Cyber resilience — surviving the incident prevention didn't stop.

Cybersecurity is about preventing and detecting an incident. Cyber resilience is the broader capability to keep critical operations running during an incident and recover on a tested, documented timeline afterward — it assumes prevention will eventually fail and asks what happens next. RBI's 2026 Resilience & Assurance Framework and SEBI's CSCRF both now examine resilience and recovery capability directly, not just preventive controls, which is why "we have a firewall and an antivirus" no longer satisfies a regulator or an enterprise customer's due diligence.

The RBI (Commercial Banks — Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, effective 31 July 2026, replaced the previous patchwork of circulars with a single consolidated framework requiring a 24×7 Cyber Security Operations Centre, continuous SIEM-based monitoring, vulnerability assessments every six months, annual penetration testing of critical internet-facing systems, and half-yearly disaster recovery drills with documented Recovery Time and Recovery Point Objectives. A parallel NBFC-specific direction was issued the same day; RBI's regulatory pattern has consistently extended bank-level requirements to NBFCs within 12 to 18 months.

The 6-hour CERT-In notification obligation under the 2022 Directions doesn't change, but an organisation with a genuine resilience programme — a tested incident response plan, a pre-identified legal and technical team, evidence-preservation procedures already documented — can actually meet that window with an accurate, defensible notification. Without that preparation, the 6-hour clock is frequently missed or met with a rushed, incomplete filing that creates its own regulatory exposure.

No. RBI and SEBI frameworks are the most codified examples, but CERT-In's Directions apply across sectors, and enterprise customers increasingly require resilience evidence — tested recovery timelines, documented incident response — as part of vendor due diligence regardless of industry. Ransomware and cloud misconfiguration attacks, the two fastest-growing threat categories in India, don't discriminate by sector.

It's mapped directly to the frameworks that actually apply to Indian organisations today — RBI's 2026 Framework, SEBI CSCRF, CERT-In — rather than a generic international maturity model retrofitted with Indian references. It's also conducted under legal engagement, so findings are protected by attorney-client privilege, and it's delivered by the same team available to run incident response if the audit surfaces something that needs it.

The Resilience Audit is the right starting point if you don't yet know where your gaps are — it's the diagnostic. SIRI Shield is the ongoing retainer for organisations ready to operate a continuous resilience programme (monitoring, testing, incident response) rather than address it as a point-in-time project. Many clients start with the audit and move into a Shield retainer once the roadmap is clear.