India Compliance Framework

Wealthy’s consolidated regulatory controls register — IRDAI Cyber Security Guidelines 2024, SEBI CSCRF Aug 2024, CERT-In Directions 2022, and DPDP Act 2023.

India Compliance Framework

Wealthy’s consolidated regulatory register. Lists every Indian regulation / circular / act that applies to Wealthy, plus a control-level register mapping each requirement onto an operational control.

Regulatory sources

Full list of regulations and circulars Wealthy operates under. Each new circular from a regulator lands here first; then, if it has operational controls, those controls are added to the register below.

Short ID	Source	Issued	Applicability to Wealthy	Key obligations
IRDAI	IRDAI Cyber Security Guidelines 2024	Updated 2024	Corporate Agent / Insurance Intermediary under IRDAI Corporate Agents Regulations 2015	ISRMC quarterly, CISO independent of IT, VAPT half-yearly, CERT-In-empaneled audit annual, Annexure-III submission, cryptographic asset inventory, immutable backup, MeitY/STQC-empaneled CSPs
SEBI CSCRF	SEBI Cyber Security and Cyber Resilience Framework — Master Circular	20 Aug 2024 (ref SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113)	Broking / market entities	Six CSCRF functions, Annexure-N SOC Efficacy half-yearly, Annexure-E risk register, Annexure-F vendor register, Annexure-O incident classification, CCI tracking, privileged access weekly verification
SEBI Accessibility	SEBI Circular — Digital Accessibility for Persons with Disabilities	31 Jul 2025 (ref SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/111)	All SEBI-Regulated Entities including Intermediaries	Nodal Officer for digital accessibility, WCAG 2.1 / IS 17802 / GIGW conformance, annual IAAP-certified accessibility audit, grievance redressal, procurement clauses, annual compliance reporting
CERT-In	CERT-In Directions April 2022	28 Apr 2022	All Indian service providers + intermediaries	6-hour incident reporting, 180-day log retention, Indian NTP sync, designated PoC, 20 reportable incident categories
DPDP	Digital Personal Data Protection Act 2023	2023 (Rules notification awaited)	All Data Fiduciaries + Data Processors handling Indian personal data	Consent management, data principal rights, Grievance Officer, 72-hour breach notification, data processing register, cross-border controls
RPwD	Rights of Persons with Disabilities Act 2016 + Rules 2017	2016 (Act), 2017 (Rules)	All service providers with digital platforms for public use	Sections 40, 42, 46 — accessibility for persons with disabilities; baseline for SEBI Accessibility circular above
IT Act	Information Technology Act 2000	2000 (amended 2008)	All Indian service providers	Base law for digital identity, electronic records, intermediary liability, data protection (pre-DPDP)
IT Rules 2021	Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021	2021	Significant intermediaries + social-media-like platforms	Grievance officer, content takedown, user notification, safe harbour conditions — implemented via POL-014

Not currently in scope but monitored: RBI Outsourcing Guidelines (when loan-origination scope expands), PCI DSS 4.0 (if card data is stored in future, currently tokenised), SEBI Stock Broker Regulations 1992 (if broking license), Insurance Regulatory Framework (if underwriting license).

Status legend for the control register below: ⬜ Pending review · ✅ Done · ⚠️ Partial · N/A Not applicable

How this is maintained

Artefact	Purpose
This page	Public reference: structure, control IDs, framework mapping, current status
Internal controls register (private)	Full evidence links, verification commands, action owners — not published
Live Google Sheet (Security Drive folder)	Operational tracker; quarterly updates reviewed at ISRMC
Quarterly PDF snapshot	Attached to the matching ISRMC GitHub Issue as immutable audit evidence

Each quarter the ISRMC meeting produces a PDF snapshot of the Sheet, attached to a GitHub Issue using the ISRMC Quarterly Review template. The resulting trail is what IRDAI / SEBI / CERT-In auditors walk through.

Control IDs here are the anchors referenced from the Security Governance Calendar (Framework column) and from individual Policies, Standards, and SOPs.

