| Health data policy under the Ayushman Bharat Digital Mission | Entities in the ABDM ecosystem | Security and privacy of health data handled through the mission | Controls over health records in scope; mission-specific consent and rules remain |
04 · When two apply
When two instruments touch the same duty
Meet the stricter number, and keep separate proof for each.
- List every row above that applies to you in the ISMS legal register (Annex A 5.31), with an owner each.
- For each shared topic (incidents, logs, suppliers), write down what each instrument asks, side by side.
- Where they set different numbers, design for the strictest: the shortest reporting window, the longest log retention.
- Where they ask for different recipients or formats, keep one process with separate outputs, such as one triage step that produces a CERT-In report and a regulator report.
- Where they conflict, such as a retention duty against an erasure duty, record the decision and its basis, and take legal advice.
- Test each instrument's specific numbers in your internal audit, since the certification audit will not.
Illustrative: an NBFC with a mobile app
A lending company falls under RBI rules, the CERT-In directions and the DPDP Act. A ransomware event is reportable to CERT-In within six hours, may be reportable to RBI under its own rules, and is a personal data breach if borrower data was touched. One incident procedure, three clocks, three records.
05 · Detail pages
Where to go next
Each row has a page of its own.
- ISO 27001 and CERT-In directionsIncident reporting and logging duties, and the ISMS.
- ISO 27001 and the DPDP ActHow the ISMS carries the Act's security safeguards duty.
Sources: CERT-In directions No. 20(3)/2022-CERT-In of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000; the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; RBI, SEBI, IRDAI, Department of Telecommunications and National Health Authority instruments as named in the table, to be confirmed against current texts; ISO/IEC 27001:2022 clause and control titles.
Questions about the regulatory map
Does any Indian regulator accept ISO 27001 in place of its own rules?
We know of none that treats it as full compliance.
Regulators may recognise a certificate as useful evidence, but each sets its own governance, audit and reporting duties. Plan to show both the ISMS and the instrument's specific requirements.
Which row should we start with?
CERT-In and DPDP, then your sector regulator.
The CERT-In directions and the DPDP Act reach most companies. Add your sector regulator next, since its rules usually add governance and reporting on top.
How often should we refresh the map?
At each management review, and when a regulator issues something new.
Make the legal register a standing management review input, and assign someone to watch circulars from each regulator that applies to you.
We are a SaaS vendor to banks. Do RBI rules apply to us?
Usually through your customer's contracts, not directly.
Regulated entities pass many duties to vendors through outsourcing contracts and audit rights. Read those clauses closely, and have counsel confirm what binds you.
See which rows apply to you.
An ISO 27001 gap analysis builds your legal register and maps each instrument to your controls. Counsel should confirm how each law applies to your contracts.