Latest Articles
The 6-Hour Rule: How India's CERT-In Mandate Is Reshaping Cyber Incident Response
Mandatory cyber incident reporting within 6 hours of detection. RBI, IRDAI, SEBI, and DPBI all running from the same timestamp. Criminal liability under IT Act §70B for non-compliance. What every Indian BFSI enterprise must have in place before the next incident.
IRDAI's March 2025 Cybersecurity Revision: What Every Insurer Needs to Know
Mandatory reporting tightened to 6 hours. Board attestation now submitted to IRDAI. Applicable to TPAs, brokers, web aggregators, ISNPs, and IMFs — not just insurers.
5 min readRead article →
DPDP Meets Vendor Risk: Why Your Third-Party Contracts Are Now a Compliance Problem
DPDP §8/§9 imposes DPA obligations for every vendor processing personal data. The sub-processor problem. What an RBI inspector asks when they arrive.
5 min readRead article →
From 80-Page Nessus Report to Actionable Risk Findings: How AI Is Changing VAPT
AI extracts every finding, maps to UCL controls, sets deadlines by severity, and closes IRDAI.AUDIT.1 automatically. The security team shifts from data entry to decision-making.
4 min readRead article →
Why Indian BFSI Needs a Risk Graph, Not a Risk Register
Your risk register doesn't know the system changed, the control was deprecated, or that a new IRDAI circular changed the obligation. A risk graph knows. SEBI CSCRF's continuous audit mandate makes this the architecture question of 2025.
6 min readRead article →
Regulatory Checklists
Technical Guides — RiskSage Platform