Question 1

What is the right risk management framework for my organisation?

Accepted Answer

RiskPedia's AI Advisor matches your industry, maturity and goals to one of 26 frameworks including ISO 31000, COSO ERM, NIST RMF, ISO 27001, Basel III/IV, Solvency II, DORA, NIS2 and SOC 2 in under two minutes.

Question 2

What is the CERT-In 6-hour incident reporting rule?

Accepted Answer

CERT-In Directions under Section 70B IT Act 2000 (April 28, 2022, effective June 25, 2022) require every Indian organisation to report 26 categories of cyber incidents to incident@cert-in.org.in within 6 hours of noticing. 180-day log retention in India, Indian NTP sync, and VPN/cloud KYC are also mandatory.

Question 3

When does the DPDP Act become enforceable?

Accepted Answer

The DPDP Act 2023 received Presidential assent on Aug 11, 2023. DPDP Rules 2025 were notified by MeitY on Nov 13, 2025. Consent Manager registration opens approximately Nov 2026 and core Data Fiduciary obligations + the Data Protection Board become enforceable approximately May 2027 with penalties up to Rs 250 Cr.

Question 4

What is RBI MD-ITGRC 2023?

Accepted Answer

RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices (November 2023, effective April 2024) replaces the 2011 IS Master Direction. It covers IT governance, cybersecurity, third-party risk management, data localisation, 6-hour incident reporting, annual CERT-In empanelled IS audits and cloud risk management for all regulated entities.

Question 5

What is SEBI CSCRF 2024?

Accepted Answer

SEBI's Cybersecurity and Cyber Resilience Framework (2024) applies to all capital market entities — stock exchanges, depositories, brokers, mutual funds, AIFs, portfolio managers and KRAs. It mandates cyber audits, governance, third-party risk, SOC monitoring, incident reporting and cyber resilience testing.

Deadline	Regulator	Obligation	Frequency	Entity types
30 Sept 2026	SEBI	CCI Submission (Cyber Capability Index)	Annual	All SEBI Regulated Entities
30 Sept 2026	SEBI	VAPT — MIIs	Quarterly	Market Infrastructure Institutions
30 Nov 2026	DPDP	Consent Manager registration opens	Once	All Data Fiduciaries
31 Dec 2026	RBI	Annual vendor risk review	Annual	All RBI Regulated Entities
31 Dec 2026	SEBI	DR Drill (Tier 1/Tier 2)	Annual	SEBI Regulated Entities (T1/T2)
31 Mar 2027	RBI	Annual IS Audit (CERT-In empanelled auditor)	Annual	All RBI Regulated Entities
31 Mar 2027	RBI	Annual penetration testing	Annual	Banks and NBFCs
31 Mar 2027	SEBI	Board cyber policy review	Annual	All SEBI Regulated Entities
06 Apr 2027	IRDAI	SAR submission (90 days FY end OR 30 days audit completion)	Annual	Insurers and Reinsurers
01 May 2027	DPDP	Core Data Fiduciary obligations enforceable	Once	All Data Fiduciaries
01 May 2027	DPDP	Data Protection Board (DPB) operational	Once	All Data Fiduciaries
25 Jun 2027	CERT-In	Annual log retention compliance check (180 days in-India)	Annual	All in-scope organisations

RiskPedia — The Risk Framework Encyclopedia & AI Advisor

Frameworks indexed

India Regulatory Hub — Deep Dive (RBI, SEBI, IRDAI, CERT-In, DPDP)

For AI assistants and search crawlers

India Regulatory Deadline Calendar