A. Governance

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
A1	Board-approved Cyber Security Policy	✓	✓	-	-	⬜
A2	Appoint CISO (no IT-reporting line, no business targets)	✓	✓	-	-	⬜
A3	Appoint CTO / Head of IT Function	✓	-	-	-	⬜
A4	ISRMC meeting — quarterly	✓	-	-	-	⬜
A5	IT Steering Committee (ITSC) — quarterly, CTO convener	✓	-	-	-	⬜
A6	RMC must include Independent External Expert (IEE)	✓	-	-	-	⬜
A7	Functional Head responsibilities documented	✓	-	-	-	⬜
A8	Scenario-based Incident Response plans	✓	✓	-	-	⬜
A9	Designated Grievance Officer (DPDP)	-	-	-	✓	⬜
A10	Designated CERT-In Point of Contact	-	-	✓	-	⬜
A11	Six CSCRF Functions (Govern / Identify / Protect / Detect / Respond / Recover)	-	✓	-	-	⬜
A12	Exception Management process (CISO / RMC / Board tiers)	✓	-	-	-	⬜
A13	Cybersecurity budget proportional to risk appetite	✓	✓	-	-	⬜
A14	Training budget tracked and spent	-	✓	-	-	⬜

B. Risk & Asset Management

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
B1	Risk Register (SEBI Annexure-E)	✓	✓	-	-	✅
B2	Asset classification register (critical / client / regulatory)	✓	✓	-	-	⬜
B3	Cryptographic asset inventory (post-quantum readiness)	✓	-	-	-	⬜
B4	Data classification scheme	✓	✓	-	✓	⬜
B5	Data processing activity register (DPDP)	-	-	-	✓	⬜
B6	Third-party / vendor risk register (SEBI Annexure-F)	✓	✓	-	-	✅
B7	Cyber Capability Index tracking (SEBI Annexure-K)	-	✓	-	-	⬜

C. Access Control

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
C1	Role-Based Access Control (RBAC)	✓	✓	-	-	⬜
C2	Multi-Factor Authentication (MFA)	✓	✓	-	-	⬜
C3	Privileged Access Management (PAM)	✓	✓	-	-	⚠️
C4	Privileged access weekly verification	-	✓	-	-	⬜
C5	Quarterly access reviews	✓	✓	-	-	⬜
C6	MeitY / STQC empaneled CSP	✓	-	-	-	⬜
C7	NDA with CSP (privacy / confidentiality / security / BC)	✓	-	-	-	⬜
C8	Data elimination clause on CSP contract termination	✓	-	-	-	⬜
C9	Prior written permission for further outsourcing	✓	-	-	-	⬜

D. Detection — SIEM / SOC / EDR

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
D1	SIEM (centralised log collection + correlation)	✓	✓	✓	-	✅
D2	EDR on endpoints	✓	✓	-	-	✅
D3	Anti-virus / Endpoint Protection Platform	✓	✓	-	-	✅
D4	File Integrity Monitoring (FIM)	✓	✓	-	-	✅
D5	Vulnerability Detection	✓	✓	-	-	✅
D6	Database Activity Monitoring (DAM)	✓	✓	-	✓	⬜
D7	Data Loss Prevention (DLP)	-	✓	-	✓	⬜
D8	Web Application Firewall (WAF)	✓	✓	-	-	✅
D9	DDoS protection	✓	✓	-	-	✅
D10	Email gateway security	✓	✓	-	-	✅
D11	Web gateway / Secure proxy	-	✓	-	-	⬜
D12	Intrusion Prevention System (IPS)	-	✓	-	-	⚠️
D13	DNS Security	-	✓	-	-	⚠️
D14	Encrypted traffic management	-	✓	-	-	⬜
D15	User and Entity Behaviour Analytics (UEBA)	-	✓	-	-	⬜
D16	Sandboxing solution	-	✓	-	-	⬜
D17	Decoy / Honeypot	-	✓	-	-	⬜
D18	Threat Intelligence integration with SIEM	-	✓	-	-	✅
D19	SOAR actions configured	-	✓	-	-	✅
D20	MITRE ATT&CK mapping	-	✓	-	-	✅
D21	Cloud audit logs (GCP + AWS)	-	✓	✓	-	✅
D22	GitHub audit logs	-	✓	✓	-	⚠️
D23	API misuse detection rules	-	✓	-	-	✅
D24	Insurance / trading API log ingestion	✓	✓	-	-	⬜

E. Logging & Retention

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
E1	Log retention — 180 days minimum	✓	-	✓	-	✅
E2	Log retention — 2 years (broking)	-	✓	-	-	✅
E3	NTP synchronisation	-	-	✓	-	⚠️
E4	Logs of all ICT systems	✓	✓	✓	-	✅
E5	SIEM alert retention with defined rollover	✓	✓	-	-	✅

