Cybersecurity GRC & compliance in India — compliance that holds up in court. GRC backed by legal authority.

CSCRF was issued in August 2024 and went through multiple deadline extensions — from an original 31 March 2025 target, pushed to 30 June 2025, then to 31 August 2025 for most regulated entities. That deadline has now passed with no further blanket extension, and CSCRF is in its recurring audit cycle: Qualified and mid-size regulated entities face a 30 June 2026 deadline for their first cyber audit, with daily penalties of roughly ₹1,500 to ₹5,000 for non-compliance plus regulatory action from NSE and BSE. SEBI has also layered a 5 May 2026 AI Vulnerability Detection Advisory onto the framework, adding specific directives for AI-related risk. Confirm your entity's specific tier and current cycle date before assuming any single deadline applies uniformly.

The DPDP Rules 2025 were notified on 14 November 2025, not merely "expected" as some compliance content still states. The operative compliance deadline for most substantive obligations is 13 May 2027, giving organisations a genuine transition window rather than an immediate cliff, but the Data Protection Board is already staffed and active, and building consent architecture, breach protocols, and a Data Processing Agreement register now is materially cheaper than a compressed effort closer to the deadline.

A consulting firm's gap assessment is a document with no legal standing — it cannot be used as a defence in regulatory proceedings, and the work product is generally discoverable, meaning your own audit findings can be used against you in litigation. SIRI's GRC engagements are conducted as legal advisory from the outset, so findings, policies, and audit reports are protected by attorney-client privilege, and the policies themselves are drafted as enforceable legal instruments rather than generic templates.

Our standard five-phase methodology runs gap assessment in weeks 1–2, roadmap development in week 3, implementation across weeks 4–12, audit readiness in weeks 13–16, and certification support on an ongoing basis. Actual timelines vary by framework and organisational complexity — our fastest dual-framework certification (ISO 27001 and SEBI CSCRF simultaneously) was completed in 18 weeks with zero regulatory findings.

Yes, and it's frequently more efficient to do so. Many frameworks share overlapping controls — access management, logging, incident response, vendor risk — so a well-scoped engagement can build the documentation and technical controls that satisfy ISO 27001, SEBI CSCRF, and DPDPA simultaneously, as demonstrated in our NBFC case study above.

Consequences vary by framework — CSCRF non-compliance carries daily penalties plus potential NSE/BSE action; DPDPA violations can reach ₹250 crore for security safeguard failures; CERT-In reporting failures carry their own regulatory consequences. In every case, documented remediation efforts and a credible compliance trajectory materially affect how a regulator responds to a missed deadline, which is why continuous monitoring matters more than a single point-in-time assessment.