The regulations behind your security budget
A practical map from India's cyber-security and data-protection rules to the controls they demand, and the ARKA products that help you implement them.
CERT-In Directions (28 April 2022)
Report specified cyber incidents to CERT-In within 6 hours; keep ICT system logs for 180 days within Indian jurisdiction; synchronise clocks to NTP.
Digital Personal Data Protection Act, 2023 & Rules, 2025
Reasonable security safeguards for personal data, consent and purpose limitation, breach notification to the Data Protection Board and affected individuals. Penalties up to ₹250 crore.
CEA (Cyber Security in Power Sector) Guidelines, 2021
Network segregation of OT from IT, removable-media control, secure remote access, asset inventory, and use of tested and trusted equipment.
Ministry of Power order on imported equipment (2020)
Imported power-sector equipment to be tested in Indian labs for embedded malware or trojans.
CERT-In Technical Guidelines on SBOM (2024)
Guidance for producing and consuming Software Bills of Materials, especially for government and critical-sector procurement.
RBI Master Direction on IT Governance, Risk, Controls & Assurance (2023)
SOC monitoring, cryptographic controls, network segmentation and vendor access governance.
SEBI Cybersecurity & Cyber Resilience Framework (CSCRF, 2024)
SOC (including market-SOC), log retention, encryption and incident reporting for regulated entities.
NCIIPC / IT Act Section 70: Critical Information Infrastructure
Protected systems must follow NCIIPC controls, including strict segregation and monitoring.
Need a compliance-mapped proposal?
We map ARKA products clause by clause to your audit or RFP requirements.