Get audit-ready for IFSCA MII
IFSCA Cyber Guidelines for Market Infrastructure Institutions · Stock exchanges, clearing corporations and depositories in IFSC (GIFT City)
IFSCA's April 2026 cyber security and cyber resilience guidelines for the market infrastructure institutions it regulates in an International Financial Services Centre: 125 numbered requirements across Govern, Identify, Protect, Detect, Respond, Recover, Resilience, a 24x7 Cyber Security Operation Centre and an annual audit by a CERT-In empanelled auditor. Items that apply only to institutions designated critical information infrastructure or holding protected systems are set aside by the profile.
IFSCA MIIWhat is IFSCA MII?
IFSCA's April 2026 cyber security and cyber resilience guidelines for the market infrastructure institutions it regulates in an International Financial Services Centre: 125 numbered requirements across Govern, Identify, Protect, Detect, Respond, Recover, Resilience, a 24x7 Cyber Security Operation Centre and an annual audit by a CERT-In empanelled auditor. Items that apply only to institutions designated critical information infrastructure or holding protected systems are set aside by the profile.
Who it applies to
Market infrastructure institutions that IFSCA regulates in an International Financial Services Centre such as GIFT City: stock exchanges including the bullion exchange, clearing corporations and depositories. It is separate from the baseline guidelines that apply to every regulated entity.
How the standard is organised
Annexure A of the circular: 125 numbered paragraphs grouped into areas such as governance, identification, access controls, insider threat, physical and network security, awareness and training, incident response and recovery, and audit.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
IFSCA MII on the Bitkosh platform
The 125 IFSCA MII controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- 118Auditor rotation: three years, then a two-year cooling off
An auditing organisation may audit the institution for at most three consecutive years, then waits two years before auditing it again.
Periodic audit - 113Test results to SCOT, lessons to IFSCA in three months
Resilience test results go before the Standing Committee on Technology, and lessons learned are shared with IFSCA within 3 months of the financial year end.
Resilience - 68Time-bound revalidation after VAPT closure
Findings closed after testing are revalidated within a set time to confirm that every open vulnerability is fixed.
Hardening of hardware and software - 85Latest patches from authorised sources, virtual patching as interim
Operating systems and applications get the latest patches regularly from the vendor's authorised sites, and virtual patching may cover zero-day gaps where no patch exists.
Patch management - 77Twice-yearly VAPT for NCIIPC protected systems
Where NCIIPC has declared systems protected, VAPT runs twice a year (the text says bi-annual) and follows NCIIPC and CERT-In guidelines.
Vulnerability assessment and penetration testing - 59Offline encrypted backups tested periodically
Offline, encrypted backups are kept and tested regularly for confidentiality, integrity and availability.
Data security
More financial & operational resilience frameworks
Frequently Asked Questions
Who publishes IFSCA MII, and who does it apply to?
How is IFSCA MII conformance demonstrated?
How is IFSCA MII structured?
Ready to get audit-ready for IFSCA MII?
See how the Bitkosh Readiness Platform gets you audit-ready for IFSCA MII — and the other 47 ready frameworks — from a single control library.