Indian regulators publish expectations as directions and circulars rather than as frameworks. Turning them into a control set is work that falls to you. This hub collects everything we have written on that, in the order it is usually needed.
Start here
- Incident reporting deadlines — the four clocks, and which one starts first.
- What is TPRM — the vocabulary, before the obligations.
- Platform comparison — if you are choosing tooling.
By regulator
- RBI — the Level I baseline for urban co-operative banks, and the outsourcing directions.
- SEBI — CSCRF, and working out which category you fall into.
- CERT-In — the six-hour rule and what it actually asks for.
- IRDAI — the insurance-sector guidelines and their reporting format.
- DPDP — consent, notice and the processor obligations.
RBI UCB Level I — all 36 controls
The Level I baseline written out as a working checklist you can take into a board meeting.
DownloadFacts last verified 28 Aug 2026
Written by
Aparna IyerHead of Compliance Research · CISA, ISO 27001 Lead Auditor
Reviewed by M. Raghavan, CA, DISA (ICAI)
