As financial institutions operating in International Financial Services Centres (IFSCs) continue to evolve as global financial hubs, they face an increasing risk of cyber threats. Recognizing the critical need for robust cyber security, the International Financial Services Centres Authority (IFSCA) has issued comprehensive Guidelines on Cyber Security and Cyber Resilience for regulated entities (REs) within IFSCs. These guidelines aim to safeguard financial entities from cyber risks while ensuring the stability, resilience, and credibility of IFSC operations. Which increases Cyber Security and Resilience in GIFT IFSC
Key Components of Cyber Security and Resilience Guidelines
To ensure a strong cyber security framework, the guidelines focus on five key areas:
1. Governance
A well-defined governance mechanism is essential to manage cyber risks effectively. The Oversight Body, which may consist of the governing board, senior management, or designated committees, is responsible for cyber security decision-making. REs must ensure their leadership possesses the necessary expertise to oversee cyber risk management and cultivate a strong security culture within the organization.
Key Actions:
Appoint a Chief Information Security Officer (CISO) or a designated senior officer.
Establish clear roles and responsibilities for cyber risk management.
Promote organization-wide cyber awareness and accountability.
2. Cyber Security and Cyber Resilience Framework
REs must develop a Cyber Security and Cyber Resilience Framework that ensures the confidentiality, integrity, and availability of IT assets. This framework should:
Define the organization’s cyber risk appetite and resilience objectives.
Establish policies for asset identification, risk assessment, and classification.
Implement international best practices such as ISO 27000 and NIST security standards.
Regularly update and review security measures to adapt to evolving threats.
Key Measures:
Access Control: Enforce strict authentication mechanisms and follow the principles of least privilege and segregation of duties.
Vulnerability Assessments & Testing: Conduct Vulnerability Assessment and Penetration Testing (VAPT) at least once a year.
Incident Management: Define and implement procedures for detecting, responding to, and recovering from cyber incidents.
Audit Trails: Maintain audit logs to facilitate compliance, forensic analysis, and dispute resolution.
3. Third-Party Risk Management
Given the reliance on external vendors, REs must adopt a collaborative security approach by:
Establishing clear security expectations with third-party service providers.
Conducting biannual security reviews for critical vendors.
Implementing an incident escalation process to address non-compliance or security breaches.
Ensuring the ultimate responsibility for cyber risk remains with the REs, even if outsourced.
4. Communication & Awareness
Human error remains one of the most significant cyber security risks. REs are required to:
Conduct regular cyber awareness training on phishing, social engineering, and incident reporting.
Provide accessible channels for employees to report vulnerabilities and suspicious activities.
5. Audit & Compliance
To provide independent assurance, REs must conduct annual cyber security audits performed by:
A CERT-In empaneled auditor, or
An independent auditor with certifications such as CISA, CISM, CISSP, or GSNA.
Audit reports must be submitted to IFSCA within 90 days of the financial year-end, with REs encouraged to adopt a higher audit frequency based on their risk exposure.
Reporting Cyber Incidents
In case of a cyber breach, REs must:
Report the incident to IFSCA within 6 hours of detection.
Submit an interim report within 3 days and a root cause analysis report within 30 days.
Implement mitigation measures within 7 days to prevent recurrence.
Exemptions and Special Cases
Certain REs, including branches of regulated Indian or foreign entities, Global In-House Centres (GICs), small firms (less than 10 employees), and foreign universities, are exempted from specific requirements. However, they must align with their parent entity’s cyber security framework and ensure compliance.
Conclusion
Cyber security is no longer an optional component—it is a fundamental necessity for financial institutions operating in IFSCs. By implementing these guidelines, regulated entities can enhance their resilience against cyber threats, protect sensitive data, and uphold the trust of international clients.
Call to Action: As cyber threats continue to evolve, are you confident in your organization's cyber security posture? Now is the time to strengthen your defenses and align with IFSCA’s guidelines to ensure a secure and resilient financial ecosystem.
For more details, visit IFSCA’s official website. Let’s build a safer and more secure digital financial world together!
Comments