Comprehensive Blueprint of the IFSCA Cyber Resilience and Security Framework for MIIs in GIFT City

To fortify the digital infrastructure of India's premier financial hub, the regulatory body for the International Financial Services Centres has rolled out an exhaustive set of digital security mandates. Through Circular No. IFSCA-CSD/MSC/2/2026-DCS, dated April 20, 2026, a highly granular and prescriptive cybersecurity architecture has been established for Market Infrastructure Institutions (MIIs).

These institutions—which encompass clearing corporations, depositories, bullion exchanges, and stock exchanges operating within the GIFT IFSC—are recognized as systemically vital. While a baseline security directive was previously circulated on March 10, 2025, the sheer criticality of MIIs necessitates a much more rigorous defense mechanism. This newly minted framework, which officially takes effect on April 1, 2026, is intricately designed around seven foundational pillars: Governance, Identification, Protection, Detection, Response, Recovery, and Resilience.

1. The Governance and Leadership Mandate

The cornerstone of any robust digital defense is accountability at the highest echelon of an organization. The regulatory guidelines mandate that the Governing Board of the assessee (the regulated MII) must formally approve a comprehensive Cyber Security and Cyber Resilience Policy.

Leadership and the CISO

A dedicated Chief Information Security Officer (CISO) must be appointed to spearhead the digital defense strategy. To ensure that security concerns are never sidelined by operational pressures, this CISO is required to bypass traditional reporting hierarchies and report directly to the Managing Director (MD) or Chief Executive Officer (CEO). The CISO's primary duties involve mitigating digital risks, establishing security protocols, and managing active threats.

Committee Oversight

The Standing Committee on Technology (SCOT) is tasked with reviewing the implementation of this security policy bi-annually. Furthermore, the framework demands that the Board and Senior Management possess adequate technical acumen to comprehend modern digital threats. For entities classified as Critical Information Infrastructure (CII) by the NCIIPC, adherence to the specific NCIIPC protection guidelines is strictly compulsory.

2. Strategic Identification of Digital Assets

Before an assessee can protect its network, it must possess absolute visibility into its digital footprint.

Asset Inventory and Classification

MIIs are obligated to maintain a dynamic, real-time inventory of all digital assets. This includes domain names, Application Programming Interfaces (APIs), shared cloud resources, and both internal and external interfacing systems.

Assets must be categorized based on their operational criticality and the sensitivity of the data they house. Critical assets typically include:

  • Systems managing Personally Identifiable Information (PII)
  • Applications directly facing the public internet
  • Core business transaction engines
  • Databases storing sensitive financial records

The Governing Board is required to ratify this list of critical assets at least once annually. Additionally, the assessee must conduct a thorough, organization-wide risk assessment every year to quantify potential vulnerabilities and their systemic impact on market continuity.