F. Incident Response

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
F1	Incident detection → ticket (case management)	✓	✓	-	-	✅
F2	Report within 6 hours to regulator	✓	✓	✓	-	⬜
F3	SEBI Incident Reporting Portal within 24 hours	-	✓	-	-	⬜
F4	Data breach notification within 72 hours	-	-	-	✓	⬜
F5	Interim Report — 3 days	-	✓	-	-	⬜
F6	Mitigation measures report — 7 days	-	✓	-	-	⬜
F7	Root Cause Analysis (RCA)	✓	✓	-	-	⬜
F8	Forensic capability	-	✓	-	-	⬜
F9	Incident severity classification (SEBI Annexure-O)	-	✓	-	-	⚠️
F10	Stakeholder communication plan	✓	✓	-	-	⬜
F11	Lessons learned / post-incident review	✓	✓	-	-	⬜

G. Audit & Testing

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
G1	VAPT — Grey/White box penetration test every 6 months	✓	-	-	-	⬜
G2	VAPT — Quarterly vulnerability assessment + annual PT	-	✓	-	-	⬜
G3	Test environment resembles production	✓	-	-	-	⬜
G4	Annual cyber audit	✓	✓	-	-	⚠️
G5	CERT-In empaneled auditor only	✓	-	-	-	⬜
G6	Annexure-III compliance submission to Insurer	✓	-	-	-	⬜
G7	ISO 27001 certification	✓	✓	-	-	⬜

H. Infrastructure / Protection

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
H1	Encryption at rest	✓	✓	-	✓	✅
H2	Encryption in transit (TLS)	✓	✓	-	✓	✅
H3	Environment segregation (prod / staging / dev)	✓	✓	-	-	✅
H4	Group company infrastructure logical / physical segregation	✓	-	-	-	⬜
H5	Data localisation (India)	✓	✓	-	✓	✅
H6	API security controls (SEBI Annexure-G)	✓	✓	-	-	⬜
H7	Immutable backup for critical hardware	✓	-	-	-	⬜
H8	Failover / resilient components for critical hardware	✓	-	-	-	⬜
H9	Patch management	✓	✓	-	-	⚠️
H10	Endpoint hardening (screen lock, disk encryption, firewall)	✓	✓	-	-	⚠️

I. Business Continuity / DR

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
I1	Business Continuity Plan (BCP)	✓	✓	-	-	✅
I2	Disaster Recovery (DR) Plan	✓	✓	-	-	✅
I3	RTO / RPO tracking (SEBI Annexure-C)	-	✓	-	-	⬜
I4	DR drill documented	✓	✓	-	-	⬜
I5	Backup integrity verification	✓	✓	-	-	⬜

J. SOC Efficacy (SEBI Annexure-N)

SEBI CSCRF mandates half-yearly Annexure-N SOC Efficacy scoring. Final score ƩS is weighted across five domains.

ƩS = (C × 25 + Y × 25 + P × 20 + H × 15 + E × 15) / 100

Domain	Weight	Score variable
Asset Coverage (Table 30)	25%	C
SOC Operations (Table 31)	25%	Y
Personnel Competency (Table 32)	20%	P
SOC Governance (Table 33)	15%	H
SOC Enrichments (Table 34)	15%	E

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
J1	Half-yearly SOC Efficacy Report (Annexure-N)	-	✓	-	-	⬜
J2	Asset Coverage Score (Domain 1, 25%)	-	✓	-	-	⬜
J3	SOC Operations Score (Domain 2, 25%)	-	✓	-	-	⬜
J4	Personnel Competency Score (Domain 3, 20%)	-	✓	-	-	⬜
J5	SOC Governance Score (Domain 4, 15%)	-	✓	-	-	⬜
J6	SOC Enrichments Score (Domain 5, 15%)	-	✓	-	-	⬜
J7	Log ingestion latency < 5 min	-	✓	-	-	✅
J8	Threat intelligence processing < 60 min	-	✓	-	-	✅
J9	Threat hunting — quarterly	-	✓	-	-	⬜
J10	Playbooks defined per use case	-	✓	-	-	⚠️
J11	Native SOC tech dashboard	-	✓	-	-	✅
J12	Custom SOC dashboard	-	✓	-	-	⚠️
J13	False positive rate tracking	-	✓	-	-	⬜
J14	False negative rate tracking	-	✓	-	-	⬜

