Get audit-ready for IFSCA Cyber
IFSCA Cyber Security and Cyber Resilience Guidelines · IFSC regulated entities (GIFT City)
IFSCA's 2025 cyber security and cyber resilience guidelines for every entity it licenses or registers in an International Financial Services Centre, including finance companies: board-level governance and a designated officer, a cyber framework and information security policy, third-party reviews, staff training, an annual independent audit, and incident reporting within six hours. Includes the March 2026 changes to the exemptions.
IFSCA CyberWhat is IFSCA Cyber?
IFSCA's 2025 cyber security and cyber resilience guidelines for every entity it licenses or registers in an International Financial Services Centre, including finance companies: board-level governance and a designated officer, a cyber framework and information security policy, third-party reviews, staff training, an annual independent audit, and incident reporting within six hours. Includes the March 2026 changes to the exemptions.
Who it applies to
Every entity that IFSCA licenses or registers in an International Financial Services Centre such as GIFT City, including finance companies. The 2026 circular revised which entities are exempt.
How the standard is organised
Numbered paragraphs grouped into nine areas: general principles, governance, a cyber security and cyber resilience framework, an information security policy, third-party risk management, communication and awareness, cyber security audit, incident reporting, and exemptions.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
IFSCA Cyber on the Bitkosh platform
The 34 IFSCA Cyber controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- 23Further exempt categories
Foreign universities in the IFSC, new standalone entities with no parent, and credit rating agencies are exempt for three years; the designated officer certifies risk-proportionate measures to IFSCA…
Exemptions and conditions - 17Annual audit without conflict, reported within 90 days
The auditor has no conflict of interest, the audit runs at least annually (more often if risk warrants), and the report reaches the IFSCA supervising department within 90 days of the financial year…
Cyber security audit - 21Time-limited exemption categories
Branches of regulated entities, entities serving only group companies, and entities with fewer than 10 employees are exempt for three years from issue; the entity records whether it relies on this and…
Exemptions and conditions - 18Reuse of audit report for exchange submissions
Broker dealers, bullion trading or clearing members and depository participants that already file a cyber audit report with a market infrastructure institution or bullion exchange send the same report…
Cyber security audit - 19Cyber incident notification to IFSCA within 6 hours
Particulars of any cyber incident are reported to IFSCA's cyber incident mailbox, copied to its CISO, no later than six hours after detection.
Incident reporting - 15Staff channels to report suspicious activity
Clear, accessible channels let employees report suspicious activity, vulnerabilities and potential cyber incidents.
Communication and awareness
More financial & operational resilience frameworks
Frequently Asked Questions
Who publishes IFSCA Cyber, and who does it apply to?
How is IFSCA Cyber conformance demonstrated?
How is IFSCA Cyber structured?
Ready to get audit-ready for IFSCA Cyber?
See how the Bitkosh Readiness Platform gets you audit-ready for IFSCA Cyber — and the other 47 ready frameworks — from a single control library.