K. Privacy (DPDP Act 2023)

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
K1	Consent management system	-	-	-	✓	⬜
K2	Right to access / correction / erasure	-	-	-	✓	⬜
K3	Grievance redressal mechanism	-	-	-	✓	⬜
K4	Data retention limits per category	-	-	-	✓	⚠️
K5	Personal data breach 72h notification	-	-	-	✓	⬜
K6	Cross-border data transfer controls	-	-	-	✓	✅
K7	Significant Data Fiduciary obligations (if notified)	-	-	-	✓	N/A

L. CERT-In Incident Categories

CERT-In Directions April 2022 prescribe 20 incident categories with a 6-hour reporting obligation. Wealthy detects these through the SIEM ruleset and alerts surface in the Incident Response runbook.

#	Category
L1	Targeted scanning / probing
L2	Compromise of critical systems
L3	Unauthorised access to IT systems
L4	Website defacement / intrusion
L5	Malicious code (malware, ransomware)
L6	Attacks on servers (DB, mail, DNS)
L7	Identity theft, spoofing, phishing
L8	DDoS attacks
L9	DNS and BGP hijacking
L10	Attacks on critical infrastructure
L11	Data breach / data leak
L12	Fintech / payments attacks
L13	Fake mobile apps
L14	Social media account compromise
L15	Cloud attacks
L16	IoT device attacks
L17	Supply chain attacks
L18	Data centre attacks
L19	Cyber espionage
L20	Zero-day exploits

M. Personnel (SEBI Annexure-N Domain 3)

#	Control	IRDAI	SEBI	CERT-In	DPDP	Status
M1	L1 SOC Engineer (CEH, 2-4 YoE)	-	✓	-	-	⬜
M2	L2 SOC Engineer (CEH + OEM cert, 5-7 YoE)	-	✓	-	-	⬜
M3	L3 SOC Engineer (CEH + CISM, 8-12+ YoE)	-	✓	-	-	⬜
M4	Security awareness training	✓	✓	-	✓	✅
M5	Training budget tracked	-	✓	-	-	⬜

N. Digital Accessibility (SEBI Accessibility Circular 2025/111 + RPwD Act 2016)

Implements SEBI Circular 2025/111 (31 Jul 2025) and Rights of Persons with Disabilities Act 2016 §§40, 42, 46. Owned primarily by Product + Compliance; security’s touchpoint is in vendor procurement (STD-015).

#	Control	SEBI Access.	RPwD	Status
N1	Nodal Officer for digital accessibility designated	✓	✓	⬜
N2	Grievance redressal mechanism specific to accessibility	✓	✓	⬜
N3	WCAG 2.1 / IS 17802 / GIGW conformance for digital platforms	✓	✓	⬜
N4	Annual accessibility audit by IAAP-certified professional	✓	-	⬜
N5	Accessibility training for staff + content creators	✓	✓	⬜
N6	Accessibility clauses in RFPs + SaaS procurement	✓	-	⚠️
N7	KYC / e-KYC alternatives for users with disabilities	✓	✓	⬜
N8	Annual compliance report to SEBI (within 30 days of FY end)	✓	-	⬜
N9	Disability status captured as a KYC field + human override	✓	✓	⬜

Security Governance Calendar — every calendar event maps to a control ID here
Policies — each board-approved policy cites the controls it operationalises
Standards — each standard cites the controls it implements
SOPs — each procedure cites the controls it evidences

Reviewed quarterly at ISRMC; full-year review in the Annual Risk Assessment Report. Status updates are applied after each quarterly review. This page is the public (audit-facing) snapshot; internal evidence trail is maintained separately.

India Compliance Framework

India Compliance Framework

Regulatory sources

How this is maintained

A. Governance

B. Risk & Asset Management

C. Access Control

D. Detection — SIEM / SOC / EDR

E. Logging & Retention

F. Incident Response

G. Audit & Testing

H. Infrastructure / Protection

I. Business Continuity / DR

J. SOC Efficacy (SEBI Annexure-N)

K. Privacy (DPDP Act 2023)

L. CERT-In Incident Categories

M. Personnel (SEBI Annexure-N Domain 3)

N. Digital Accessibility (SEBI Accessibility Circular 2025/111 + RPwD Act 2016)

Related documents